Skip to content

Commit 034241b

Browse files
authored
Merge pull request #42017 from nextcloud/backport/41650/stable28
[stable28] feat(LDAP): implement IIsAdmin interface
2 parents 7ae780b + 26465f3 commit 034241b

File tree

9 files changed

+186
-2
lines changed

9 files changed

+186
-2
lines changed

apps/user_ldap/appinfo/info.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ A user logs into Nextcloud with their LDAP or AD credentials, and is granted acc
5151
<command>OCA\User_LDAP\Command\CheckGroup</command>
5252
<command>OCA\User_LDAP\Command\CreateEmptyConfig</command>
5353
<command>OCA\User_LDAP\Command\DeleteConfig</command>
54+
<command>OCA\User_LDAP\Command\PromoteGroup</command>
5455
<command>OCA\User_LDAP\Command\ResetGroup</command>
5556
<command>OCA\User_LDAP\Command\ResetUser</command>
5657
<command>OCA\User_LDAP\Command\Search</command>

apps/user_ldap/composer/composer/autoload_classmap.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
'OCA\\User_LDAP\\Command\\CheckUser' => $baseDir . '/../lib/Command/CheckUser.php',
1616
'OCA\\User_LDAP\\Command\\CreateEmptyConfig' => $baseDir . '/../lib/Command/CreateEmptyConfig.php',
1717
'OCA\\User_LDAP\\Command\\DeleteConfig' => $baseDir . '/../lib/Command/DeleteConfig.php',
18+
'OCA\\User_LDAP\\Command\\PromoteGroup' => $baseDir . '/../lib/Command/PromoteGroup.php',
1819
'OCA\\User_LDAP\\Command\\ResetGroup' => $baseDir . '/../lib/Command/ResetGroup.php',
1920
'OCA\\User_LDAP\\Command\\ResetUser' => $baseDir . '/../lib/Command/ResetUser.php',
2021
'OCA\\User_LDAP\\Command\\Search' => $baseDir . '/../lib/Command/Search.php',

apps/user_ldap/composer/composer/autoload_static.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ class ComposerStaticInitUser_LDAP
3030
'OCA\\User_LDAP\\Command\\CheckUser' => __DIR__ . '/..' . '/../lib/Command/CheckUser.php',
3131
'OCA\\User_LDAP\\Command\\CreateEmptyConfig' => __DIR__ . '/..' . '/../lib/Command/CreateEmptyConfig.php',
3232
'OCA\\User_LDAP\\Command\\DeleteConfig' => __DIR__ . '/..' . '/../lib/Command/DeleteConfig.php',
33+
'OCA\\User_LDAP\\Command\\PromoteGroup' => __DIR__ . '/..' . '/../lib/Command/PromoteGroup.php',
3334
'OCA\\User_LDAP\\Command\\ResetGroup' => __DIR__ . '/..' . '/../lib/Command/ResetGroup.php',
3435
'OCA\\User_LDAP\\Command\\ResetUser' => __DIR__ . '/..' . '/../lib/Command/ResetUser.php',
3536
'OCA\\User_LDAP\\Command\\Search' => __DIR__ . '/..' . '/../lib/Command/Search.php',
Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
/**
5+
* @copyright Copyright (c) 2023 Arthur Schiwon <[email protected]>
6+
*
7+
* @author Arthur Schiwon <[email protected]>
8+
*
9+
* @license GNU AGPL version 3 or any later version
10+
*
11+
* This program is free software: you can redistribute it and/or modify
12+
* it under the terms of the GNU Affero General Public License as
13+
* published by the Free Software Foundation, either version 3 of the
14+
* License, or (at your option) any later version.
15+
*
16+
* This program is distributed in the hope that it will be useful,
17+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
18+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19+
* GNU Affero General Public License for more details.
20+
*
21+
* You should have received a copy of the GNU Affero General Public License
22+
* along with this program. If not, see <http://www.gnu.org/licenses/>.
23+
*
24+
*/
25+
namespace OCA\User_LDAP\Command;
26+
27+
use OCA\User_LDAP\Group_Proxy;
28+
use OCP\IGroup;
29+
use OCP\IGroupManager;
30+
use Symfony\Component\Console\Command\Command;
31+
use Symfony\Component\Console\Helper\QuestionHelper;
32+
use Symfony\Component\Console\Input\InputArgument;
33+
use Symfony\Component\Console\Input\InputInterface;
34+
use Symfony\Component\Console\Input\InputOption;
35+
use Symfony\Component\Console\Output\OutputInterface;
36+
use Symfony\Component\Console\Question\Question;
37+
38+
class PromoteGroup extends Command {
39+
40+
public function __construct(
41+
private IGroupManager $groupManager,
42+
private Group_Proxy $backend
43+
) {
44+
parent::__construct();
45+
}
46+
47+
protected function configure(): void {
48+
$this
49+
->setName('ldap:promote-group')
50+
->setDescription('declares the specified group as admin group (only one is possible per LDAP configuration)')
51+
->addArgument(
52+
'group',
53+
InputArgument::REQUIRED,
54+
'the group ID in Nextcloud or a group name'
55+
)
56+
->addOption(
57+
'yes',
58+
'y',
59+
InputOption::VALUE_NONE,
60+
'do not ask for confirmation'
61+
);
62+
}
63+
64+
protected function formatGroupName(IGroup $group): string {
65+
$idLabel = '';
66+
if ($group->getGID() !== $group->getDisplayName()) {
67+
$idLabel = sprintf(' (Group ID: %s)', $group->getGID());
68+
}
69+
return sprintf('%s%s', $group->getDisplayName(), $idLabel);
70+
}
71+
72+
protected function promoteGroup(IGroup $group, InputInterface $input, OutputInterface $output): void {
73+
$access = $this->backend->getLDAPAccess($group->getGID());
74+
$currentlyPromotedGroupId = $access->connection->ldapAdminGroup;
75+
if ($currentlyPromotedGroupId === $group->getGID()) {
76+
$output->writeln('<info>The specified group is already promoted</info>');
77+
return;
78+
}
79+
80+
if ($input->getOption('yes') === false) {
81+
$currentlyPromotedGroup = $this->groupManager->get($currentlyPromotedGroupId);
82+
$demoteLabel = '';
83+
if ($currentlyPromotedGroup instanceof IGroup && $this->backend->groupExists($currentlyPromotedGroup->getGID())) {
84+
$groupNameLabel = $this->formatGroupName($currentlyPromotedGroup);
85+
$demoteLabel = sprintf('and demote %s ', $groupNameLabel);
86+
}
87+
88+
/** @var QuestionHelper $helper */
89+
$helper = $this->getHelper('question');
90+
$q = new Question(sprintf('Promote %s to the admin group %s(y|N)? ', $this->formatGroupName($group), $demoteLabel));
91+
$input->setOption('yes', $helper->ask($input, $output, $q) === 'y');
92+
}
93+
if ($input->getOption('yes') === true) {
94+
$access->connection->setConfiguration(['ldapAdminGroup' => $group->getGID()]);
95+
$access->connection->saveConfiguration();
96+
$output->writeln(sprintf('<info>Group %s was promoted</info>', $group->getDisplayName()));
97+
} else {
98+
$output->writeln('<comment>Group promotion cancelled</comment>');
99+
}
100+
}
101+
102+
protected function execute(InputInterface $input, OutputInterface $output): int {
103+
$groupInput = (string)$input->getArgument('group');
104+
$group = $this->groupManager->get($groupInput);
105+
106+
if ($group instanceof IGroup && $this->backend->groupExists($group->getGID())) {
107+
$this->promoteGroup($group, $input, $output);
108+
return 0;
109+
}
110+
111+
$groupCandidates = $this->backend->getGroups($groupInput, 20);
112+
foreach ($groupCandidates as $gidCandidate) {
113+
$group = $this->groupManager->get($gidCandidate);
114+
if ($group !== null
115+
&& $this->backend->groupExists($group->getGID()) // ensure it is an LDAP group
116+
&& ($group->getGID() === $groupInput
117+
|| $group->getDisplayName() === $groupInput)
118+
) {
119+
$this->promoteGroup($group, $input, $output);
120+
return 0;
121+
}
122+
}
123+
124+
$output->writeln('<error>No matching group found</error>');
125+
return 1;
126+
}
127+
128+
}

apps/user_ldap/lib/Configuration.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ class Configuration {
134134
'ldapAttributeRole' => null,
135135
'ldapAttributeHeadline' => null,
136136
'ldapAttributeBiography' => null,
137+
'ldapAdminGroup' => '',
137138
];
138139

139140
public function __construct(string $configPrefix, bool $autoRead = true) {
@@ -490,6 +491,7 @@ public function getDefaults(): array {
490491
'ldap_attr_role' => '',
491492
'ldap_attr_headline' => '',
492493
'ldap_attr_biography' => '',
494+
'ldap_admin_group' => '',
493495
];
494496
}
495497

@@ -566,6 +568,7 @@ public function getConfigTranslationArray(): array {
566568
'ldap_attr_role' => 'ldapAttributeRole',
567569
'ldap_attr_headline' => 'ldapAttributeHeadline',
568570
'ldap_attr_biography' => 'ldapAttributeBiography',
571+
'ldap_admin_group' => 'ldapAdminGroup',
569572
];
570573
return $array;
571574
}

apps/user_ldap/lib/Connection.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@
8383
* @property string ldapAttributeRole
8484
* @property string ldapAttributeHeadline
8585
* @property string ldapAttributeBiography
86+
* @property string ldapAdminGroup
8687
*/
8788
class Connection extends LDAPUtility {
8889
/**

apps/user_ldap/lib/Group_LDAP.php

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,14 +51,15 @@
5151
use OCP\Group\Backend\ABackend;
5252
use OCP\Group\Backend\IDeleteGroupBackend;
5353
use OCP\Group\Backend\IGetDisplayNameBackend;
54+
use OCP\Group\Backend\IIsAdminBackend;
5455
use OCP\GroupInterface;
5556
use OCP\IConfig;
5657
use OCP\IUserManager;
5758
use OCP\Server;
5859
use Psr\Log\LoggerInterface;
5960
use function json_decode;
6061

61-
class Group_LDAP extends ABackend implements GroupInterface, IGroupLDAP, IGetDisplayNameBackend, IDeleteGroupBackend {
62+
class Group_LDAP extends ABackend implements GroupInterface, IGroupLDAP, IGetDisplayNameBackend, IDeleteGroupBackend, IIsAdminBackend {
6263
protected bool $enabled = false;
6364

6465
/** @var CappedMemoryCache<string[]> $cachedGroupMembers array of user DN with gid as key */
@@ -1241,6 +1242,7 @@ protected function filterValidGroups(array $listOfGroups): array {
12411242
public function implementsActions($actions): bool {
12421243
return (bool)((GroupInterface::COUNT_USERS |
12431244
GroupInterface::DELETE_GROUP |
1245+
GroupInterface::IS_ADMIN |
12441246
$this->groupPluginManager->getImplementedActions()) & $actions);
12451247
}
12461248

@@ -1444,4 +1446,18 @@ public function addRelationshipToCaches(string $uid, ?string $dnUser, string $gi
14441446
// $cacheKey = 'usersInGroup-' . $gid . '-' . $search;
14451447
// $cacheKey = 'countUsersInGroup-' . $gid . '-' . $search;
14461448
}
1449+
1450+
/**
1451+
* @throws ServerNotAvailableException
1452+
*/
1453+
public function isAdmin(string $uid): bool {
1454+
if (!$this->enabled) {
1455+
return false;
1456+
}
1457+
$ldapAdminGroup = $this->access->connection->ldapAdminGroup;
1458+
if ($ldapAdminGroup === '') {
1459+
return false;
1460+
}
1461+
return $this->inGroup($uid, $ldapAdminGroup);
1462+
}
14471463
}

apps/user_ldap/lib/Group_Proxy.php

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,13 @@
3333
use OCP\Group\Backend\IDeleteGroupBackend;
3434
use OCP\Group\Backend\IGetDisplayNameBackend;
3535
use OCP\Group\Backend\IGroupDetailsBackend;
36+
use OCP\Group\Backend\IIsAdminBackend;
3637
use OCP\Group\Backend\INamedBackend;
3738
use OCP\GroupInterface;
3839
use OCP\IConfig;
3940
use OCP\IUserManager;
4041

41-
class Group_Proxy extends Proxy implements \OCP\GroupInterface, IGroupLDAP, IGetDisplayNameBackend, INamedBackend, IDeleteGroupBackend, IBatchMethodsBackend {
42+
class Group_Proxy extends Proxy implements \OCP\GroupInterface, IGroupLDAP, IGetDisplayNameBackend, INamedBackend, IDeleteGroupBackend, IBatchMethodsBackend, IIsAdminBackend {
4243
private $backends = [];
4344
private ?Group_LDAP $refBackend = null;
4445
private Helper $helper;
@@ -396,4 +397,8 @@ public function searchInGroup(string $gid, string $search = '', int $limit = -1,
396397
public function addRelationshipToCaches(string $uid, ?string $dnUser, string $gid): void {
397398
$this->handleRequest($gid, 'addRelationshipToCaches', [$uid, $dnUser, $gid]);
398399
}
400+
401+
public function isAdmin(string $uid): bool {
402+
return $this->handleRequest($uid, 'isAdmin', [$uid]);
403+
}
399404
}

build/integration/ldap_features/openldap-numerical-id.feature

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,3 +66,31 @@ Scenario: Test LDAP group membership with intermediate groups not matching filte
6666
| 50194 | 1 |
6767
| 59376 | 1 |
6868
| 59463 | 1 |
69+
70+
Scenario: Test LDAP admin group mapping, empowered user
71+
Given modify LDAP configuration
72+
| ldapBaseGroups | ou=NumericGroups,dc=nextcloud,dc=ci |
73+
| ldapGroupFilter | (objectclass=groupOfNames) |
74+
| ldapGroupMemberAssocAttr | member |
75+
| ldapAdminGroup | 3001 |
76+
| useMemberOfToDetectMembership | 1 |
77+
And cookies are reset
78+
# alice, part of the promoted group
79+
And Logging in using web as "92379"
80+
And sending "GET" to "/cloud/groups"
81+
And sending "GET" to "/cloud/groups/2000/users"
82+
And Sending a "GET" to "/index.php/settings/admin/overview" with requesttoken
83+
Then the HTTP status code should be "200"
84+
85+
Scenario: Test LDAP admin group mapping, regular user (no access)
86+
Given modify LDAP configuration
87+
| ldapBaseGroups | ou=NumericGroups,dc=nextcloud,dc=ci |
88+
| ldapGroupFilter | (objectclass=groupOfNames) |
89+
| ldapGroupMemberAssocAttr | member |
90+
| ldapAdminGroup | 3001 |
91+
| useMemberOfToDetectMembership | 1 |
92+
And cookies are reset
93+
# gustaf, not part of the promoted group
94+
And Logging in using web as "59376"
95+
And Sending a "GET" to "/index.php/settings/admin/overview" with requesttoken
96+
Then the HTTP status code should be "403"

0 commit comments

Comments
 (0)