diff --git a/.drone.yml b/.drone.yml
index 5a76da3d19e04..7a0618b52ad96 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -581,6 +581,7 @@ services:
MYSQL_USER: oc_autotest
MYSQL_PASSWORD: owncloud
MYSQL_DATABASE: oc_autotest
+ command: [ "--max_allowed_packet=67108864" ]
tmpfs:
- /var/lib/mysql
trigger:
diff --git a/apps/user_ldap/appinfo/info.xml b/apps/user_ldap/appinfo/info.xml
index ac62d39c2ad1f..d9f59adef1e2c 100644
--- a/apps/user_ldap/appinfo/info.xml
+++ b/apps/user_ldap/appinfo/info.xml
@@ -9,7 +9,7 @@
A user logs into Nextcloud with their LDAP or AD credentials, and is granted access based on an authentication request handled by the LDAP or AD server. Nextcloud does not store LDAP or AD passwords, rather these credentials are used to authenticate a user and then Nextcloud uses a session for the user ID. More information is available in the LDAP User and Group Backend documentation.
- 1.10.3
+ 1.10.4
agpl
Dominik Schmidt
Arthur Schiwon
diff --git a/apps/user_ldap/composer/composer/autoload_classmap.php b/apps/user_ldap/composer/composer/autoload_classmap.php
index bd13a97877f38..e2892d3361a18 100644
--- a/apps/user_ldap/composer/composer/autoload_classmap.php
+++ b/apps/user_ldap/composer/composer/autoload_classmap.php
@@ -59,6 +59,7 @@
'OCA\\User_LDAP\\Migration\\UUIDFixUser' => $baseDir . '/../lib/Migration/UUIDFixUser.php',
'OCA\\User_LDAP\\Migration\\Version1010Date20200630192842' => $baseDir . '/../lib/Migration/Version1010Date20200630192842.php',
'OCA\\User_LDAP\\Migration\\Version1120Date20210917155206' => $baseDir . '/../lib/Migration/Version1120Date20210917155206.php',
+ 'OCA\\User_LDAP\\Migration\\Version1130Date20211102154716' => $baseDir . '/../lib/Migration/Version1130Date20211102154716.php',
'OCA\\User_LDAP\\Notification\\Notifier' => $baseDir . '/../lib/Notification/Notifier.php',
'OCA\\User_LDAP\\PagedResults\\IAdapter' => $baseDir . '/../lib/PagedResults/IAdapter.php',
'OCA\\User_LDAP\\PagedResults\\Php54' => $baseDir . '/../lib/PagedResults/Php54.php',
diff --git a/apps/user_ldap/composer/composer/autoload_static.php b/apps/user_ldap/composer/composer/autoload_static.php
index ef40b451fe848..c0698a69dd0f4 100644
--- a/apps/user_ldap/composer/composer/autoload_static.php
+++ b/apps/user_ldap/composer/composer/autoload_static.php
@@ -74,6 +74,7 @@ class ComposerStaticInitUser_LDAP
'OCA\\User_LDAP\\Migration\\UUIDFixUser' => __DIR__ . '/..' . '/../lib/Migration/UUIDFixUser.php',
'OCA\\User_LDAP\\Migration\\Version1010Date20200630192842' => __DIR__ . '/..' . '/../lib/Migration/Version1010Date20200630192842.php',
'OCA\\User_LDAP\\Migration\\Version1120Date20210917155206' => __DIR__ . '/..' . '/../lib/Migration/Version1120Date20210917155206.php',
+ 'OCA\\User_LDAP\\Migration\\Version1130Date20211102154716' => __DIR__ . '/..' . '/../lib/Migration/Version1130Date20211102154716.php',
'OCA\\User_LDAP\\Notification\\Notifier' => __DIR__ . '/..' . '/../lib/Notification/Notifier.php',
'OCA\\User_LDAP\\PagedResults\\IAdapter' => __DIR__ . '/..' . '/../lib/PagedResults/IAdapter.php',
'OCA\\User_LDAP\\PagedResults\\Php54' => __DIR__ . '/..' . '/../lib/PagedResults/Php54.php',
diff --git a/apps/user_ldap/lib/Mapping/AbstractMapping.php b/apps/user_ldap/lib/Mapping/AbstractMapping.php
index 47d69a96071d9..29c962b336e19 100644
--- a/apps/user_ldap/lib/Mapping/AbstractMapping.php
+++ b/apps/user_ldap/lib/Mapping/AbstractMapping.php
@@ -67,6 +67,7 @@ public function __construct(\OCP\IDBConnection $dbc) {
public function isColNameValid($col) {
switch ($col) {
case 'ldap_dn':
+ case 'ldap_dn_hash':
case 'owncloud_name':
case 'directory_uuid':
return true;
@@ -142,11 +143,11 @@ public function setDNbyUUID($fdn, $uuid) {
$oldDn = $this->getDnByUUID($uuid);
$query = $this->dbc->prepare('
UPDATE `' . $this->getTableName() . '`
- SET `ldap_dn` = ?
+ SET `ldap_dn_hash` = ?, `ldap_dn` = ?
WHERE `directory_uuid` = ?
');
- $r = $this->modify($query, [$fdn, $uuid]);
+ $r = $this->modify($query, [$this->getDNHash($fdn), $fdn, $uuid]);
if ($r && is_string($oldDn) && isset($this->cache[$oldDn])) {
$this->cache[$fdn] = $this->cache[$oldDn];
@@ -169,12 +170,24 @@ public function setUUIDbyDN($uuid, $fdn) {
$query = $this->dbc->prepare('
UPDATE `' . $this->getTableName() . '`
SET `directory_uuid` = ?
- WHERE `ldap_dn` = ?
+ WHERE `ldap_dn_hash` = ?
');
unset($this->cache[$fdn]);
- return $this->modify($query, [$uuid, $fdn]);
+ return $this->modify($query, [$uuid, $this->getDNHash($fdn)]);
+ }
+
+ /**
+ * Get the hash to store in database column ldap_dn_hash for a given dn
+ */
+ protected function getDNHash(string $fdn): string {
+ $hash = hash('sha256', $fdn, false);
+ if (is_string($hash)) {
+ return $hash;
+ } else {
+ throw new \RuntimeException('hash function did not return a string');
+ }
}
/**
@@ -185,16 +198,19 @@ public function setUUIDbyDN($uuid, $fdn) {
*/
public function getNameByDN($fdn) {
if (!isset($this->cache[$fdn])) {
- $this->cache[$fdn] = $this->getXbyY('owncloud_name', 'ldap_dn', $fdn);
+ $this->cache[$fdn] = $this->getXbyY('owncloud_name', 'ldap_dn_hash', $this->getDNHash($fdn));
}
return $this->cache[$fdn];
}
- protected function prepareListOfIdsQuery(array $dnList): IQueryBuilder {
+ /**
+ * @param array $hashList
+ */
+ protected function prepareListOfIdsQuery(array $hashList): IQueryBuilder {
$qb = $this->dbc->getQueryBuilder();
- $qb->select('owncloud_name', 'ldap_dn')
+ $qb->select('owncloud_name', 'ldap_dn_hash', 'ldap_dn')
->from($this->getTableName(false))
- ->where($qb->expr()->in('ldap_dn', $qb->createNamedParameter($dnList, QueryBuilder::PARAM_STR_ARRAY)));
+ ->where($qb->expr()->in('ldap_dn_hash', $qb->createNamedParameter($hashList, QueryBuilder::PARAM_STR_ARRAY)));
return $qb;
}
@@ -207,6 +223,10 @@ protected function collectResultsFromListOfIdsQuery(IQueryBuilder $qb, array &$r
$stmt->closeCursor();
}
+ /**
+ * @param array $fdns
+ * @return array
+ */
public function getListOfIdsByDn(array $fdns): array {
$totalDBParamLimit = 65000;
$sliceSize = 1000;
@@ -214,6 +234,7 @@ public function getListOfIdsByDn(array $fdns): array {
$results = [];
$slice = 1;
+ $fdns = array_map([$this, 'getDNHash'], $fdns);
$fdnsSlice = count($fdns) > $sliceSize ? array_slice($fdns, 0, $sliceSize) : $fdns;
$qb = $this->prepareListOfIdsQuery($fdnsSlice);
@@ -231,7 +252,7 @@ public function getListOfIdsByDn(array $fdns): array {
}
if (!empty($fdnsSlice)) {
- $qb->orWhere($qb->expr()->in('ldap_dn', $qb->createNamedParameter($fdnsSlice, QueryBuilder::PARAM_STR_ARRAY)));
+ $qb->orWhere($qb->expr()->in('ldap_dn_hash', $qb->createNamedParameter($fdnsSlice, QueryBuilder::PARAM_STR_ARRAY)));
}
if ($slice % $maxSlices === 0) {
@@ -294,7 +315,7 @@ public function getDnByUUID($uuid) {
* @throws \Exception
*/
public function getUUIDByDN($dn) {
- return $this->getXbyY('directory_uuid', 'ldap_dn', $dn);
+ return $this->getXbyY('directory_uuid', 'ldap_dn_hash', $this->getDNHash($dn));
}
/**
@@ -328,9 +349,9 @@ public function getList($offset = null, $limit = null) {
* @return bool
*/
public function map($fdn, $name, $uuid) {
- if (mb_strlen($fdn) > 255) {
+ if (mb_strlen($fdn) > 4096) {
\OC::$server->getLogger()->error(
- 'Cannot map, because the DN exceeds 255 characters: {dn}',
+ 'Cannot map, because the DN exceeds 4096 characters: {dn}',
[
'app' => 'user_ldap',
'dn' => $fdn,
@@ -340,6 +361,7 @@ public function map($fdn, $name, $uuid) {
}
$row = [
+ 'ldap_dn_hash' => $this->getDNHash($fdn),
'ldap_dn' => $fdn,
'owncloud_name' => $name,
'directory_uuid' => $uuid
@@ -416,7 +438,7 @@ public function clearCb(callable $preCallback, callable $postCallback): bool {
*/
public function count() {
$qb = $this->dbc->getQueryBuilder();
- $query = $qb->select($qb->func()->count('ldap_dn'))
+ $query = $qb->select($qb->func()->count('ldap_dn_hash'))
->from($this->getTableName());
$res = $query->execute();
$count = $res->fetchColumn();
diff --git a/apps/user_ldap/lib/Migration/Version1010Date20200630192842.php b/apps/user_ldap/lib/Migration/Version1010Date20200630192842.php
index 484607052e115..c065eca0fa09c 100644
--- a/apps/user_ldap/lib/Migration/Version1010Date20200630192842.php
+++ b/apps/user_ldap/lib/Migration/Version1010Date20200630192842.php
@@ -60,8 +60,13 @@ public function changeSchema(IOutput $output, Closure $schemaClosure, array $opt
'length' => 255,
'default' => '',
]);
+ $table->addColumn('ldap_dn_hash', Types::STRING, [
+ 'notnull' => false,
+ 'length' => 64,
+ ]);
$table->setPrimaryKey(['owncloud_name']);
- $table->addUniqueIndex(['ldap_dn'], 'ldap_dn_users');
+ $table->addUniqueIndex(['ldap_dn_hash'], 'ldap_user_dn_hashes');
+ $table->addUniqueIndex(['directory_uuid'], 'ldap_user_directory_uuid');
}
if (!$schema->hasTable('ldap_group_mapping')) {
@@ -81,8 +86,13 @@ public function changeSchema(IOutput $output, Closure $schemaClosure, array $opt
'length' => 255,
'default' => '',
]);
- $table->setPrimaryKey(['ldap_dn']);
- $table->addUniqueIndex(['owncloud_name'], 'owncloud_name_groups');
+ $table->addColumn('ldap_dn_hash', Types::STRING, [
+ 'notnull' => false,
+ 'length' => 64,
+ ]);
+ $table->setPrimaryKey(['owncloud_name']);
+ $table->addUniqueIndex(['ldap_dn_hash'], 'ldap_group_dn_hashes');
+ $table->addUniqueIndex(['directory_uuid'], 'ldap_group_directory_uuid');
}
if (!$schema->hasTable('ldap_group_members')) {
diff --git a/apps/user_ldap/lib/Migration/Version1120Date20210917155206.php b/apps/user_ldap/lib/Migration/Version1120Date20210917155206.php
index e8d9e0f7a7bd3..cea7f62683225 100644
--- a/apps/user_ldap/lib/Migration/Version1120Date20210917155206.php
+++ b/apps/user_ldap/lib/Migration/Version1120Date20210917155206.php
@@ -2,6 +2,28 @@
declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2020 Joas Schilling
+ *
+ * @author Arthur Schiwon
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see .
+ *
+ */
+
namespace OCA\User_LDAP\Migration;
use Closure;
diff --git a/apps/user_ldap/lib/Migration/Version1130Date20211102154716.php b/apps/user_ldap/lib/Migration/Version1130Date20211102154716.php
new file mode 100644
index 0000000000000..80a6f0650da2a
--- /dev/null
+++ b/apps/user_ldap/lib/Migration/Version1130Date20211102154716.php
@@ -0,0 +1,168 @@
+
+ *
+ * @author Côme Chilliet
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see .
+ *
+ */
+
+namespace OCA\User_LDAP\Migration;
+
+use Closure;
+use OCP\DB\Exception;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\DB\Types;
+use OCP\IDBConnection;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+use Psr\Log\LoggerInterface;
+
+class Version1130Date20211102154716 extends SimpleMigrationStep {
+
+ /** @var IDBConnection */
+ private $dbc;
+ /** @var LoggerInterface */
+ private $logger;
+
+ public function __construct(IDBConnection $dbc, LoggerInterface $logger) {
+ $this->dbc = $dbc;
+ $this->logger = $logger;
+ }
+
+ public function getName() {
+ return 'Adjust LDAP user and group ldap_dn column lengths and add ldap_dn_hash columns';
+ }
+
+ /**
+ * @param IOutput $output
+ * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
+ * @param array $options
+ * @return null|ISchemaWrapper
+ */
+ public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+ /** @var ISchemaWrapper $schema */
+ $schema = $schemaClosure();
+
+ $changeSchema = false;
+ foreach (['ldap_user_mapping', 'ldap_group_mapping'] as $tableName) {
+ $table = $schema->getTable($tableName);
+ if (!$table->hasColumn('ldap_dn_hash')) {
+ $table->addColumn('ldap_dn_hash', Types::STRING, [
+ 'notnull' => false,
+ 'length' => 64,
+ ]);
+ $changeSchema = true;
+ }
+ $column = $table->getColumn('ldap_dn');
+ if ($column->getLength() < 4096) {
+ $column->setLength(4096);
+ $changeSchema = true;
+ }
+ if ($tableName === 'ldap_user_mapping') {
+ if ($table->hasIndex('ldap_dn_users')) {
+ $table->dropIndex('ldap_dn_users');
+ $changeSchema = true;
+ }
+ if (!$table->hasIndex('ldap_user_dn_hashes')) {
+ $table->addUniqueIndex(['ldap_dn_hash'], 'ldap_user_dn_hashes');
+ $changeSchema = true;
+ }
+ if (!$table->hasIndex('ldap_user_directory_uuid')) {
+ $table->addUniqueIndex(['directory_uuid'], 'ldap_user_directory_uuid');
+ $changeSchema = true;
+ }
+ } else {
+ if ($table->hasIndex('owncloud_name_groups')) {
+ $table->dropIndex('owncloud_name_groups');
+ $changeSchema = true;
+ }
+ if (!$table->hasIndex('ldap_group_dn_hashes')) {
+ $table->addUniqueIndex(['ldap_dn_hash'], 'ldap_group_dn_hashes');
+ $changeSchema = true;
+ }
+ if (!$table->hasIndex('ldap_group_directory_uuid')) {
+ $table->addUniqueIndex(['directory_uuid'], 'ldap_group_directory_uuid');
+ $changeSchema = true;
+ }
+ if (!$table->hasPrimaryKey() || ($table->getPrimaryKeyColumns() !== ['owncloud_name'])) {
+ $table->dropPrimaryKey();
+ $table->setPrimaryKey(['owncloud_name']);
+ $changeSchema = true;
+ }
+ }
+ }
+
+ return $changeSchema ? $schema : null;
+ }
+
+ /**
+ * @param IOutput $output
+ * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
+ * @param array $options
+ */
+ public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options) {
+ $this->handleDNHashes('ldap_group_mapping');
+ $this->handleDNHashes('ldap_user_mapping');
+ }
+
+ protected function handleDNHashes(string $table): void {
+ $select = $this->getSelectQuery($table);
+ $update = $this->getUpdateQuery($table);
+
+ $result = $select->execute();
+ while ($row = $result->fetch()) {
+ $dnHash = hash('sha256', $row['ldap_dn'], false);
+ $update->setParameter('name', $row['owncloud_name']);
+ $update->setParameter('dn_hash', $dnHash);
+ try {
+ $update->execute();
+ } catch (Exception $e) {
+ $this->logger->error('Failed to add hash "{dnHash}" ("{name}" of {table})',
+ [
+ 'app' => 'user_ldap',
+ 'name' => $row['owncloud_name'],
+ 'dnHash' => $dnHash,
+ 'table' => $table,
+ 'exception' => $e,
+ ]
+ );
+ }
+ }
+ $result->closeCursor();
+ }
+
+ protected function getSelectQuery(string $table): IQueryBuilder {
+ $qb = $this->dbc->getQueryBuilder();
+ $qb->select('owncloud_name', 'ldap_dn', 'ldap_dn_hash')
+ ->from($table)
+ ->where($qb->expr()->isNull('ldap_dn_hash'));
+ return $qb;
+ }
+
+ protected function getUpdateQuery(string $table): IQueryBuilder {
+ $qb = $this->dbc->getQueryBuilder();
+ $qb->update($table)
+ ->set('ldap_dn_hash', $qb->createParameter('dn_hash'))
+ ->where($qb->expr()->eq('owncloud_name', $qb->createParameter('name')));
+ return $qb;
+ }
+}