Skip to content

Commit dc1520c

Browse files
blizzzblizzz
committed
enh(LDAP): add occ command to promote an LDAP group to admin
Signed-off-by: Arthur Schiwon <[email protected]>
1 parent 3fea94f commit dc1520c

File tree

4 files changed

+154
-0
lines changed

4 files changed

+154
-0
lines changed

‎apps/user_ldap/appinfo/info.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ A user logs into Nextcloud with their LDAP or AD credentials, and is granted acc
5151
<command>OCA\User_LDAP\Command\CheckGroup</command>
5252
<command>OCA\User_LDAP\Command\CreateEmptyConfig</command>
5353
<command>OCA\User_LDAP\Command\DeleteConfig</command>
54+
<command>OCA\User_LDAP\Command\PromoteGroup</command>
5455
<command>OCA\User_LDAP\Command\ResetGroup</command>
5556
<command>OCA\User_LDAP\Command\ResetUser</command>
5657
<command>OCA\User_LDAP\Command\Search</command>

‎apps/user_ldap/composer/composer/autoload_classmap.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
'OCA\\User_LDAP\\Command\\CheckUser' => $baseDir . '/../lib/Command/CheckUser.php',
1616
'OCA\\User_LDAP\\Command\\CreateEmptyConfig' => $baseDir . '/../lib/Command/CreateEmptyConfig.php',
1717
'OCA\\User_LDAP\\Command\\DeleteConfig' => $baseDir . '/../lib/Command/DeleteConfig.php',
18+
'OCA\\User_LDAP\\Command\\PromoteGroup' => $baseDir . '/../lib/Command/PromoteGroup.php',
1819
'OCA\\User_LDAP\\Command\\ResetGroup' => $baseDir . '/../lib/Command/ResetGroup.php',
1920
'OCA\\User_LDAP\\Command\\ResetUser' => $baseDir . '/../lib/Command/ResetUser.php',
2021
'OCA\\User_LDAP\\Command\\Search' => $baseDir . '/../lib/Command/Search.php',

‎apps/user_ldap/composer/composer/autoload_static.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ class ComposerStaticInitUser_LDAP
3030
'OCA\\User_LDAP\\Command\\CheckUser' => __DIR__ . '/..' . '/../lib/Command/CheckUser.php',
3131
'OCA\\User_LDAP\\Command\\CreateEmptyConfig' => __DIR__ . '/..' . '/../lib/Command/CreateEmptyConfig.php',
3232
'OCA\\User_LDAP\\Command\\DeleteConfig' => __DIR__ . '/..' . '/../lib/Command/DeleteConfig.php',
33+
'OCA\\User_LDAP\\Command\\PromoteGroup' => __DIR__ . '/..' . '/../lib/Command/PromoteGroup.php',
3334
'OCA\\User_LDAP\\Command\\ResetGroup' => __DIR__ . '/..' . '/../lib/Command/ResetGroup.php',
3435
'OCA\\User_LDAP\\Command\\ResetUser' => __DIR__ . '/..' . '/../lib/Command/ResetUser.php',
3536
'OCA\\User_LDAP\\Command\\Search' => __DIR__ . '/..' . '/../lib/Command/Search.php',

‎apps/user_ldap/lib/Command/PromoteGroup.php‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
/**
5+
* @copyright Copyright (c) 2023 Arthur Schiwon <[email protected]>
6+
*
7+
* @author Arthur Schiwon <[email protected]>
8+
*
9+
* @license GNU AGPL version 3 or any later version
10+
*
11+
* This program is free software: you can redistribute it and/or modify
12+
* it under the terms of the GNU Affero General Public License as
13+
* published by the Free Software Foundation, either version 3 of the
14+
* License, or (at your option) any later version.
15+
*
16+
* This program is distributed in the hope that it will be useful,
17+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
18+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19+
* GNU Affero General Public License for more details.
20+
*
21+
* You should have received a copy of the GNU Affero General Public License
22+
* along with this program. If not, see <http://www.gnu.org/licenses/>.
23+
*
24+
*/
25+
namespace OCA\User_LDAP\Command;
26+
27+
use OCA\User_LDAP\Group_Proxy;
28+
use OCP\IGroup;
29+
use OCP\IGroupManager;
30+
use Symfony\Component\Console\Command\Command;
31+
use Symfony\Component\Console\Helper\QuestionHelper;
32+
use Symfony\Component\Console\Input\InputArgument;
33+
use Symfony\Component\Console\Input\InputInterface;
34+
use Symfony\Component\Console\Input\InputOption;
35+
use Symfony\Component\Console\Output\OutputInterface;
36+
use Symfony\Component\Console\Question\Question;
37+
38+
class PromoteGroup extends Command {
39+
private IGroupManager $groupManager;
40+
private Group_Proxy $backend;
41+
42+
public function __construct(
43+
IGroupManager $groupManager,
44+
Group_Proxy $backend
45+
) {
46+
$this->groupManager = $groupManager;
47+
$this->backend = $backend;
48+
parent::__construct();
49+
}
50+
51+
protected function configure(): void {
52+
$this
53+
->setName('ldap:promote-group')
54+
->setDescription('declares the specified group as admin group (only one is possible per LDAP configuration)')
55+
->addArgument(
56+
'group',
57+
InputArgument::REQUIRED,
58+
'the group ID in Nextcloud or a group name'
59+
)
60+
->addOption(
61+
'yes',
62+
'y',
63+
InputOption::VALUE_NONE,
64+
'do not ask for confirmation'
65+
)
66+
->addOption(
67+
'demote',
68+
'd',
69+
InputOption::VALUE_NONE,
70+
'demote the specified group instead'
71+
);
72+
}
73+
74+
protected function promoteGroup(IGroup $group, InputInterface $input, OutputInterface $output): void {
75+
if ($input->getOption('yes') === false) {
76+
/** @var QuestionHelper $helper */
77+
$helper = $this->getHelper('question');
78+
79+
$idLabel = '';
80+
if ($group->getGID() !== $group->getDisplayName()) {
81+
$idLabel = sprintf(' (Group ID: %s)', $group->getGID());
82+
}
83+
84+
$q = new Question(sprintf('Promote %s%s to the admin group (y|N)? ', $group->getDisplayName(), $idLabel));
85+
$input->setOption('yes', $helper->ask($input, $output, $q) === 'y');
86+
}
87+
if ($input->getOption('yes') === true) {
88+
$access = $this->backend->getLDAPAccess($group->getGID());
89+
$access->connection->setConfiguration(['ldapAdminGroup' => $group->getGID()]);
90+
$access->connection->saveConfiguration();
91+
$output->writeln(sprintf('<info>Group %s was promoted</info>', $group->getDisplayName()));
92+
} else {
93+
$output->writeln('<comment>Group promotion cancelled</comment>');
94+
}
95+
}
96+
97+
protected function demoteGroup(IGroup $group, InputInterface $input, OutputInterface $output): void {
98+
$access = $this->backend->getLDAPAccess($group->getGID());
99+
100+
if ($input->getOption('yes') === false) {
101+
/** @var QuestionHelper $helper */
102+
$helper = $this->getHelper('question');
103+
104+
$idLabel = '';
105+
if ($group->getGID() !== $group->getDisplayName()) {
106+
$idLabel = sprintf(' (Group ID: %s)', $group->getGID());
107+
}
108+
109+
$q = new Question(sprintf('Demote %s%s from being an admin group (y|N)? ', $group->getDisplayName(), $idLabel));
110+
$input->setOption('yes', $helper->ask($input, $output, $q) === 'y');
111+
}
112+
if ($input->getOption('yes') === true) {
113+
$access = $this->backend->getLDAPAccess($group->getGID());
114+
$access->connection->setConfiguration(['ldapAdminGroup' => '']);
115+
$access->connection->saveConfiguration();
116+
$output->writeln(sprintf('<info>Group %s was demoted</info>', $group->getDisplayName()));
117+
} else {
118+
$output->writeln('<comment>Group demotion cancelled</comment>');
119+
}
120+
}
121+
122+
protected function execute(InputInterface $input, OutputInterface $output): int {
123+
$groupInput = (string)$input->getArgument('group');
124+
$group = $this->groupManager->get($groupInput);
125+
126+
if ($group instanceof IGroup && $this->backend->groupExists($group->getGID())) {
127+
if ($input->getOption('demote') === true) {
128+
129+
}
130+
$this->promoteGroup($group, $input, $output);
131+
return 0;
132+
}
133+
134+
$groupCandidates = $this->backend->getGroups($groupInput, 20);
135+
foreach ($groupCandidates as $gidCandidate) {
136+
$group = $this->groupManager->get($gidCandidate);
137+
if ($group !== null
138+
&& $this->backend->groupExists($group->getGID()) // ensure it is an LDAP group
139+
&& ($group->getGID() === $groupInput
140+
|| $group->getDisplayName() === $groupInput)
141+
) {
142+
$this->promoteGroup($group, $input, $output);
143+
return 0;
144+
}
145+
}
146+
147+
$output->writeln('<error>No matching group found</error>');
148+
return 1;
149+
}
150+
151+
}

0 commit comments

Comments
 (0)