PHP ldap_get_entries_moodle函数代码示例

 /**
  * Get password expiration time for a given user from Active Directory
  *
  * @param string $pwdlastset The time last time we changed the password.
  * @param resource $lcapconn The open LDAP connection.
  * @param string $user_dn The distinguished name of the user we are checking.
  *
  * @return string $unixtime
  */
 function ldap_get_ad_pwdexpire($pwdlastset, $ldapconn, $user_dn)
 {
     global $CFG;
     if (!function_exists('bcsub')) {
         error_log($this->errorlogtag . get_string('needbcmath', 'auth_ldap'));
         return 0;
     }
     // If UF_DONT_EXPIRE_PASSWD flag is set in user's
     // userAccountControl attribute, the password doesn't expire.
     $sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)', array('userAccountControl'));
     if (!$sr) {
         error_log($this->errorlogtag . get_string('useracctctrlerror', 'auth_ldap', $user_dn));
         // Don't expire password, as we are not sure if it has to be
         // expired or not.
         return 0;
     }
     $entry = ldap_get_entries_moodle($ldapconn, $sr);
     $info = array_change_key_case($entry[0], CASE_LOWER);
     $useraccountcontrol = $info['useraccountcontrol'][0];
     if ($useraccountcontrol & UF_DONT_EXPIRE_PASSWD) {
         // Password doesn't expire.
         return 0;
     }
     // If pwdLastSet is zero, the user must change his/her password now
     // (unless UF_DONT_EXPIRE_PASSWD flag is set, but we already
     // tested this above)
     if ($pwdlastset === '0') {
         // Password has expired
         return -1;
     }
     // ----------------------------------------------------------------
     // Password expiration time in Active Directory is the composition of
     // two values:
     //
     //   - User's pwdLastSet attribute, that stores the last time
     //     the password was changed.
     //
     //   - Domain's maxPwdAge attribute, that sets how long
     //     passwords last in this domain.
     //
     // We already have the first value (passed in as a parameter). We
     // need to get the second one. As we don't know the domain DN, we
     // have to query rootDSE's defaultNamingContext attribute to get
     // it. Then we have to query that DN's maxPwdAge attribute to get
     // the real value.
     //
     // Once we have both values, we just need to combine them. But MS
     // chose to use a different base and unit for time measurements.
     // So we need to convert the values to Unix timestamps (see
     // details below).
     // ----------------------------------------------------------------
     $sr = ldap_read($ldapconn, ROOTDSE, '(objectClass=*)', array('defaultNamingContext'));
     if (!$sr) {
         error_log($this->errorlogtag . get_string('rootdseerror', 'auth_ldap'));
         return 0;
     }
     $entry = ldap_get_entries_moodle($ldapconn, $sr);
     $info = array_change_key_case($entry[0], CASE_LOWER);
     $domaindn = $info['defaultnamingcontext'][0];
     $sr = ldap_read($ldapconn, $domaindn, '(objectClass=*)', array('maxPwdAge'));
     $entry = ldap_get_entries_moodle($ldapconn, $sr);
     $info = array_change_key_case($entry[0], CASE_LOWER);
     $maxpwdage = $info['maxpwdage'][0];
     // ----------------------------------------------------------------
     // MSDN says that "pwdLastSet contains the number of 100 nanosecond
     // intervals since January 1, 1601 (UTC), stored in a 64 bit integer".
     //
     // According to Perl's Date::Manip, the number of seconds between
     // this date and Unix epoch is 11644473600. So we have to
     // substract this value to calculate a Unix time, once we have
     // scaled pwdLastSet to seconds. This is the script used to
     // calculate the value shown above:
     //
     //    #!/usr/bin/perl -w
     //
     //    use Date::Manip;
     //
     //    $date1 = ParseDate ("160101010000 UTC");
     //    $date2 = ParseDate ("197001010000 UTC");
     //    $delta = DateCalc($date1, $date2, \$err);
     //    $secs = Delta_Format($delta, 0, "%st");
     //    print "$secs \n";
     //
     // MSDN also says that "maxPwdAge is stored as a large integer that
     // represents the number of 100 nanosecond intervals from the time
     // the password was set before the password expires." We also need
     // to scale this to seconds. Bear in mind that this value is stored
     // as a _negative_ quantity (at least in my AD domain).
     //
     // As a last remark, if the low 32 bits of maxPwdAge are equal to 0,
     // the maximum password age in the domain is set to 0, which means
//.........这里部分代码省略.........

/**
 * Checks if user belongs to specific group(s) or is in a subtree.
 *
 * Returns true if user belongs to a group in grupdns string OR if the
 * DN of the user is in a subtree of the DN provided as "group"
 *
 * @param mixed $ldapconnection A valid LDAP connection.
 * @param string $userid LDAP user id (dn/cn/uid/...) to test membership for.
 * @param array $group_dns arrary of group dn
 * @param string $member_attrib the name of the membership attribute.
 * @return boolean
 *
 */
function ldap_isgroupmember($ldapconnection, $userid, $group_dns, $member_attrib)
{
    if (empty($ldapconnection) || empty($userid) || empty($group_dns) || empty($member_attrib)) {
        return false;
    }
    $result = false;
    foreach ($group_dns as $group) {
        $group = trim($group);
        if (empty($group)) {
            continue;
        }
        // Check cheaply if the user's DN sits in a subtree of the
        // "group" DN provided. Granted, this isn't a proper LDAP
        // group, but it's a popular usage.
        if (stripos(strrev(strtolower($userid)), strrev(strtolower($group))) === 0) {
            $result = true;
            break;
        }
        $search = ldap_read($ldapconnection, $group, '(' . $member_attrib . '=' . ldap_filter_addslashes($userid) . ')', array($member_attrib));
        if (!empty($search) && ldap_count_entries($ldapconnection, $search)) {
            $info = ldap_get_entries_moodle($ldapconnection, $search);
            if (count($info) > 0) {
                // User is member of group
                $result = true;
                break;
            }
        }
    }
    return $result;
}

/**
 * Reads user information from ldap and returns it in array()
 *
 * Function should return all information available. If you are saving
 * this information to moodle user-table you should honor syncronization flags
 *
 * @param object $ldapauth the ldap authentication instance
 * @param string $username username
 * @param array $options an array with CLI input options
 *
 * @return mixed array with no magic quotes or false on error
 */
function local_ent_installer_get_userinfo($ldapauth, $username, $options = array())
{
    static $entattributes;
    // Load some cached static data.
    if (!isset($entattributes)) {
        // aggregate additional ent specific attributes that hold interesting information
        $configattribs = get_config('local_ent_installer', 'ent_userinfo_attributes');
        if (empty($configattribs)) {
            $entattributes = array('ENTPersonFonctions', 'ENTPersonJointure', 'ENTEleveClasses', 'ENTEleveGroupes', 'ENTEleveTransport', 'ENTEleveRegime', 'ENTPersonProfils', 'objectGUID');
        } else {
            $entattributes = explode(',', $configattribs);
        }
    }
    $extusername = core_text::convert($username, 'utf-8', $ldapauth->config->ldapencoding);
    $ldapconnection = $ldapauth->ldap_connect();
    if (!($user_dn = $ldapauth->ldap_find_userdn($ldapconnection, $extusername))) {
        $ldapauth->ldap_close();
        return false;
    }
    $search_attribs = array();
    $attrmap = $ldapauth->ldap_attributes();
    foreach ($attrmap as $key => $values) {
        if (!is_array($values)) {
            $values = array($values);
        }
        foreach ($values as $value) {
            if (!in_array($value, $search_attribs)) {
                array_push($search_attribs, $value);
            }
        }
    }
    foreach ($entattributes as $value) {
        if (!in_array($value, $search_attribs)) {
            array_push($search_attribs, $value);
            // Add attributes to $attrmap so they are pulled down into final user object.
            $attrmap[$value] = strtolower($value);
        }
    }
    if ($options['verbose']) {
        mtrace("Getting {$user_dn} for " . implode(',', $search_attribs));
    }
    if (!($user_info_result = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs))) {
        $ldapauth->ldap_close();
        return false;
    }
    $user_entry = ldap_get_entries_moodle($ldapconnection, $user_info_result);
    if (empty($user_entry)) {
        $ldapauth->ldap_close();
        return false;
        // Entry not found.
    }
    $result = array();
    foreach ($attrmap as $key => $values) {
        if (!is_array($values)) {
            $values = array($values);
        }
        $ldapval = NULL;
        foreach ($values as $value) {
            $entry = array_change_key_case($user_entry[0], CASE_LOWER);
            if ($value == 'dn' || $value == 'distinguishedname') {
                $result[$key] = $user_dn;
                continue;
            }
            if (!array_key_exists($value, $entry)) {
                if ($options['verbose']) {
                    mtrace("Requested value {$value} but missing in record");
                }
                continue;
                // wrong data mapping!
            }
            if ($value == 'objectguid') {
                if (strlen($entry[$value][0]) == 16) {
                    $tmp = bin2hex($entry[$value][0]);
                    $t = $tmp[6] . $tmp[7] . $tmp[4] . $tmp[5] . $tmp[2] . $tmp[3] . $tmp[0] . $tmp[1] . '-';
                    $t .= $tmp[10] . $tmp[11] . $tmp[8] . $tmp[9] . '-';
                    $t .= $tmp[14] . $tmp[15] . $tmp[12] . $tmp[13] . '-';
                    $t .= substr($tmp, 16, 4) . '-';
                    $t .= substr($tmp, 20);
                    $objectguid = $t;
                }
                $newval = $objectguid;
            } else {
                if ($value == 'entelevegroupes' && is_array($entry[$value])) {
                    $newval = array();
                    foreach ($entry[$value] as $subkey => $subvalue) {
                        if ($subkey !== 'count') {
                            $newval[] = core_text::convert($subvalue, $ldapauth->config->ldapencoding, 'utf-8');
                        }
//.........这里部分代码省略.........

 /**
  * 
  * returns the distinct values of the target LDAP attribute
  * these will be the idnumbers of the synched Moodle cohorts
  * @returns array of string 
  */
 function get_attribute_distinct_values()
 {
     //return array ('affiliate','retired','student','faculty','staff','employee','affiliate','member','alum','emeritus','researcher');
     global $CFG, $DB;
     // only these cohorts will be synched
     if (!empty($this->config->cohort_synching_ldap_attribute_idnumbers)) {
         return explode(',', $this->config->cohort_synching_ldap_attribute_idnumbers);
     }
     //build a filter to fetch all users having something in the target LDAP attribute
     $filter = '(&(' . $this->config->user_attribute . '=*)' . $this->config->objectclass . ')';
     $filter = '(&' . $filter . '(' . $this->config->cohort_synching_ldap_attribute_attribute . '=*))';
     if ($CFG->debug_ldap_groupes) {
         pp_print_object('looking for ', $filter);
     }
     $ldapconnection = $this->ldap_connect();
     $contexts = explode(';', $this->config->contexts);
     if (!empty($this->config->create_context)) {
         array_push($contexts, $this->config->create_context);
     }
     $matchings = array();
     foreach ($contexts as $context) {
         $context = trim($context);
         if (empty($context)) {
             continue;
         }
         if ($this->config->search_sub) {
             // Use ldap_search to find first user from subtree
             $ldap_result = ldap_search($ldapconnection, $context, $filter, array($this->config->cohort_synching_ldap_attribute_attribute));
         } else {
             // Search only in this context
             $ldap_result = ldap_list($ldapconnection, $context, $filter, array($this->config->cohort_synching_ldap_attribute_attribute));
         }
         if (!$ldap_result) {
             continue;
         }
         // this API function returns all attributes as an array
         // wether they are single or multiple
         $users = ldap_get_entries_moodle($ldapconnection, $ldap_result);
         // Add found DISTINCT values to list
         for ($i = 0; $i < count($users); $i++) {
             $count = $users[$i][$this->config->cohort_synching_ldap_attribute_attribute]['count'];
             for ($j = 0; $j < $count; $j++) {
                 $value = textlib::convert($users[$i][$this->config->cohort_synching_ldap_attribute_attribute][$j], $this->config->ldapencoding, 'utf-8');
                 if (!in_array($value, $matchings)) {
                     array_push($matchings, $value);
                 }
             }
         }
     }
     $this->ldap_close();
     return $matchings;
 }

 /**
  * Get ldap entry by user name
  * @param required $username
  */
 private function _getldap_entry($username)
 {
     $ap_ldap = new auth_plugin_ldap();
     $ldapconnection = $ap_ldap->ldap_connect();
     $user_dn = $ap_ldap->ldap_find_userdn($ldapconnection, $username);
     $sr = ldap_read($ldapconnection, $user_dn, 'objectclass=*', array());
     if ($sr) {
         $info = ldap_get_entries_moodle($ldapconnection, $sr);
     } else {
         return false;
     }
     return $info;
 }