chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

SSO: Extending LDAP synchronisation script with many options -refs BT#19168

Browse Source
pull/4392/head
NicoDucou 3 years ago
parent 2928475989
commit e2e7a0c298
1 changed files with 213 additions and 133 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 346
      tests/scripts/synchronize_user_base_from_ldap.php

346
tests/scripts/synchronize_user_base_from_ldap.php
Unescape View File

@ -7,9 +7,10 @@ User account synchronisation from LDAP
This script
creates new user accounts found in the LDAP directory (if multiURL is enable, it creates the user on the URL for which the LDAP has been configured)
disables user accounts not found in the LDAP directory (it disbales the user for all URLs)
updates existing user accounts found in the LDAP directory, re-enabling them if disabled (it applies for all URLs)
anonymizes user accounts disabled for more than 3 years (applies for all URLs)
disables user accounts not found in the LDAP directory (it disbales the user for all URLs)
or delete the user depending on the variable deleteUsersNotFoundInLDAP (only if the user has auth_source === extldap)
updates existing user accounts found in the LDAP directory, re-enabling them if disabled (it applies for all URLs) only if option reenableUsersFoundInLDAP is set to true.
anonymizes user accounts disabled for more than 3 years (applies for all URLs) only if the variable is set to true (by default).
This script can be run unattended.
@ -29,6 +30,30 @@ $chamiloRoot = __DIR__.'/../..';
// Set to true in order to get a trace of changes made by this script
$debug = false;
// Set to test mode by default to only show the output, put this test variable to 0 to enable creation, modificaction and deletion of users
$test = 1;
// It defines if the user not find in the LDAP but present in Chamilo should be deleted or disabled. By default it will be disabled.
// Set it to true for users to be deleted.
$deleteUsersNotFoundInLDAP = false;
// Re-enable users found in LDAP and that where present but inactivated in Chamilo
$reenableUsersFoundInLDAP = false;
// Anonymize user accounts disabled for more than 3 years
$anonymizeUserAccountsDisbaledFor3Years = false;
// List of username of accounts that should not be disabled or deleted if not present in LDAP
// For exemple the first admin and the anonymous user that has no username ('')
//$usernameListNotToTouchEvenIfNotInLDAP = ['admin','','test'];
// List of LDAP attributes that are not in extldap_user_correspondance but are needed in this script
//$extraLdapAttributes[0][] = 'description';
//$extraLdapAttributes[0][] = 'userAccountControl';
use Chamilo\CoreBundle\Entity\ExtraFieldValues;
use Chamilo\CoreBundle\Entity\ExtraField;
use Chamilo\CoreBundle\Entity\TrackEDefault;
@ -44,6 +69,7 @@ require $chamiloRoot.'/cli-config.php';
require_once $chamiloRoot.'/main/inc/lib/api.lib.php';
require_once $chamiloRoot.'/app/config/auth.conf.php';
require_once $chamiloRoot.'/main/inc/lib/database.constants.inc.php';
require_once $chamiloRoot.'/main/auth/external_login/ldap.inc.php';
ini_set('memory_limit', -1);
@ -79,7 +105,7 @@ if (api_is_multiple_url_enabled()) {
}
if (!$multipleUrlLDAPConfig) {
$accessUrls['id'] = 0;
$accessUrls[0]['id'] = 0;
$generalTableFieldMap[0] = $generalTableFieldMap;
}
if ($debug) {
@ -88,9 +114,9 @@ if ($debug) {
foreach ($accessUrls as $accessUrl) {
$tableFields = [];
$extraFields = [];
$ldapAttributes = [];
$extraFieldMap = [];
$accessUrlId = $accessUrl['id'];
$ldapAttributes = $extraLdapAttributes[$accessUrlId];
if (array_key_exists($accessUrlId, $generalTableFieldMap) && is_array($generalTableFieldMap[$accessUrlId])) {
$tableFieldMap = $generalTableFieldMap[$accessUrlId];
if (array_key_exists(EXTRA_ARRAY_KEY, $tableFieldMap) and is_array($tableFieldMap[EXTRA_ARRAY_KEY])) {
@ -121,7 +147,7 @@ foreach ($accessUrls as $accessUrl) {
$userField->extraFieldValues[$extraFieldValue->getItemId()] = $extraFieldValue;
}
$extraFields[] = $userField;
} else {
} elseif ($name !== 'admin') {
try {
$userField->getter = new ReflectionMethod(
'\Chamilo\UserBundle\Entity\User',
@ -138,11 +164,17 @@ foreach ($accessUrls as $accessUrl) {
}
}
}
$allFields = array_merge($tableFields, $extraFields);
}
// Retrieve source information from LDAP
if ($debug) {
echo ' Entering ldap search ' . "\n";
echo ' extldap_config = ' . print_r($extldap_config,1) . "\n";
}
if (!$multipleUrlLDAPConfig) {
$extldap_config[$accessUrlId] = $extldap_config;
}
$ldap = false;
if (array_key_exists($accessUrlId, $extldap_config) && is_array($extldap_config[$accessUrlId])) {
foreach ($extldap_config[$accessUrlId]['host'] as $ldapHost) {
@ -179,9 +211,12 @@ foreach ($accessUrls as $accessUrl) {
echo "Bound to LDAP server as $adminDn .\n";
}
$baseDn = $extldap_config[$accessUrlId]['base_dn']
$baseDn = $extldap_config[$accessUrlId]['base_dn']
or die("cannot read the LDAP directory base DN where to search for user entries\n");
if (!$multipleUrlLDAPConfig) {
$extldap_user_correspondance[$accessUrlId] = $extldap_user_correspondance;
}
$ldapUsernameAttribute = $extldap_user_correspondance[$accessUrlId]['username']
or die("cannot read the name of the LDAP attribute where to find the username\n");
@ -199,23 +234,20 @@ foreach ($accessUrls as $accessUrl) {
}
$ldapUsers = [];
$entry = ldap_first_entry($ldap, $searchResult);
while (false !== $entry) {
$attributes = ldap_get_attributes($ldap, $entry);
$ldapUser = [];
$ldapUser = [];
foreach ($allFields as $userField) {
if (!is_null($userField->constant)) {
$value = $userField->constant;
} elseif ($userField->function) {
switch ($userField->name) {
case 'status':
$value = STUDENT;
break;
case 'admin':
$value = false;
break;
default:
die("'func' not implemented for $userField->name\n");
} elseif ($userField->function) {
$func = "extldap_get_$userField->name";
if (function_exists($func)) {
$value = extldap_purify_string($func($attributes));
} else {
die("'func' not implemented for $userField->name\n");
}
} else {
if (array_key_exists($userField->ldapAttribute, $attributes)) {
@ -239,165 +271,213 @@ foreach ($accessUrls as $accessUrl) {
}
$ldapUser[$userField->name] = $value;
}
$username = strtolower($ldapUser['username']);
$username = strtolower($ldapUser['username']);
array_key_exists($username, $ldapUsers) and die("duplicate username '$username' found in LDAP\n");
$ldapUsers[$username] = $ldapUser;
if ($debug) {
echo 'Adding user ' . $username . ' to ldapUsersArray ' . "\n";
echo "ldapUser = " . print_r($ldapUser,1) . "\n";
}
$entry = ldap_next_entry($ldap, $entry);
}
ldap_close($ldap);
if ($debug) {
echo "ldapUsers = " . print_r($ldapUsers,1) . "\n";
}
// create new user accounts found in the LDAP directory and update the existing ones, re-enabling them if disabled
// create new user accounts found in the LDAP directory and update the existing ones, re-enabling if necessary
foreach ($ldapUsers as $username => $ldapUser) {
if (array_key_exists($username, $dbUsers)) {
$user = $dbUsers[$username];
echo "User in DB = " . $username . " and user id = " . $user->getId() . "\n";
if ($debug) {
echo "User in DB = " . $username . " and user id = " . $user->getId() . "\n";
}
} else {
$user = new User();
$dbUsers[$username] = $user;
$user->setUsernameCanonical($username);
if (!$test) {
$user = new User();
$dbUsers[$username] = $user;
$user->setUsernameCanonical($username);
}
if ($debug) {
echo 'Created ' . $username . "\n";
echo "ldapUser = " . print_r($ldapUser,1) . "\n";
}
}
foreach ($tableFields as $userField) {
$value = $ldapUser[$userField->name];
if ($userField->getter->invoke($user) !== $value) {
$userField->setter->invoke($user, $value);
if ($debug) {
echo 'Updated ' . $username . ' field '.$userField->name."\n";
}
if ($userField->name == 'email') {
$user->setEmailCanonical($value);
}
if ($test) {
if ($debug) {
echo 'Updated ' . $username . ' fields '."\n";
}
} else {
foreach ($tableFields as $userField) {
$value = $ldapUser[$userField->name];
if ($userField->getter->invoke($user) !== $value) {
$userField->setter->invoke($user, $value);
if ($debug) {
echo 'Updated ' . $username . ' field '.$userField->name."\n";
}
if ($userField->name == 'email') {
$user->setEmailCanonical($value);
}
}
}
if (!$user->isActive() and $reenableUsersFoundInLDAP) {
$user->setActive(true);
}
Database::getManager()->persist($user);
try {
Database::getManager()->flush();
} catch (OptimisticLockException $exception) {
die($exception->getMessage()."\n");
}
if($debug) {
echo 'Sent to DB ' . $username . " with user id = " . $user->getId() . "\n";
}
if ($multipleUrlLDAPConfig) {
UrlManager::add_user_to_url($user->getId(), $accessUrlId);
} elseif (!api_is_multiple_url_enabled()) {
//we are adding by default the access_url_user table with access_url_id = 1
UrlManager::add_user_to_url($user->getId(), 1);
}
}
if (!$user->isActive()) {
$user->setActive(true);
}
Database::getManager()->persist($user);
try {
Database::getManager()->flush();
} catch (OptimisticLockException $exception) {
die($exception->getMessage()."\n");
}
if($debug) {
echo 'Sent to DB ' . $username . " with user id = " . $user->getId() . "\n";
}
if ($multipleUrlLDAPConfig) {
UrlManager::add_user_to_url($user->getId(), $accessUrlId);
} elseif (!api_is_multiple_url_enabled()) {
//we are adding by default the access_url_user table with access_url_id = 1
UrlManager::add_user_to_url($user->getId(), 1);
}
}
// also update extra field values
foreach ($ldapUsers as $username => $ldapUser) {
$user = $dbUsers[$username];
foreach ($extraFields as $userField) {
$value = $ldapUser[$userField->name];
if (array_key_exists($user->getId(), $userField->extraFieldValues)) {
/**
* @var ExtraFieldValues $extraFieldValue
*/
$extraFieldValue = $userField->extraFieldValues[$user->getId()];
if ($extraFieldValue->getValue() !== $value) {
if ($test) {
if ($debug) {
echo 'Updated ' . $username . ' extra fields ' . "\n";
}
} else {
foreach ($ldapUsers as $username => $ldapUser) {
$user = $dbUsers[$username];
foreach ($extraFields as $userField) {
$value = $ldapUser[$userField->name];
if (array_key_exists($user->getId(), $userField->extraFieldValues)) {
/**
* @var ExtraFieldValues $extraFieldValue
*/
$extraFieldValue = $userField->extraFieldValues[$user->getId()];
if ($extraFieldValue->getValue() !== $value) {
$extraFieldValue->setValue($value);
Database::getManager()->persist($extraFieldValue);
if ($debug) {
echo 'Updated ' . $username . ' extra field ' . $userField->name . "\n";
}
}
} else {
$extraFieldValue = new ExtraFieldValues();
$extraFieldValue->setValue($value);
$extraFieldValue->setField($userField->extraField);
$extraFieldValue->setItemId($user->getId());
Database::getManager()->persist($extraFieldValue);
$userField->extraFieldValues[$user->getId()] = $extraFieldValue;
if ($debug) {
echo 'Updated ' . $username . ' extra field ' . $userField->name . "\n";
echo 'Created ' . $username . ' extra field ' . $userField->name . "\n";
}
}
} else {
$extraFieldValue = new ExtraFieldValues();
$extraFieldValue->setValue($value);
$extraFieldValue->setField($userField->extraField);
$extraFieldValue->setItemId($user->getId());
Database::getManager()->persist($extraFieldValue);
$userField->extraFieldValues[$user->getId()] = $extraFieldValue;
if ($debug) {
echo 'Created ' . $username . ' extra field ' . $userField->name . "\n";
}
}
}
try {
Database::getManager()->flush();
} catch (OptimisticLockException $exception) {
die($exception->getMessage()."\n");
}
}
try {
Database::getManager()->flush();
} catch (OptimisticLockException $exception) {
die($exception->getMessage()."\n");
}
$allLdapUsers = array_merge($allLdapUsers, $ldapUsers);
}
}
// disable user accounts not found in the LDAP directories
// disable or delete user accounts not found in the LDAP directories depending on $deleteUsersNotFoundInLDAP
$now = new DateTime();
foreach (array_diff(array_keys($dbUsers), array_keys($allLdapUsers)) as $usernameToDisable) {
$user = $dbUsers[$usernameToDisable];
if ($user->isActive()) {
// In order to avoid slow individual SQL updates, we do not call
// UserManager::disable($user->getId());
$user->setActive(false);
Database::getManager()->persist($user);
// In order to avoid slow individual SQL updates, we do not call
// Event::addEvent(LOG_USER_DISABLE, LOG_USER_ID, $user->getId());
$trackEDefault = new TrackEDefault();
$trackEDefault->setDefaultUserId(1);
$trackEDefault->setDefaultDate($now);
$trackEDefault->setDefaultEventType(LOG_USER_DISABLE);
$trackEDefault->setDefaultValueType(LOG_USER_ID);
$trackEDefault->setDefaultValue($user->getId());
Database::getManager()->persist($trackEDefault);
if (in_array($usernameToDisable, $usernameListNotToTouchEvenIfNotInLDAP)) {
if ($debug) {
echo 'Disabled ' . $user->getUsername() . "\n";
echo 'User not modified even if not present in LDAP : ' . $usernameToDisable . "\n";
}
} else {
$user = $dbUsers[$usernameToDisable];
if ($deleteUsersNotFoundInLDAP) {
if (!$test) {
if (!UserManager::delete_user($user->getId())) {
if ($debug) {
echo 'Unable to delete user ' . $usernameToDisable . "\n";
}
}
}
if ($debug) {
echo 'Deleted user ' . $usernameToDisable . "\n";
}
} else {
if (!$test) {
if ($user->isActive()) {
// In order to avoid slow individual SQL updates, we do not call
// UserManager::disable($user->getId());
$user->setActive(false);
Database::getManager()->persist($user);
// In order to avoid slow individual SQL updates, we do not call
// Event::addEvent(LOG_USER_DISABLE, LOG_USER_ID, $user->getId());
$trackEDefault = new TrackEDefault();
$trackEDefault->setDefaultUserId(1);
$trackEDefault->setDefaultDate($now);
$trackEDefault->setDefaultEventType(LOG_USER_DISABLE);
$trackEDefault->setDefaultValueType(LOG_USER_ID);
$trackEDefault->setDefaultValue($user->getId());
Database::getManager()->persist($trackEDefault);
}
}
if ($debug) {
echo 'Disabled ' . $user->getUsername() . "\n";
}
}
}
}
try {
// Saving everything together
Database::getManager()->flush();
} catch (OptimisticLockException $exception) {
die($exception->getMessage()."\n");
if (!$test) {
try {
// Saving everything together
Database::getManager()->flush();
} catch (OptimisticLockException $exception) {
die($exception->getMessage()."\n");
}
}
// anonymize user accounts disabled for more than 3 years
$longDisabledUserIds = [];
foreach (Database::query(
'select default_value
from track_e_default
where default_event_type=\'user_disable\' and default_value_type=\'user_id\'
group by default_value
having max(default_date) < date_sub(now(), interval 3 year)'
)->fetchAll(FetchMode::COLUMN) as $userId) {
$longDisabledUserIds[] = $userId;
}
$anonymizedUserIds = [];
foreach (Database::query(
'select distinct default_value
from track_e_default
where default_event_type=\'user_anonymized\' and default_value_type=\'user_id\''
)->fetchAll(FetchMode::COLUMN) as $userId) {
$anonymizedUserIds[] = $userId;
}
foreach (array_diff($longDisabledUserIds, $anonymizedUserIds) as $userId) {
$user = $userRepository->find($userId);
if ($user && !$user->isEnabled()) {
try {
UserManager::anonymize($userId)
or die("could not anonymize user $userId\n");
} catch (Exception $exception) {
die($exception->getMessage()."\n");
}
if ($debug) {
echo "Anonymized user $userId\n";
if ($anonymizeUserAccountsDisbaledFor3Years) {
$longDisabledUserIds = [];
foreach (Database::query(
'select default_value
from track_e_default
where default_event_type=\'user_disable\' and default_value_type=\'user_id\'
group by default_value
having max(default_date) < date_sub(now(), interval 3 year)'
)->fetchAll(FetchMode::COLUMN) as $userId) {
$longDisabledUserIds[] = $userId;
}
$anonymizedUserIds = [];
foreach (Database::query(
'select distinct default_value
from track_e_default
where default_event_type=\'user_anonymized\' and default_value_type=\'user_id\''
)->fetchAll(FetchMode::COLUMN) as $userId) {
$anonymizedUserIds[] = $userId;
}
foreach (array_diff($longDisabledUserIds, $anonymizedUserIds) as $userId) {
$user = $userRepository->find($userId);
if ($user && !$user->isEnabled()) {
if (!$test) {
try {
UserManager::anonymize($userId)
or die("could not anonymize user $userId\n");
} catch (Exception $exception) {
die($exception->getMessage()."\n");
}
}
if ($debug) {
echo "Anonymized user $userId\n";
}
}
}
}

Write Preview
Loading…
Cancel
Save