|
| 1 | +module RedmineLdapSync |
| 2 | + module RedmineExt |
| 3 | + module AuthSourceLdapPatch |
| 4 | + def self.included(base) |
| 5 | + base.class_eval do |
| 6 | + |
| 7 | + public |
| 8 | + def member_of?(login, group) |
| 9 | + ldap_con = initialize_ldap_con(self.account, self.account_password) |
| 10 | + login_filter = Net::LDAP::Filter.eq( self.attr_login, login ) |
| 11 | + user_filter = Net::LDAP::Filter.eq( 'objectClass', 'user' ) |
| 12 | + |
| 13 | + ldap_con.search(:base => self.base_dn, |
| 14 | + :filter => user_filter & login_filter, |
| 15 | + :attributes => ['memberof'], |
| 16 | + :return_result => false) do |entry| |
| 17 | + return entry['memberof'].include? group |
| 18 | + end |
| 19 | + |
| 20 | + end |
| 21 | + |
| 22 | + |
| 23 | + def sync_groups(user) |
| 24 | + return unless ldapsync_active? |
| 25 | + |
| 26 | + changes = groups_changes(user) |
| 27 | + changes[:added].each do |groupname| |
| 28 | + next if user.groups.detect { |g| g.to_s == groupname } |
| 29 | + |
| 30 | + group = Group.find_by_lastname(groupname) |
| 31 | + group = Group.create(:lastname => groupname, :auth_source_id => self.id) unless group |
| 32 | + group.users << user |
| 33 | + end |
| 34 | + |
| 35 | + changes[:deleted].each do |groupname| |
| 36 | + next unless group = user.groups.detect { |g| g.to_s == groupname } |
| 37 | + |
| 38 | + group.users.delete(user) |
| 39 | + end |
| 40 | + end |
| 41 | + |
| 42 | + def sync_users |
| 43 | + return unless ldapsync_active? |
| 44 | + |
| 45 | + ldap_users[:disabled].each do |login| |
| 46 | + user = User.find_by_login(login) |
| 47 | + |
| 48 | + user.lock! if user |
| 49 | + end |
| 50 | + ldap_users[:enabled].each do |login| |
| 51 | + user = User.find_by_login(login) |
| 52 | + |
| 53 | + unless user |
| 54 | + attrs = get_user_dn(login) |
| 55 | + user = User.create(attrs.except(:dn)) do |user| |
| 56 | + user.login = login |
| 57 | + user.language = Setting.default_language |
| 58 | + end |
| 59 | + end |
| 60 | + |
| 61 | + sync_groups(user) |
| 62 | + end |
| 63 | + end |
| 64 | + |
| 65 | + protected |
| 66 | + def ldap_users |
| 67 | + ldap_con = initialize_ldap_con(self.account, self.account_password) |
| 68 | + user_filter = Net::LDAP::Filter.eq( 'objectClass', 'user' ) |
| 69 | + attr_enabled = 'userAccountControl' |
| 70 | + users = {:enabled => [], :disabled => []} |
| 71 | + |
| 72 | + ldap_con.search(:base => self.base_dn, |
| 73 | + :filter => user_filter, |
| 74 | + :attributes => [self.attr_login, attr_enabled], |
| 75 | + :return_result => false) do |entry| |
| 76 | + if entry[attr_enabled][0].to_i & 2 == 0 |
| 77 | + users[:enabled] << entry[self.attr_login][0] |
| 78 | + else |
| 79 | + users[:disabled] << entry[self.attr_login][0] |
| 80 | + end |
| 81 | + end |
| 82 | + |
| 83 | + users |
| 84 | + end |
| 85 | + |
| 86 | + def groups_changes(user) |
| 87 | + return unless ldapsync_active? |
| 88 | + changes = { :added => [], :deleted => [] } |
| 89 | + |
| 90 | + ldap_con = initialize_ldap_con(self.account, self.account_password) |
| 91 | + login_filter = Net::LDAP::Filter.eq( self.attr_login, user.login ) |
| 92 | + user_filter = Net::LDAP::Filter.eq( 'objectClass', 'user' ) |
| 93 | + group_filter = Net::LDAP::Filter.eq( 'objectClass', 'group' ) |
| 94 | + attr_groupname = Setting.plugin_redmine_ldap_sync[self.name][:attr_groupname] |
| 95 | + groupname_filter = /#{Setting.plugin_redmine_ldap_sync[self.name][:groupname_filter]}/ |
| 96 | + groups_base_dn = Setting.plugin_redmine_ldap_sync[self.name][:groups_base_dn] |
| 97 | + |
| 98 | + # Faster, but requires all groups to be added to redmine with sync_groups |
| 99 | + #changes[:deleted] = user.groups.reject{|g| g.auth_source_id != self.id}.map(&:to_s) if user.groups |
| 100 | + ldap_con.open do |ldap| |
| 101 | + user_groups = user.groups.select {|g| groupname_filter =~ g.to_s} |
| 102 | + names_filter = user_groups.map {|g| Net::LDAP::Filter.eq( attr_groupname, g.to_s )}.reduce(:|) |
| 103 | + ldap.search(:base => groups_base_dn, |
| 104 | + :filter => group_filter & names_filter, |
| 105 | + :attributes => [attr_groupname], |
| 106 | + :return_result => false) do |entry| |
| 107 | + changes[:deleted] << entry[attr_groupname][0] |
| 108 | + end if names_filter |
| 109 | + |
| 110 | + groups = [] |
| 111 | + ldap.search(:base => self.base_dn, |
| 112 | + :filter => user_filter & login_filter, |
| 113 | + :attributes => ['memberof'], |
| 114 | + :return_result => false) do |entry| |
| 115 | + groups = entry['memberof'].select {|g| g.end_with?(groups_base_dn)} |
| 116 | + end |
| 117 | + |
| 118 | + names_filter = groups.map{|g| Net::LDAP::Filter.eq( 'distinguishedName', g )}.reduce(:|) |
| 119 | + ldap.search(:base => groups_base_dn, |
| 120 | + :filter => group_filter & names_filter, |
| 121 | + :attributes => [attr_groupname], |
| 122 | + :return_result => false) do |entry| |
| 123 | + group = entry[attr_groupname][0] |
| 124 | + changes[:added] << group if groupname_filter =~ group |
| 125 | + end if names_filter |
| 126 | + end |
| 127 | + |
| 128 | + changes[:deleted].reject! {|g| changes[:added].include?(g)} |
| 129 | + |
| 130 | + changes |
| 131 | + end |
| 132 | + |
| 133 | + def ldapsync_active? |
| 134 | + Setting.plugin_redmine_ldap_sync[self.name].present? && Setting.plugin_redmine_ldap_sync[self.name][:active] |
| 135 | + end |
| 136 | + end |
| 137 | + end |
| 138 | + end |
| 139 | + end |
| 140 | +end |
0 commit comments