-
-
Notifications
You must be signed in to change notification settings - Fork 4.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add command to synchronize specific ldap user #29326
Conversation
Signed-off-by: Guillaume COLSON <guillaume.colson@univ-lorraine.fr>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
see inline comment
I've tried to add dependency injection. It works well on my test instance. |
Co-authored-by: Carl Schwan <carl@carlschwan.eu> Signed-off-by: Guillaume COLSON <guillaume.colson@univ-lorraine.fr>
Signed-off-by: Guillaume COLSON <guillaume.colson@univ-lorraine.fr>
|
||
$connection = $access->getConnection(); | ||
|
||
$loginName = $access->escapeFilterPart($input->getArgument('uid')); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this will not work, because the user id is not necessarily (and not by default) a valid login name.
Oh, btw, why is occ ldap:check-user --update $uid
not sufficient?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi,
Thanks for following this PR.
The case I'm trying to address is when a new user appears in LDAP and needs to be synchronize in NC.
I want to speed up the process of creation of the account.
occ ldap:check-user --update $uid
doesn't synchronize to NC such users.
I get the following message
The given user is not a recognized LDAP user.
I assume that this script searches for the user in NC database and then update its attribute.
What I want is to search in LDAP(using the defined filter) the username passed in parameters and then
- If the user exists and is not present in NC, I want to create it <- that's what I want to do
- If it exists in the LDAP and is present in NC database, its attributes are updated
- If it doesn't exist, then print an error message
Concerning the first sentence in your comment, I believe (tell me if it's not the case) that my description is not accurate.
In fact, if the uid passed in parameter (toto in the example below) is not a valid login name, you get an error message indicating this fact.
php occ ldap:syncuser toto
No user found with uid : toto
Maybe I should change the name of the command by ldap:create-user
or ldap:add-user
to be more explicit.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi goyome,
thanks for this valuable input. Based on this, i would like to suggest following:
-
Rename the argument in
configure()
fromuid
tologinName
.uid
is typically used in Nextcloud to refer to the user id, while the login name can be one or more arbitrary LDAP attributes and some servers don't use uid. That way it is more clear for both users as well as developers to what to expect. -
$access = $this->backend->getLDAPAccess($uid);
in the current code may give you the wrong instancess ofAccess
since$uid
is most likely unknown. This affects setups with more than one LDAP server configured. TheUser_Proxy $backend
offers you a handy method however:$uid = $backend->loginName2UserName($loginName)
. It pulls yet unknown users, too. -
With
loginName2UserName()
from step 2 you can drop the manualfetchListOfUsers
because this is already done, and the user imported. The returnd$uid
isfalse
when no user was found, otherwise contains the user id in Nextcloud. -
Use the
$uid
from above to get the Access instance only for updating the user. It'S duplicated fromcheck-user --update
though. The logic fromCheckUser::updateUser()
might be split into a Trait and reused. -
For the output use
$backend->getDisplayName($uid)
, this fixes also the hardcodedcn
that might or might not be present. -
About naming of the command, i would strongly refrain from
create-user
oradd-user
as you might think it would create the user on the LDAP server. My suggestion would befind-user
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the time taken to help me understand how to improve the code.
I'm gonna update the PR soon.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
After testing this new approach, I'm inclined to modify check-user to add a new option (--map or --create) which will allow to map new user from ldap.
I tested it on my instance and it seems to be a better option.
What would be the best way to propose this modification ? I would be inclined to do a new PR and cancel this one as I'm doing it all over again. What do you think about that ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sure, you can go this way. Point out this PR in the new one to have a reference, should somebody ever want to look up things. I would prefer --fetch
or your suggested --map
as flag name, I am afraid create may cause confusion.
Add a new command to force sync LDAP user through cli.
Adress issue #27948