inc/drivers_ldap.php

   1 <?php
   2 /**
   3 * Manages LDAP repository connection
   4 *
   5 * @package   davical
   6 * @category Technical
   7 * @subpackage   ldap
   8 * @author    Maxime Delorme <mdelorme@tennaxia.net>,
   9 *                Andrew McMillan <andrew@mcmillan.net.nz>
  10 * @copyright Maxime Delorme
  11 * @license   http://gnu.org/copyleft/gpl.html GNU GPL v2 or later
  12 */
  13
  14 require_once("auth-functions.php");
  15
  16 class ldapDrivers
  17 {
  18   /**#@+
  19   * @access private
  20   */
  21
  22   /**
  23   * Holds the LDAP connection parameters
  24   */
  25   var $connect;
  26
  27   /**#@-*/
  28
  29
  30   /**
  31   * Initializes the LDAP connection
  32   *
  33   * @param array $config The configuration data
  34   */
  35   function __construct($config)
  36   {
  37       global $c;
  38       $host=$config['host'];
  39       $port=$config['port'];
  40       if(!function_exists('ldap_connect')){
  41           $c->messages[] = i18n("drivers_ldap : function ldap_connect not defined, check your php_ldap module");
  42           $this->valid=false;
  43           return ;
  44       }
  45
  46       //Set LDAP protocol version
  47       if (isset($config['protocolVersion']))
  48           ldap_set_option($this->connect, LDAP_OPT_PROTOCOL_VERSION, $config['protocolVersion']);
  49       if (isset($config['optReferrals']))
  50           ldap_set_option($this->connect, LDAP_OPT_REFERRALS, $config['optReferrals']);
  51
  52       if ($port)
  53           $this->connect=ldap_connect($host, $port);
  54       else
  55           $this->connect=ldap_connect($host);
  56
  57       if (! $this->connect){
  58           $c->messages[] = sprintf(translate( 'drivers_ldap : Unable to connect to LDAP with port %s on host %s'), $port, $host );
  59           $this->valid=false;
  60           return ;
  61       }
  62
  63       dbg_error_log( "LDAP", "drivers_ldap : Connected to LDAP server %s",$host );
  64
  65       // Start TLS if desired (requires protocol version 3)
  66       if (isset($config['startTLS'])) {
  67         if (!ldap_set_option($this->connect, LDAP_OPT_PROTOCOL_VERSION, 3)) {
  68           $c->messages[] = i18n('drivers_ldap : Failed to set LDAP to use protocol version 3, TLS not supported');
  69           $this->valid=false;
  70           return;
  71         }
  72         if (!ldap_start_tls($this->connect)) {
  73           $c->messages[] = i18n('drivers_ldap : Could not start TLS: ldap_start_tls() failed');
  74           $this->valid=false;
  75           return;
  76         }
  77       }
  78
  79       //Set the search scope to be used, default to subtree.  This sets the functions to be called later.
  80       if (!isset($config['scope'])) $config['scope'] = 'subtree';
  81       switch (strtolower($config['scope'])) {
  82       case "base":
  83         $this->ldap_query_one = 'ldap_read';
  84         $this->ldap_query_all = 'ldap_read';
  85         break;
  86       case "onelevel":
  87         $this->ldap_query_one = 'ldap_list';
  88         $this->ldap_query_all = 'ldap_search';
  89         break;
  90       default:
  91         $this->ldap_query_one = 'ldap_search';
  92         $this->ldap_query_all = 'ldap_search';
  93         break;
  94       }
  95
  96       //connect as root
  97       if (!ldap_bind($this->connect, (isset($config['bindDN']) ? $config['bindDN'] : null), (isset($config['passDN']) ? $config['passDN'] : null) ) ){
  98           $bindDN = isset($config['bindDN']) ? $config['bindDN'] : 'anonymous';
  99           $passDN = isset($config['passDN']) ? $config['passDN'] : 'anonymous';
 100           dbg_error_log( "LDAP", i18n('drivers_ldap : Failed to bind to host %1$s on port %2$s with bindDN of %3$s'), $host, $port, $bindDN );
 101           $c->messages[] = i18n( 'drivers_ldap : Unable to bind to LDAP - check your configuration for bindDN and passDN, and that your LDAP server is reachable');
 102           $this->valid=false;
 103           return ;
 104       }
 105       $this->valid = true;
 106       //root to start search
 107       $this->baseDNUsers  = is_string($config['baseDNUsers']) ? array($config['baseDNUsers']) : $config['baseDNUsers'];
 108       $this->filterUsers  = (isset($config['filterUsers'])  ? $config['filterUsers']  : null);
 109       $this->baseDNGroups = is_string($config['baseDNGroups']) ? array($config['baseDNGroups']) : $config['baseDNGroups'];
 110       $this->filterGroups = (isset($config['filterGroups']) ? $config['filterGroups'] : null);
 111   }
 112
 113   /**
 114   * Retrieve all users from the LDAP directory
 115   */
 116   function getAllUsers($attributes){
 117     global $c;
 118
 119     $query = $this->ldap_query_all;
 120
 121     foreach($this->baseDNUsers as $baseDNUsers) {
 122       $entry = $query($this->connect,$baseDNUsers,$this->filterUsers,$attributes);
 123
 124       if (!ldap_first_entry($this->connect,$entry)) {
 125         $c->messages[] = sprintf(translate('Error NoUserFound with filter >%s<, attributes >%s< , dn >%s<'),
 126                                  $this->filterUsers,
 127                                  join(', ', $attributes),
 128                                  $baseDNUsers);
 129       }
 130       $row = array();
 131       for($i = ldap_first_entry($this->connect,$entry);
 132           $i && $arr = ldap_get_attributes($this->connect,$i);
 133           $i = ldap_next_entry($this->connect,$i) ) {
 134         $row = array();
 135         for ($j=0; $j < $arr['count']; $j++) {
 136           $row[$arr[$j]] = $arr[$arr[$j]][0];
 137         }
 138         $ret[]=$row;
 139       }
 140     }
 141     return $ret;
 142   }
 143
 144   /**
 145   * Retrieve all groups from the LDAP directory
 146   */
 147   function getAllGroups($attributes){
 148     global $c;
 149
 150     $query = $this->ldap_query_all;
 151
 152     foreach($this->baseDNGroups as $baseDNGroups) {
 153       $entry = $query($this->connect,$baseDNGroups,$this->filterGroups,$attributes);
 154
 155       if (!ldap_first_entry($this->connect,$entry)) {
 156         $c->messages[] = sprintf(translate('Error NoGroupFound with filter >%s<, attributes >%s< , dn >%s<'),
 157                                  $this->filterGroups,
 158                                  join(', ', $attributes),
 159                                  $baseDNGroups);
 160       }
 161       $row = array();
 162       for($i = ldap_first_entry($this->connect,$entry);
 163           $i && $arr = ldap_get_attributes($this->connect,$i);
 164           $i = ldap_next_entry($this->connect,$i) ) {
 165         for ($j=0; $j < $arr['count']; $j++) {
 166           $row[$arr[$j]] = count($arr[$arr[$j]])>2?$arr[$arr[$j]]:$arr[$arr[$j]][0];
 167         }
 168         $ret[]=$row;
 169       }
 170     }
 171     return $ret;
 172   }
 173
 174   /**
 175     * Returns the result of the LDAP query
 176     *
 177     * @param string $filter The filter used to search entries
 178     * @param array $attributes Attributes to be returned
 179     * @param string $passwd password to check
 180     * @return array Contains selected attributes from all entries corresponding to the given filter
 181     */
 182   function requestUser( $filter, $attributes=NULL, $username, $passwd) {
 183     global $c;
 184
 185     $entry=NULL;
 186     // We get the DN of the USER
 187     $query = $this->ldap_query_one;
 188
 189     foreach($this->baseDNUsers as $baseDNUsers) {
 190       $entry = $query($this->connect, $baseDNUsers, $filter, $attributes);
 191
 192       if (ldap_first_entry($this->connect,$entry) )
 193         break;
 194
 195       dbg_error_log( "LDAP", "drivers_ldap : Failed to find user with baseDN: %s", $baseDNUsers );
 196     }
 197
 198     if ( !ldap_first_entry($this->connect, $entry) ){
 199       dbg_error_log( "ERROR", "drivers_ldap : Unable to find the user with filter %s",$filter );
 200       return false;
 201     } else {
 202       dbg_error_log( "LDAP", "drivers_ldap : Found a user using filter %s",$filter );
 203     }
 204
 205     $dnUser = ldap_get_dn($this->connect, ldap_first_entry($this->connect,$entry));
 206
 207     if ( isset($c->authenticate_hook['config']['i_use_mode_kerberos']) && $c->authenticate_hook['config']['i_use_mode_kerberos'] == "i_know_what_i_am_doing") {
 208         dbg_error_log( "LDAP", "drivers_ldap : Skipping password Check for user %s which should be the same as %s",$username , $_SERVER["REMOTE_USER"]);
 209       if ($username != $_SERVER["REMOTE_USER"]) {
 210         return false;
 211       }
 212     }
 213     else if ( empty($passwd) || preg_match('/[\x00-\x19]/',$passwd) ) {
 214       // See http://www.php.net/manual/en/function.ldap-bind.php#73718 for more background
 215       dbg_error_log( 'LDAP', 'drivers_ldap : user %s supplied empty or invalid password: login rejected', $dnUser );
 216       return false;
 217     }
 218     else {
 219       if ( !@ldap_bind($this->connect, $dnUser, $passwd) ) {
 220         dbg_error_log( "LDAP", "drivers_ldap : Failed to bind to user %s ", $dnUser );
 221         return false;
 222       }
 223     }
 224
 225     dbg_error_log( "LDAP", "drivers_ldap : Bound to user %s using password %s", $dnUser,
 226           (isset($c->dbg['password']) && $c->dbg['password'] ? $passwd : 'another delicious password for the debugging monster!') );
 227
 228     $i = ldap_first_entry($this->connect,$entry);
 229     $arr = ldap_get_attributes($this->connect,$i);
 230     for( $i=0; $i<$arr['count']; $i++ ) {
 231       $ret[$arr[$i]]=$arr[$arr[$i]][0];
 232     }
 233     return $ret;
 234
 235   }
 236 }
 237
 238
 239 /**
 240 * A generic function to create and fetch static objects
 241 */
 242 function getStaticLdap() {
 243   global $c;
 244   // Declare a static variable to hold the object instance
 245   static $instance;
 246
 247   // If the instance is not there, create one
 248   if(!isset($instance)) {
 249     $ldapDrivers = new ldapDrivers($c->authenticate_hook['config']);
 250   }
 251   return $ldapDrivers;
 252 }
 253
 254
 255 /**
 256 * Synchronise a cached user with one from LDAP
 257 * @param object $principal A Principal object to be updated (or created)
 258 */
 259 function sync_user_from_LDAP( Principal &$principal, $mapping, $ldap_values ) {
 260   global $c;
 261
 262   dbg_error_log( "LDAP", "Going to sync the user from LDAP" );
 263
 264   $fields_to_set = array();
 265   $updateable_fields = Principal::updateableFields();
 266   foreach( $updateable_fields AS $field ) {
 267     if ( isset($mapping[$field]) ) {
 268       $tab_part_fields = explode(',',$mapping[$field]);
 269       foreach( $tab_part_fields as $part_field ) {
 270         if ( isset($ldap_values[$part_field]) ) {
 271           if (isset($fields_to_set[$field]) ) {
 272             $fields_to_set[$field] .= ' '.$ldap_values[$part_field];
 273           }
 274           else {
 275             $fields_to_set[$field] = $ldap_values[$part_field];
 276           }
 277         }
 278       }
 279       dbg_error_log( "LDAP", "Setting usr->%s to %s from LDAP field %s", $field, $fields_to_set[$field], $mapping[$field] );
 280     }
 281     else if ( isset($c->authenticate_hook['config']['default_value']) && is_array($c->authenticate_hook['config']['default_value'])
 282               && isset($c->authenticate_hook['config']['default_value'][$field] ) ) {
 283       $fields_to_set[$field] = $c->authenticate_hook['config']['default_value'][$field];
 284       dbg_error_log( "LDAP", "Setting usr->%s to %s from configured defaults", $field, $c->authenticate_hook['config']['default_value'][$field] );
 285     }
 286   }
 287
 288   if ( $principal->Exists() ) {
 289     $principal->Update($fields_to_set);
 290   }
 291   else {
 292     $principal->Create($fields_to_set);
 293     CreateHomeCollections($principal->username());
 294     CreateDefaultRelationships($principal->username());
 295   }
 296 }
 297
 298 /*
 299 * explode the multipart mapping
 300 */
 301 function array_values_mapping($mapping){
 302   $attributes=array();
 303   foreach ( $mapping as $field ) {
 304     $tab_part_field = explode(",",$field);
 305     foreach( $tab_part_field as $part_field ) {
 306       $attributes[] = $part_field;
 307     }
 308   }
 309   return $attributes;
 310 }
 311
 312 /**
 313 * Check the username / password against the LDAP server
 314 */
 315 function LDAP_check($username, $password ){
 316   global $c;
 317
 318   $ldapDriver = getStaticLdap();
 319   if ( !$ldapDriver->valid ) {
 320     sleep(1);  // Sleep very briefly to try and survive intermittent issues
 321     $ldapDriver = getStaticLdap();
 322     if ( !$ldapDriver->valid ) {
 323       dbg_error_log( "ERROR", "Couldn't contact LDAP server for authentication" );
 324       header( sprintf("HTTP/1.1 %d %s", 503, translate("Authentication server unavailable.")) );
 325       exit(0);
 326     }
 327   }
 328
 329   $mapping = $c->authenticate_hook['config']['mapping_field'];
 330   if ( isset($mapping['active']) && !isset($mapping['user_active']) ) {
 331     // Backward compatibility: now 'user_active'
 332     $mapping['user_active'] = $mapping['active'];
 333     unset($mapping['active']);
 334   }
 335   if ( isset($mapping['updated']) && !isset($mapping['modified']) ) {
 336     // Backward compatibility: now 'modified'
 337     $mapping['modified'] = $mapping['updated'];
 338     unset($mapping['updated']);
 339   }
 340   $attributes = array_values_mapping($mapping);
 341
 342   /**
 343   * If the config contains a filter that starts with a ( then believe
 344   * them and don't modify it, otherwise wrap the filter.
 345   */
 346   $filter_munge = "";
 347   if ( preg_match( '/^\(/', $ldapDriver->filterUsers ) ) {
 348     $filter_munge = $ldapDriver->filterUsers;
 349   }
 350   else if ( isset($ldapDriver->filterUsers) && $ldapDriver->filterUsers != '' ) {
 351     $filter_munge = "($ldapDriver->filterUsers)";
 352   }
 353
 354   $filter = "(&$filter_munge(".$mapping['username']."=$username))";
 355   $valid = $ldapDriver->requestUser( $filter, $attributes, $username, $password );
 356
 357   // is a valid user or not
 358   if ( !$valid ) {
 359     dbg_error_log( "LDAP", "user %s is not a valid user",$username );
 360     return false;
 361   }
 362
 363   $ldap_timestamp = $valid[$mapping['modified']];
 364
 365   /**
 366   * This splits the LDAP timestamp apart and assigns values to $Y $m $d $H $M and $S
 367   */
 368   foreach($c->authenticate_hook['config']['format_updated'] as $k => $v)
 369     $$k = substr($ldap_timestamp,$v[0],$v[1]);
 370
 371   $ldap_timestamp = "$Y"."$m"."$d"."$H"."$M"."$S";
 372   $valid[$mapping['modified']] = "$Y-$m-$d $H:$M:$S";
 373
 374   $principal = new Principal('username',$username);
 375   if ( $principal->Exists() ) {
 376     // should we update it ?
 377     $db_timestamp = $principal->modified;
 378     $db_timestamp = substr(strtr($db_timestamp, array(':' => '',' '=>'','-'=>'')),0,14);
 379     if( $ldap_timestamp <= $db_timestamp ) {
 380         return $principal; // no need to update
 381     }
 382     // we will need to update the user record
 383   }
 384   else {
 385     dbg_error_log( "LDAP", "user %s doesn't exist in local DB, we need to create it",$username );
 386   }
 387   $principal->setUsername($username);
 388
 389   // The local cached user doesn't exist, or is older, so we create/update their details
 390   sync_user_from_LDAP( $principal, $mapping, $valid );
 391
 392   return $principal;
 393
 394 }
 395
 396 /**
 397 * sync LDAP Groups against the DB
 398 */
 399 function sync_LDAP_groups(){
 400   global $c;
 401   $ldapDriver = getStaticLdap();
 402   if ( ! $ldapDriver->valid ) return;
 403
 404   $mapping = $c->authenticate_hook['config']['group_mapping_field'];
 405   //$attributes = array('cn','modifyTimestamp','memberUid');
 406   $attributes = array_values_mapping($mapping);
 407   $ldap_groups_tmp = $ldapDriver->getAllGroups($attributes);
 408
 409   if ( sizeof($ldap_groups_tmp) == 0 ) return;
 410
 411   $member_field = $mapping['members'];
 412
 413   foreach($ldap_groups_tmp as $key => $ldap_group){
 414     $group_mapping = $ldap_group[$mapping['username']];
 415     $ldap_groups_info[$group_mapping] = $ldap_group;
 416     if ( is_array($ldap_groups_info[$group_mapping][$member_field]) ) {
 417       unset( $ldap_groups_info[$group_mapping][$member_field]['count'] );
 418     }
 419     else {
 420       $ldap_groups_info[$group_mapping][$member_field] = array($ldap_groups_info[$group_mapping][$member_field]);
 421     }
 422     unset($ldap_groups_tmp[$key]);
 423   }
 424   $db_groups = array();
 425   $db_group_members = array();
 426   $qry = new AwlQuery( "SELECT g.username AS group_name, member.username AS member_name FROM dav_principal g LEFT JOIN group_member ON (g.principal_id=group_member.group_id) LEFT JOIN dav_principal member  ON (member.principal_id=group_member.member_id) WHERE g.type_id = 3");
 427   $qry->Exec('sync_LDAP',__LINE__,__FILE__);
 428   while($db_group = $qry->Fetch()) {
 429     $db_groups[$db_group->group_name] = $db_group->group_name;
 430     $db_group_members[$db_group->group_name][] = $db_group->member_name;
 431   }
 432
 433   $ldap_groups = array_keys($ldap_groups_info);
 434   // users only in ldap
 435   $groups_to_create = array_diff($ldap_groups,$db_groups);
 436   // users only in db
 437   $groups_to_deactivate = array_diff($db_groups,$ldap_groups);
 438   // users present in ldap and in the db
 439   $groups_to_update = array_intersect($db_groups,$ldap_groups);
 440
 441   if ( sizeof ( $groups_to_create ) ){
 442     $c->messages[] = sprintf(i18n('- creating groups : %s'),join(', ',$groups_to_create));
 443     $validUserFields = get_fields('usr');
 444     foreach ( $groups_to_create as $k => $group ){
 445       $user = (object) array();
 446
 447       if ( isset($c->authenticate_hook['config']['default_value']) && is_array($c->authenticate_hook['config']['default_value']) ) {
 448         foreach ( $c->authenticate_hook['config']['default_value'] as $field => $value ) {
 449           if ( isset($validUserFields[$field]) ) {
 450             $user->{$field} =  $value;
 451             dbg_error_log( "LDAP", "Setting usr->%s to %s from configured defaults", $field, $value );
 452           }
 453         }
 454       }
 455       $user->user_no = 0;
 456       $ldap_values = $ldap_groups_info[$group];
 457       foreach ( $mapping as $field => $value ) {
 458         dbg_error_log( "LDAP", "Considering copying %s", $field );
 459         if ( isset($validUserFields[$field]) ) {
 460           $user->{$field} =  $ldap_values[$value];
 461           dbg_error_log( "LDAP", "Setting usr->%s to %s from LDAP field %s", $field, $ldap_values[$value], $value );
 462         }
 463       }
 464       if ($user->fullname=="") {
 465         $user->fullname = $group;
 466       }
 467       if ($user->displayname=="") {
 468         $user->displayname = $group;
 469       }
 470       $user->username = $group;
 471       $user->updated = "now";  /** @todo Use the 'updated' timestamp from LDAP for groups too */
 472
 473       $principal = new Principal('username',$group);
 474       if ( $principal->Exists() ) {
 475         $principal->Update($user);
 476       }
 477       else {
 478         $principal->Create($user);
 479       }
 480
 481       $qry = new AwlQuery( "UPDATE dav_principal set type_id = 3 WHERE username=:group ",array(':group'=>$group) );
 482       $qry->Exec('sync_LDAP',__LINE__,__FILE__);
 483       Principal::cacheDelete('username', $group);
 484       $c->messages[] = sprintf(i18n('- adding users %s to group : %s'),join(',',$ldap_groups_info[$group][$mapping['members']]),$group);
 485       foreach ( $ldap_groups_info[$group][$mapping['members']] as $member ){
 486         $qry = new AwlQuery( "INSERT INTO group_member SELECT g.principal_id AS group_id,u.principal_id AS member_id FROM dav_principal g, dav_principal u WHERE g.username=:group AND u.username=:member;",array (':group'=>$group,':member'=>$member) );
 487         $qry->Exec('sync_LDAP_groups',__LINE__,__FILE__);
 488         Principal::cacheDelete('username', $member);
 489       }
 490     }
 491   }
 492
 493   if ( sizeof ( $groups_to_update ) ){
 494     $c->messages[] = sprintf(i18n('- updating groups : %s'),join(', ',$groups_to_update));
 495     foreach ( $groups_to_update as $group ){
 496       $db_members = array_values ( $db_group_members[$group] );
 497       $ldap_members = array_values ( $ldap_groups_info[$group][$member_field] );
 498       $add_users = array_diff ( $ldap_members, $db_members );
 499       if ( sizeof ( $add_users ) ){
 500         $c->messages[] = sprintf(i18n('- adding %s to group : %s'),join(', ', $add_users ), $group);
 501         foreach ( $add_users as $member ){
 502           $qry = new AwlQuery( "INSERT INTO group_member SELECT g.principal_id AS group_id,u.principal_id AS member_id FROM dav_principal g, dav_principal u WHERE g.username=:group AND u.username=:member",array (':group'=>$group,':member'=>$member) );
 503           $qry->Exec('sync_LDAP_groups',__LINE__,__FILE__);
 504           Principal::cacheDelete('username', $member);
 505         }
 506       }
 507       $remove_users = @array_flip( @array_flip( array_diff( $db_members, $ldap_members ) ));
 508       if ( sizeof ( $remove_users ) ){
 509         $c->messages[] = sprintf(i18n('- removing %s from group : %s'),join(', ', $remove_users ), $group);
 510         foreach ( $remove_users as $member ){
 511           $qry = new AwlQuery( "DELETE FROM group_member USING dav_principal g,dav_principal m WHERE group_id=g.principal_id AND member_id=m.principal_id AND g.username=:group AND m.username=:member",array (':group'=>$group,':member'=>$member) );
 512           $qry->Exec('sync_LDAP_groups',__LINE__,__FILE__);
 513           Principal::cacheDelete('username', $member);
 514         }
 515       }
 516     }
 517   }
 518
 519   if ( sizeof ( $groups_to_deactivate ) ){
 520     $c->messages[] = sprintf(i18n('- deactivate groups : %s'),join(', ',$groups_to_deactivate));
 521     foreach ( $groups_to_deactivate as $group ){
 522       $qry = new AwlQuery( 'UPDATE dav_principal SET user_active=FALSE WHERE username=:group AND type_id = 3',array(':group'=>$group) );
 523       $qry->Exec('sync_LDAP',__LINE__,__FILE__);
 524       Principal::cacheFlush('username=:group AND type_id = 3', array(':group'=>$group) );
 525     }
 526   }
 527
 528 }
 529
 530 /**
 531 * sync LDAP against the DB
 532 */
 533 function sync_LDAP(){
 534   global $c;
 535   $ldapDriver = getStaticLdap();
 536   if ( ! $ldapDriver->valid ) return;
 537
 538   $mapping = $c->authenticate_hook['config']['mapping_field'];
 539   $attributes = array_values_mapping($mapping);
 540   $ldap_users_tmp = $ldapDriver->getAllUsers($attributes);
 541
 542   if ( sizeof($ldap_users_tmp) == 0 ) return;
 543
 544   foreach($ldap_users_tmp as $key => $ldap_user){
 545     $ldap_users_info[$ldap_user[$mapping['username']]] = $ldap_user;
 546     unset($ldap_users_tmp[$key]);
 547   }
 548   $qry = new AwlQuery( "SELECT username, user_no, modified as updated FROM dav_principal where type_id=1");
 549   $qry->Exec('sync_LDAP',__LINE__,__FILE__);
 550   while($db_user = $qry->Fetch()) {
 551     $db_users[] = $db_user->username;
 552     $db_users_info[$db_user->username] = array('user_no' => $db_user->user_no, 'updated' => $db_user->updated);
 553   }
 554
 555   // all users from ldap
 556   $ldap_users = array_keys($ldap_users_info);
 557   // users only in ldap
 558   $users_to_create = array_diff($ldap_users,$db_users);
 559   // users only in db
 560   $users_to_deactivate = array_diff($db_users,$ldap_users);
 561   // users present in ldap and in the db
 562   $users_to_update = array_intersect($db_users,$ldap_users);
 563
 564   // creation of all users;
 565   if ( sizeof($users_to_create) ) {
 566     $c->messages[] = sprintf(i18n('- creating record for users :  %s'),join(', ',$users_to_create));
 567
 568     foreach( $users_to_create as $username ) {
 569       $principal = new Principal( 'username', $username );
 570       $valid = $ldap_users_info[$username];
 571       $ldap_timestamp = $valid[$mapping['modified']];
 572
 573       if ( !empty($c->authenticate_hook['config']['format_updated']) ) {
 574         /**
 575         * This splits the LDAP timestamp apart and assigns values to $Y $m $d $H $M and $S
 576         */
 577         foreach($c->authenticate_hook['config']['format_updated'] as $k => $v)
 578             $$k = substr($ldap_timestamp,$v[0],$v[1]);
 579         $ldap_timestamp = $Y.$m.$d.$H.$M.$S;
 580       }
 581       else if ( preg_match('{^(\d{8})(\d{6})(Z)?$', $ldap_timestamp, $matches ) ) {
 582         $ldap_timestamp = $matches[1].'T'.$matches[2].$matches[3];
 583       }
 584       else if ( empty($ldap_timestamp) ) {
 585         $ldap_timestamp = date('c');
 586       }
 587       $valid[$mapping['modified']] = $ldap_timestamp;
 588
 589       sync_user_from_LDAP( $principal, $mapping, $valid );
 590     }
 591   }
 592
 593   // deactivating all users
 594   $params = array();
 595   $i = 0;
 596   $paramstring = '';
 597   foreach( $users_to_deactivate AS $v ) {
 598     if ( isset($c->do_not_sync_from_ldap) && isset($c->do_not_sync_from_ldap[$v]) ) continue;
 599     if ( $i > 0 ) $paramstring .= ',';
 600     $paramstring .= ':u'.$i.'::text';
 601     $params[':u'.$i++] = strtolower($v);
 602   }
 603   if ( count($params) > 0 ) {
 604     $c->messages[] = sprintf(i18n('- deactivating users : %s'),join(', ',$users_to_deactivate));
 605     $qry = new AwlQuery( 'UPDATE usr SET active = FALSE WHERE lower(username) IN ('.$paramstring.')', $params);
 606     $qry->Exec('sync_LDAP',__LINE__,__FILE__);
 607
 608     Principal::cacheFlush('lower(username) IN ('.$paramstring.')', $params);
 609   }
 610
 611   // updating all users
 612   if ( sizeof($users_to_update) ) {
 613     foreach ( $users_to_update as $key=> $username ) {
 614       $principal = new Principal( 'username', $username );
 615       $valid=$ldap_users_info[$username];
 616       $ldap_timestamp = $valid[$mapping['modified']];
 617
 618       $valid['user_no'] = $db_users_info[$username]['user_no'];
 619       $mapping['user_no'] = 'user_no';
 620
 621       /**
 622       * This splits the LDAP timestamp apart and assigns values to $Y $m $d $H $M and $S
 623       */
 624       foreach($c->authenticate_hook['config']['format_updated'] as $k => $v) {
 625         $$k = substr($ldap_timestamp,$v[0],$v[1]);
 626       }
 627       $ldap_timestamp = $Y.$m.$d.$H.$M.$S;
 628       $valid[$mapping['modified']] = "$Y-$m-$d $H:$M:$S";
 629
 630       $db_timestamp = substr(strtr($db_users_info[$username]['updated'], array(':' => '',' '=>'','-'=>'')),0,14);
 631       if ( $ldap_timestamp > $db_timestamp ) {
 632         sync_user_from_LDAP($principal, $mapping, $valid );
 633       }
 634       else {
 635         unset($users_to_update[$key]);
 636         $users_nothing_done[] = $username;
 637       }
 638     }
 639     if ( sizeof($users_to_update) )
 640       $c->messages[] = sprintf(i18n('- updating user records : %s'),join(', ',$users_to_update));
 641     if ( sizeof($users_nothing_done) )
 642       $c->messages[] = sprintf(i18n('- nothing done on : %s'),join(', ', $users_nothing_done));
 643   }
 644
 645   $admins = 0;
 646   $qry = new AwlQuery( "SELECT count(*) AS admins FROM usr JOIN role_member USING ( user_no ) JOIN roles USING (role_no) WHERE usr.active=TRUE AND role_name='Admin'");
 647   $qry->Exec('sync_LDAP',__LINE__,__FILE__);
 648   while ( $db_user = $qry->Fetch() ) {
 649     $admins = $db_user->admins;
 650   }
 651   if ( $admins == 0 ) {
 652     $c->messages[] = sprintf(i18n('Warning: there are no active admin users! You should fix this before logging out.  Consider using the $c->do_not_sync_from_ldap configuration setting.'));
 653   }
 654 }