Compare commits

..

No commits in common. "develop" and "master" have entirely different histories.

4 changed files with 248 additions and 283 deletions

View File

@ -55,59 +55,3 @@ here the domain is test.com All the parameters are in a separate dc in ldap
These are the configuration of the connection to the ldap server.
Then the login will try to use this library.
Configuration
============================
By default and LDAP user will be considered a test-taker belonging to no group.
The following attributes will be taken from LDAP and mapped to TAO properties by default:
* 'mail' as PROPERTY_USER_MAIL
* 'givenName' as PROPERTY_USER_FIRSTNAME
* 'sn' as PROPERTY_USER_LASTNAME
* 'displayName' as RDFS_LABEL
However there are several ways to enhance or override this default behaviour:
------------------------------
To hardcode one of the user properties, you would need to add a mapping of the type 'value' to the configuration:
array(
'driver' => 'oat\authLdap\model\LdapAdapter',
'config' => SEE_ABOVE
'mapping' => array(
'http://www.tao.lu/Ontologies/TAOGroup.rdf#member' => array(
'type' => 'value',
'value' => array('http://localnamespace.com/install#i123456789')
)
);
),
This example would set the group membership of all users loging in to a group identified by the id http://localnamespace.com/install#i123456789
------------------------------
Alternatively if you want to take over a value of an LDAP attribute you would add a mapping of type 'attributeValue'
array(
'driver' => 'oat\authLdap\model\LdapAdapter',
'config' => SEE_ABOVE
'mapping' => array(
'http://www.tao.lu/Ontologies/TAOGroup.rdf#member' => array(
'type' => 'value',
'value' => array('http://localnamespace.com/install#i123456789')
),
'http://www.w3.org/2000/01/rdf-schema#label' => array(
'type' => 'attributeValue',
'attribute' => 'username'
)
);
),
This would use the value of the LDAP attribute 'username' as label (RDFS_LABEL) for the user, overriding the default rule to use 'displayName'.
------------------------------
For more advanced cases there is the type 'callback' which allows you to programmatically enhance the mapping of the LDAP attributes to the TAO properties. See oat\authLdap\model\LdapUserFactory for details.

View File

@ -36,11 +36,6 @@ use oat\generisHard\models\hardsql\Exception;
use oat\oatbox\user\auth\LoginAdapter;
use Zend\Authentication\Adapter\Ldap;
use common_persistence_Manager;
use oat\taoTestTaker\models\CrudService;
use core_kernel_classes_Class;
use oat\oatbox\user\LoginService;
use oat\taoGroups\models\CrudGroupsService;
use oat\taoGroups\models\GroupsService;
/**
* Adapter to authenticate users stored in the Ldap implementation
@ -50,10 +45,6 @@ use oat\taoGroups\models\GroupsService;
*/
class LdapAdapter implements LoginAdapter
{
const OPTION_ADAPTER_CONFIG = 'config';
const OPTION_USER_MAPPING = 'mapping';
/** @var $username string */
private $username;
@ -63,6 +54,9 @@ class LdapAdapter implements LoginAdapter
/** @var $configuration array $configuration */
protected $configuration;
/** @var $mapping array $mapping */
protected $mapping;
/**
* @var \Zend\Authentication\Adapter\Ldap
*/
@ -75,31 +69,21 @@ class LdapAdapter implements LoginAdapter
* @return oat\authLdap\model\LdapAdapter
*/
public static function createFromConfig(array $configuration) {
$adapter = new self();
$adapter->setOptions($configuration);
return $adapter;
return new self($configuration);
}
/**
* Instantiates Zend Ldap adapter
* @param array $configuration
*/
public function __construct() {
public function __construct(array $configuration) {
$this->configuration = $configuration;
$this->adapter = new Ldap();
$this->adapter->setOptions($configuration['config']);
$this->setMapping($configuration['mapping']);
}
public function setOptions(array $options) {
$this->configuration = $options;
$this->adapter->setOptions($options['config']);
}
public function getOption($name) {
return $this->configuration[$name];
}
public function hasOption($name) {
return isset($this->configuration[$name]);
}
/**
* Set the credential
*
@ -124,75 +108,19 @@ class LdapAdapter implements LoginAdapter
$result = $adapter->getAccountObject();
$params = get_object_vars($result);
$mapping = $this->hasOption(self::OPTION_USER_MAPPING)
? $this->getOption(self::OPTION_USER_MAPPING)
: array();
//TODO: change this
$user = $this->createTestTaker($this->getUsername(), $this->getPassword(), $params);
$this->addUserToGroup($user, 'LDAP');
$user = new LdapUser($this->getMapping());
return LoginService::authenticate($this->getUsername(), $this->getPassword());
$user->setUserRawParameters($params);
return $user;
} else {
throw new core_kernel_users_InvalidLoginException('User "'.$this->getUsername().'" failed LDAP authentication.');
throw new core_kernel_users_InvalidLoginException();
}
}
private function createTestTaker($login, $password, $params)
{
$testTakerCrudService = CrudService::singleton();
$testTakerClass = new core_kernel_classes_Class(('http://www.tao.lu/Ontologies/TAO.rdf#User'));
$data = [
PROPERTY_USER_LOGIN => $login,
PROPERTY_USER_PASSWORD => $password,
RDFS_LABEL => $login . ' - ' . $params['givenname'] . ' ' . $params['sn'],
PROPERTY_USER_FIRSTNAME => $params['givenname'],
PROPERTY_USER_LASTNAME => $params['sn'],
];
try {
$testTaker = $testTakerCrudService->createFromLdapData($data);
} catch (\common_exception_PreConditionFailure $e) {
//TODO: throw better exception
throw new core_kernel_users_InvalidLoginException('Error while creating test taker: ' . $login);
}
return $testTaker;
}
private function addUserToGroup($user, $groupLabel)
{
$groupCrudService = CrudGroupsService::singleton();
$groupService = GroupsService::singleton();
$groupClass = $groupService->getRootClass();
$instances = $groupClass->searchInstances(array(
RDFS_LABEL => $groupLabel
), array(
'recursive' => true,
'like' => false
));
if (count($instances)) {
$group = current($instances);
} else {
$group = $groupCrudService->createFromArray([
RDFS_LABEL => $groupLabel
]);
}
$groupService->addUser($user->getUri(), $group);
}
/**
* @param \Zend\Authentication\Adapter\Ldap $adapter
*/
@ -226,6 +154,24 @@ class LdapAdapter implements LoginAdapter
return $this->configuration;
}
/**
* @param array $mapping
*/
public function setMapping($mapping)
{
$this->mapping = $mapping;
}
/**
* @return array
*/
public function getMapping()
{
return $this->mapping;
}
/**
* @param string $password
*/
@ -260,4 +206,3 @@ class LdapAdapter implements LoginAdapter
}

View File

@ -33,32 +33,230 @@ use common_user_User;
use core_kernel_classes_Resource;
use core_kernel_classes_Property;
use common_Logger;
use SebastianBergmann\Exporter\Exception;
class LdapUser extends common_user_User {
private $identifier;
private $cache;
public function __construct($id, $data)
{
$this->identifier = $id;
$this->cache = $data;
/** @var array of configuration */
protected $configuration;
/**
* @var array
*/
protected $userRawParameters;
/**
* @var array
*/
protected $userExtraParameters = array();
/**
* @var string
*/
protected $identifier;
/** @var array $roles */
protected $roles;
/**
* Array that contains the language code as a single string
*
* @var array
*/
protected $languageUi = array(DEFAULT_LANG);
/**
* Array that contains the language code as a single string
*
* @var array
*/
protected $languageDefLg = array(DEFAULT_LANG);
/**
* The mapping of custom parameter from ldap to TAO property
*
* @var array
*/
protected $mapping;
public function __construct(array $mapping = null){
$this->mapping = $mapping;
}
public function getIdentifier()
/**
* @return array
*/
public function getMapping()
{
return $this->mapping;
}
/**
* Sets the language URI
*
* @param string $languageDefLgUri
*/
public function setLanguageDefLg($languageDefLgUri)
{
$this->languageDefLg = array((string)$languageDefLgUri);
return $this;
}
/**
* Returns the language code
*
* @return array
*/
public function getLanguageDefLg()
{
return $this->languageDefLg;
}
/**
* @param $property string
* @param $value string
*/
public function setUserParameter($property, $value){
$this->userRawParameters[$property] = $value;
}
public function getUserParameter($property) {
if (isset ($this->userRawParameters[$property] ) )
return $this->userRawParameters[$property];
return null;
}
/**
* @param array $params
* @return AuthKeyValueUser
*/
public function setUserRawParameters(array $params)
{
$this->setRoles(array('http://www.tao.lu/Ontologies/TAO.rdf#DeliveryRole'));
// initialize parameter that should be set
isset($params['preferredlanguage']) ? $this->setLanguageUi($params['preferredlanguage']) : DEFAULT_LANG;
isset($params['preferredlanguage']) ? $this->setLanguageDefLg($params['preferredlanguage']) : DEFAULT_LANG;
isset($params['mail']) ? $this->setUserParameter(PROPERTY_USER_MAIL, $params['mail']) : '';
isset($params['displayname']) ? $this->setUserParameter(PROPERTY_USER_LASTNAME, $params['displayname']) : $this->setUserParameter(PROPERTY_USER_LASTNAME, $params['cn']) ;
$mapping = $this->getMapping();
foreach($params as $key => $value) {
if(! in_array($key, array('preferredlanguage','mail', 'displayname'))) {
if(array_key_exists($key, $mapping)){
$this->setUserParameter($mapping[$key], $value);
}
}
}
return $this;
}
/**
* @return array
*/
public function getUserRawParameters()
{
return $this->userRawParameters;
}
/**
* @param mixed $language
*/
public function setLanguageUi($languageUri)
{
$this->languageUi = array((string)$languageUri);
return $this;
}
/**
* @return array
*/
public function getLanguageUi()
{
return $this->languageUi;
}
/**
* @return string
*/
public function getIdentifier(){
return $this->identifier;
}
/**
* @param $identifier
* @return $this
*/
public function setIdentifier($identifier){
$this->identifier = $identifier;
return $this;
}
/**
* @param $property string
* @return array|null
*/
public function getPropertyValues($property)
{
return isset($this->cache[$property])
? $this->cache[$property]
: array();
$returnValue = null;
switch ($property) {
case PROPERTY_USER_DEFLG :
$returnValue = $this->getLanguageDefLg();
break;
case PROPERTY_USER_UILG :
$returnValue = $this->getLanguageUi();
break;
case PROPERTY_USER_ROLES :
$returnValue = $this->getRoles();
break;
default:
$returnValue = array($this->getUserParameter($property));
}
return $returnValue;
}
/**
* Function that will refresh the parameters.
*/
public function refresh() {
return false;
}
/**
* @return array
*/
public function getRoles() {
return $this->roles;
}
/**
* @param array $roles
* @return $this
*/
public function setRoles(array $roles ) {
$this->roles = $roles;
return $this;
}
}

View File

@ -1,122 +0,0 @@
<?php
/**
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; under version 2
* of the License (non-upgradable).
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*
* Copyright (c) 2014 (original work) Open Assessment Technologies SA;
*
*
*/
/**
* Authentication user for key value db access
*
* @author christophe massin
* @package authLdap
*/
namespace oat\authLdap\model;
use oat\oatbox\Configurable;
class LdapUserFactory extends Configurable {
public function createUser($rawData) {
if (!isset($rawData['dn'])) {
throw new \common_exception_InconsistentData('Missing DN for LDAP user');
} else {
$id = $rawData['dn'];
}
$data = array();
foreach ($this->getRules() as $property => $rule) {
$data[$property] = $this->map($rule, $rawData);
}
return new LdapUser($id, $data);
}
public function map($propertyConfig, $rawData) {
$data = array();
switch ($propertyConfig['type']) {
case 'value' :
$data = $propertyConfig['value'];
break;
case 'attributeValue' :
if (isset($rawData[$propertyConfig['attribute']])) {
$value = $rawData[$propertyConfig['attribute']];
$data = is_array($value) ? $value : array($value);
}
break;
case 'callback' :
if (isset($rawData[$propertyConfig['attribute']])) {
$callback = $propertyConfig['callable'];
if (is_callable($callback)) {
$data = call_user_func($callback, $rawData[$propertyConfig['attribute']]);
}
}
break;
default :
throw new \common_exception_InconsistentData('Unknown mapping: '.$propertyConfig['type']);
}
return $data;
}
public function getRules() {
$rules = self::getDefaultConfig();
foreach ($this->getOptions() as $key => $value) {
$rules[$key] = $value;
}
return $rules;
}
static public function getDefaultConfig()
{
return array(
PROPERTY_USER_ROLES => self::rawValue(INSTANCE_ROLE_DELIVERY)
,PROPERTY_USER_UILG => self::rawValue(DEFAULT_LANG)
,PROPERTY_USER_DEFLG => self::rawValue(DEFAULT_LANG)
,PROPERTY_USER_TIMEZONE => self::rawValue(TIME_ZONE)
,PROPERTY_USER_MAIL => self::attributeValue('mail')
,PROPERTY_USER_FIRSTNAME => self::attributeValue('givenName')
,PROPERTY_USER_LASTNAME => self::attributeValue('sn')
,RDFS_LABEL => self::attributeValue('displayName')
);
}
static protected function rawValue($value) {
return array(
'type' => 'value',
'value' => array($value)
);
}
static protected function attributeValue($attributeName) {
return array(
'type' => 'attributeValue',
'attribute' => $attributeName
);
}
static protected function callback($callable, $attributeName) {
return array(
'type' => 'callback',
'callable' => $callable,
'attribute' => $attributeName
);
}
}