diff --git a/.env.example b/.env.example index 01dd024ed7..fdb8a5313e 100644 --- a/.env.example +++ b/.env.example @@ -201,11 +201,11 @@ LDAP_AUTH_FIELD=uid # # If you wish to only authenticate users from a specific group, use the base DN above. # -# If you require extra/special filters please use the LDAP_GROUP_FILTER with a valid DN. +# If you require extra/special filters please use the LDAP_EXTRA_FILTER with a valid DN. # -# The group filter will only be applied after the user is authenticated. +# The extra filter will only be applied after the user is authenticated. # -LDAP_GROUP_FILTER= +LDAP_EXTRA_FILTER= # # Remote user guard settings diff --git a/app/Ldap/Rules/UserDefinedRule.php b/app/Ldap/Rules/UserDefinedRule.php index 03c68e28e1..e97888378d 100644 --- a/app/Ldap/Rules/UserDefinedRule.php +++ b/app/Ldap/Rules/UserDefinedRule.php @@ -21,35 +21,35 @@ class UserDefinedRule extends Rule */ public function isValid() { - $groupFilter = config('ldap.group_filter'); - Log::debug(sprintf('UserDefinedRule with group filter "%s"', $groupFilter)); + $extraFilter = config('ldap.extra_filter'); + Log::debug(sprintf('UserDefinedRule with extra filter "%s"', $extraFilter)); - if (empty($groupFilter)) { - Log::debug('Group filter is empty, return true.'); + if (empty($extraFilter)) { + Log::debug('Extra filter is empty, return true.'); return true; } - Log::debug('Group filter is not empty, continue.'); + Log::debug('Extra filter is not empty, continue.'); // group class: // use ; $openLDAP = class_exists(\LdapRecord\Models\OpenLDAP\Group::class) ? \LdapRecord\Models\OpenLDAP\Group::class : ''; $activeDirectory = class_exists(\LdapRecord\Models\ActiveDirectory\Group::class) ? \LdapRecord\Models\ActiveDirectory\Group::class : ''; - $groupClass = env('LDAP_DIALECT') === 'OpenLDAP' ? $openLDAP : $activeDirectory; + $groupClass = config('ldap.dialect') === 'OpenLDAP' ? $openLDAP : $activeDirectory; - Log::debug(sprintf('Will use group class "%s"', $groupClass)); + Log::debug(sprintf('Will use dialect group class "%s"', $groupClass)); // We've been given an invalid group filter. We will assume the // developer is using some group ANR attribute, and attempt // to check the user's membership with the resulting group. - if (!DistinguishedName::isValid($groupFilter)) { + if (!DistinguishedName::isValid($extraFilter)) { Log::debug('UserDefinedRule: Is not valid DN'); - return $this->user->groups()->recursive()->exists($groupClass::findByAnrOrFail($groupFilter)); + return $this->user->groups()->recursive()->exists($groupClass::findByAnrOrFail($extraFilter)); } - $head = strtolower(DistinguishedName::make($groupFilter)->head()); + $head = strtolower(DistinguishedName::make($extraFilter)->head()); Log::debug(sprintf('UserDefinedRule: Head is "%s"', $head)); // If the head of the DN we've been given is an OU, we will assume // the developer is looking to filter users based on hierarchy. @@ -58,23 +58,10 @@ class UserDefinedRule extends Rule if ('ou' === $head) { Log::debug('UserDefinedRule: Will return if user is a descendant of.'); - return $this->user->isDescendantOf($groupFilter); + return $this->user->isDescendantOf($extraFilter); } Log::debug('UserDefinedRule: Will return if user exists in group.'); - return $this->user->groups()->recursive()->exists($groupClass::findOrFail($groupFilter)); - // - // - // // old - // $groupFilter = config('ldap.group_filter'); - // - // if (null !== $groupFilter && '' !== (string)$groupFilter) { - // - // - // return $this->user->groups()->recursive()->exists(Group::findOrFail($groupFilter)); - // } - // Log::debug('Group filter is empty or NULL, so will return true.'); - // - // return true; + return $this->user->groups()->recursive()->exists($groupClass::findOrFail($extraFilter)); } } diff --git a/app/Ldap/Scopes/UserDefinedScope.php b/app/Ldap/Scopes/UserDefinedScope.php index d9752f5f3f..30c60804b9 100644 --- a/app/Ldap/Scopes/UserDefinedScope.php +++ b/app/Ldap/Scopes/UserDefinedScope.php @@ -23,12 +23,5 @@ class UserDefinedScope implements Scope */ public function apply(Builder $query, Model $model) { -// $groupFilter = config('ldap.group_filter'); -// Log::debug(sprintf('UserDefinedScope with group filter "%s"', $groupFilter)); -// if (null !== $groupFilter && '' !== (string)$groupFilter) { -// Log::debug('UserDefinedScope: Group filter is not empty, will now apply it.'); -// $query->in($groupFilter); -// } -// Log::debug('UserDefinedScope: done!'); } } diff --git a/config/ldap.php b/config/ldap.php index 4a0ab707fd..6d00ca1a16 100644 --- a/config/ldap.php +++ b/config/ldap.php @@ -36,8 +36,8 @@ return [ */ 'default' => env('LDAP_CONNECTION', 'default'), - - 'group_filter' => env('LDAP_GROUP_FILTER'), + 'extra_filter' => env('LDAP_EXTRA_FILTER'), + 'dialect' => env('LDAP_DIALECT'), /* |--------------------------------------------------------------------------