PHP ca_users::inGroup方法代码示例

 public static function authenticate($ps_username, $ps_password = '', $pa_options = null)
 {
     $po_auth_config = Configuration::load(Configuration::load()->get('authentication_config'));
     if (!function_exists("ldap_connect")) {
         throw new OpenLDAPException(_t("PHP's LDAP module is required for LDAP authentication!"));
     }
     if (!$ps_username) {
         return false;
     }
     // ldap config
     $vs_ldaphost = $po_auth_config->get("ldap_host");
     $vs_ldapport = $po_auth_config->get("ldap_port");
     $vs_base_dn = $po_auth_config->get("ldap_base_dn");
     $vs_user_ou = $po_auth_config->get("ldap_user_ou");
     $vs_bind_rdn = self::postProcessLDAPConfigValue("ldap_bind_rdn_format", $ps_username, $vs_user_ou, $vs_base_dn);
     $va_default_roles = $po_auth_config->get("ldap_users_default_roles");
     if (!is_array($va_default_roles)) {
         $va_default_roles = array();
     }
     $va_default_groups = $po_auth_config->get("ldap_users_default_groups");
     if (!is_array($va_default_groups)) {
         $va_default_groups = array();
     }
     $vo_ldap = ldap_connect($vs_ldaphost, $vs_ldapport);
     ldap_set_option($vo_ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
     if (!$vo_ldap) {
         return false;
     }
     $vs_bind_rdn_filter = self::postProcessLDAPConfigValue("ldap_bind_rdn_filter", $ps_username, $vs_user_ou, $vs_base_dn);
     if (strlen($vs_bind_rdn_filter) > 0) {
         $vo_dn_search_results = ldap_search($vo_ldap, $vs_base_dn, $vs_bind_rdn_filter);
         $va_dn_search_results = ldap_get_entries($vo_ldap, $vo_dn_search_results);
         if (isset($va_dn_search_results[0]['dn'])) {
             $vs_bind_rdn = $va_dn_search_results[0]['dn'];
         }
     }
     // log in
     $vo_bind = @ldap_bind($vo_ldap, $vs_bind_rdn, $ps_password);
     if (!$vo_bind) {
         // wrong credentials
         if (ldap_get_option($vo_ldap, 0x32, $extended_error)) {
             caLogEvent("ERR", "LDAP ERROR (" . ldap_errno($vo_ldap) . ") {$extended_error} [{$vs_bind_rdn}]", "OpenLDAP::Authenticate");
         }
         ldap_unbind($vo_ldap);
         return false;
     }
     // check group membership
     if (!self::isMemberinAtLeastOneGroup($ps_username, $vo_ldap)) {
         ldap_unbind($vo_ldap);
         return false;
     }
     // user role and group membership syncing with directory
     $t_user = new ca_users();
     if ($t_user->load($ps_username)) {
         // don't try to sync roles for non-existing users (the first auth call is before the user is actually created)
         if ($po_auth_config->get('ldap_sync_user_roles')) {
             $va_expected_roles = array_merge($va_default_roles, self::getRolesToAddFromDirectory($ps_username, $vo_ldap));
             foreach ($va_expected_roles as $vs_role) {
                 if (!$t_user->hasUserRole($vs_role)) {
                     $t_user->addRoles($vs_role);
                 }
             }
             foreach ($t_user->getUserRoles() as $vn_id => $va_role_info) {
                 if (!in_array($va_role_info['code'], $va_expected_roles)) {
                     $t_user->removeRoles($vn_id);
                 }
             }
         }
         if ($po_auth_config->get('ldap_sync_user_groups')) {
             $va_expected_groups = array_merge($va_default_groups, self::getGroupsToAddFromDirectory($ps_username, $vo_ldap));
             foreach ($va_expected_groups as $vs_group) {
                 if (!$t_user->inGroup($vs_group)) {
                     $t_user->addToGroups($vs_group);
                 }
             }
             foreach ($t_user->getUserGroups() as $vn_id => $va_group_info) {
                 if (!in_array($va_group_info['code'], $va_expected_groups)) {
                     $t_user->removeFromGroups($vn_id);
                 }
             }
         }
     }
     ldap_unbind($vo_ldap);
     return true;
 }

//.........这里部分代码省略.........
                     # set field values
                     if ($t_user->numErrors() > 0) {
                         $va_errors[$vs_f] = join("; ", $t_user->getErrors());
                     }
                 }
                 break;
                 # -------------
         }
     }
     // Save user profile responses
     if (is_array($va_profile_prefs) && sizeof($va_profile_prefs)) {
         foreach ($va_profile_prefs as $vs_pref) {
             $t_user->setPreference($vs_pref, $this->request->getParameter('pref_' . $vs_pref, pString));
         }
     }
     if (sizeof($va_errors) == 0) {
         # --- there are no errors so make new user record
         $t_user->setMode(ACCESS_WRITE);
         if ($vb_user_exists_but_is_deleted) {
             $t_user->update();
         } else {
             $t_user->insert();
         }
         $pn_user_id = $t_user->get("user_id");
         if ($t_user->numErrors()) {
             $va_errors["register"] = join("; ", $t_user->getErrors());
         } else {
             # --- add default roles
             if (($va_default_roles = $this->request->config->getList('registration_default_roles')) && sizeof($va_default_roles)) {
                 $t_user->addRoles($va_default_roles);
             }
             # --- user is joining a user group from a supplied link
             if ($this->request->session->getVar("join_user_group_id")) {
                 if (!$t_user->inGroup($this->request->session->getVar("join_user_group_id"))) {
                     $t_user->addToGroups($this->request->session->getVar("join_user_group_id"));
                     $this->request->session->setVar("join_user_group_id", "");
                     $vs_group_message = _t(" You were added to the group");
                 } else {
                     $this->request->session->setVar("join_user_group_id", "");
                     $vs_group_message = _t(" You are already a member of the group");
                 }
             }
             # --- send email confirmation
             $o_view = new View($this->request, array($this->request->getViewsDirectoryPath()));
             # -- generate email subject line from template
             $vs_subject_line = $o_view->render("mailTemplates/reg_conf_subject.tpl");
             # -- generate mail text from template - get both the text and the html versions
             $vs_mail_message_text = $o_view->render("mailTemplates/reg_conf.tpl");
             $vs_mail_message_html = $o_view->render("mailTemplates/reg_conf_html.tpl");
             caSendmail($t_user->get('email'), $this->request->config->get("ca_admin_email"), $vs_subject_line, $vs_mail_message_text, $vs_mail_message_html);
             if ($this->request->config->get("email_notification_for_new_registrations")) {
                 # --- send email to admin
                 $o_view = new View($this->request, array($this->request->getViewsDirectoryPath()));
                 $o_view->setVar("t_user", $t_user);
                 # -- generate email subject line from template
                 $vs_subject_line = $o_view->render("mailTemplates/reg_admin_notification_subject.tpl");
                 # -- generate mail text from template - get both the text and the html versions
                 $vs_mail_message_text = $o_view->render("mailTemplates/reg_admin_notification.tpl");
                 $vs_mail_message_html = $o_view->render("mailTemplates/reg_admin_notification_html.tpl");
                 caSendmail($this->request->config->get("ca_admin_email"), $this->request->config->get("ca_admin_email"), $vs_subject_line, $vs_mail_message_text, $vs_mail_message_html);
             }
             $t_user = new ca_users();
             $vs_action = $vs_controller = $vs_module_path = '';
             if ($vs_default_action = $this->request->config->get('default_action')) {
                 $va_tmp = explode('/', $vs_default_action);
                 $vs_action = array_pop($va_tmp);

 private function syncWithDirectory($ps_username)
 {
     $va_default_roles = $this->getConfigValue("ldap_users_default_roles", array());
     $va_default_groups = $this->getConfigValue("ldap_users_default_groups", array());
     $t_user = new ca_users();
     // don't try to sync roles for non-existing users (the first auth call is before the user is actually created)
     if (!$t_user->load($ps_username)) {
         return;
     }
     if ($this->getConfigValue('ldap_sync_user_roles')) {
         $va_expected_roles = array_merge($va_default_roles, $this->getRolesToAddFromDirectory($ps_username));
         foreach ($va_expected_roles as $vs_role) {
             if (!$t_user->hasUserRole($vs_role)) {
                 $t_user->addRoles($vs_role);
             }
         }
         foreach ($t_user->getUserRoles() as $vn_id => $va_role_info) {
             if (!in_array($va_role_info['code'], $va_expected_roles)) {
                 $t_user->removeRoles($vn_id);
             }
         }
     }
     if ($this->getConfigValue('ldap_sync_user_groups')) {
         $va_expected_groups = array_merge($va_default_groups, $this->getGroupsToAddFromDirectory($ps_username));
         foreach ($va_expected_groups as $vs_group) {
             if (!$t_user->inGroup($vs_group)) {
                 $t_user->addToGroups($vs_group);
             }
         }
         foreach ($t_user->getUserGroups() as $vn_id => $va_group_info) {
             if (!in_array($va_group_info['code'], $va_expected_groups)) {
                 $t_user->removeFromGroups($vn_id);
             }
         }
     }
 }