File Coverage

blib/lib/Samba/LDAP/Group.pm

Criterion	Covered	Total	%
statement	24	202	11.8
branch	0	58	0.0
condition			n/a
subroutine	8	23	34.7
pod	12	12	100.0
total	44	295	14.9

package Samba::LDAP::Group;

# Returned by Perl::MinimumVersion 0.11
require 5.006;

use warnings;
use strict;
use Regexp::DefaultFlags;
use Readonly;
use Carp qw( croak carp );
use base qw(Samba::LDAP::Base);
use Samba::LDAP;

#use Samba::LDAP::User;
use List::MoreUtils qw( any );

our $VERSION = '0.05';

#
# Add Log::Log4perl to all our classes!!!!
#

# Our usage messages
Readonly my $ADD_TO_GROUPS_USAGE =>
  'Usage: add_to_groups( $username | HoA, Aref | HoA);';

#========================================================================
#                         -- PUBLIC METHODS --
#========================================================================

#------------------------------------------------------------------------
# is_group_member( $dn,$userid )
#
# Check that the user is a member of the group already
#------------------------------------------------------------------------

sub is_group_member {
    my $self     = shift;
    my $dn_group = shift;
    my $username = shift;

    my $ldap = Samba::LDAP->new();
    $ldap = $ldap->connect_ldap_slave();

    my $mesg = $ldap->search(
        base   => $dn_group,
        scope  => 'sub',
        filter => "(|(memberUid=$username)(member=uid=$username,$self->{usersDN}))"
    );
    $mesg->code && die $mesg->error;

    return ( $mesg->count ne 0 );
}

#------------------------------------------------------------------------
# add_to_group( $group, $username)
#
# Add $username to LDAP group $group
#------------------------------------------------------------------------

sub add_to_group {
    my $self     = shift;
    my $group    = shift;
    my $username = shift;

    my $members = q{};
    my $dn_line = $self->_get_group_dn($group);

    if ( !defined( $self->_get_group_dn($group) ) ) {
        $self->error("group $group does not exist\n");
        die $self->error();
    }

    if ( !defined($dn_line) ) {
        $self->error("Can not find group DN\n");
        die $self->error();
    }

    ( my $dn = $dn_line ) =~ s{\A dn:}{};

    # Should have been checked earlier, but check again anyway
    my $user       = Samba::LDAP::User->new();
    my $valid_user = $user->is_unix_user($username);

    # Die if they are not
    if ( $valid_user == 1 ) {
        $self->error("User $username, is not even a user on this system\n");
        die $self->error();
    }

    # Now check if the user is already present in the group
    my $is_member = $self->is_group_member( $dn, $username );
    if ( $is_member == 1 ) {
        $self->error("User $username already member of the group $group\n");
        die $self->error();
    }
    else {

        # bind to a directory with dn and password
        # It does not matter if the user already exist, Net::LDAP will add the
        # user if he does not exist, and ignore him if his already in the
        # directory.
        my $ldap = Samba::LDAP->new();
        $ldap = $ldap->connect_ldap_master();
        my $modify =
          $ldap->modify( "$dn",
            changes => [ add => [ memberUid => $username ] ] );
        $modify->code && die "failed to modify entry: ", $modify->error;
        return 0;
    }

    return 1;
}

#------------------------------------------------------------------------
# add_to_groups( $groups_ref | HoA, Aref | HoA, $username )
#
# Pass in a list of groups for the user to be added to.
#------------------------------------------------------------------------

sub add_to_groups {
    my $self     = shift;
    my $groups   = shift;
    my $username = shift;

    # Required arguments
    my @required_args = ($groups);

    # Allow HoA for adding lots of users to groups next.
    #my $groups_ref = {
    #        admin => [ 'staff', 'directors', 'contractors', ],
    #        ghenry => [ 'web_team', 'finance', 'cleaners', ],
    #      };

    croak $ADD_TO_GROUPS_USAGE
      if any { !defined $_ } @required_args;

    # Dereference the hashref passed to us by add_user in
    # Samba::LDAP::User to get the Array, or take a Aref ;-)

    my @groups;
    if ( ref($groups) eq 'HASH' ) {
        for my $key ( keys %{$groups} ) {

            # Reminder: $key is our $username
            $self->add_to_group( $key, ${$groups}{$key} );
        }
        return;
    }

    elsif ( ref($groups) eq 'ARRAY' ) {
        @groups = @{$groups};
    }
    else {
        $self->error("Need a normal Array_Ref, $ADD_TO_GROUPS_USAGE");
        croak $self->error();
    }

    for my $group (@groups) {
        $self->add_to_group( $group, $username );
    }
    return 1;
}

#------------------------------------------------------------------------
# add_group()
#
# Description here
#------------------------------------------------------------------------

sub add_group {
    my $self = shift;
}

#------------------------------------------------------------------------
# show_group( $group )
#
# Lists the entries for that group
#------------------------------------------------------------------------

sub show_group {
    my $self  = shift;
    my $group = shift;

    croak "No group specified!" if !$group;

    return $self->_read_group($group);
}

#------------------------------------------------------------------------
# list_groups()
#
# Lists the entries for that group
#------------------------------------------------------------------------

sub list_groups {
    my $self = shift;
}

#------------------------------------------------------------------------
# delete_group( $group_name )
#
# Deletes group name from LDAP tree
#------------------------------------------------------------------------

sub delete_group {
    my $self  = shift;
    my $group = shift;

    my $ldap = Samba::LDAP->new();
    $ldap = $ldap->connect_ldap_slave();

    my $dn_line = $self->_get_group_dn($group);
    ( my $dn = $dn_line ) =~ s{\A dn: [ ] }{};

    if ( !defined($dn_line) ) {
        $self->error("$group doesn't exist\n");
        return $self->error();
    }

    my $modify = $ldap->delete($dn);
    $modify->code && croak "Failed to delete group : ", $modify->error;

    # take down session
    $ldap->unbind;

    return "$group group deleted\n.";
}

#------------------------------------------------------------------------
# read_group_entry( $group )
#
# Return all posixGroup details
#------------------------------------------------------------------------

sub read_group_entry {
    my $self  = shift;
    my $group = shift;
    my $entry;

    my $ldap = Samba::LDAP->new();
    $ldap = $ldap->connect_ldap_slave();

    my $mesg = $ldap->search(
        base   => $self->{groupsdn},
        scope  => $self->{scope},
        filter => "(&(objectclass=posixGroup)(cn=$group))"
    );

    $mesg->code && die $mesg->error;
    my $nb = $mesg->count;

    if ( $nb > 1 ) {
        $self->error("Error: $nb groups exist \"cn=$group\"\n");

        foreach $entry ( $mesg->all_entries ) {
            my $dn = $entry->dn;
            return $dn;
        }

        return $self->error();
    }
    else {
        $entry = $mesg->shift_entry();
    }
    return $entry;
}

#------------------------------------------------------------------------
# read_group_entry_gid( $group )
#
# Read the group number in the LDAP Directory
#------------------------------------------------------------------------

sub read_group_entry_gid {
    my $self  = shift;
    my $group = shift;

    my $ldap = Samba::LDAP->new();
    $ldap = $ldap->connect_ldap_master();

    my $mesg = $ldap->search(    # perform a search
        base   => $self->{groupsdn},
        scope  => $self->{scope},
        filter => "(&(objectclass=posixGroup)(gidNumber=$group))"
    );

    $mesg->code && die $mesg->error;
    my $entry = $mesg->shift_entry();
    return $entry;
}

#------------------------------------------------------------------------
# find_groups( $username )
#
# Find the groups that $username belongs to
#------------------------------------------------------------------------

sub find_groups {
    my $self   = shift;
    my $user   = shift;
    my @groups = ();

    my $ldap = Samba::LDAP->new();
    $ldap = $ldap->connect_ldap_master();

    # Everything apart from Open-xchange uses memberUid, OX uses
    # member, so we do 2 searches
    my $mesg = $ldap->search(
        base   => $self->{groupsdn},
        scope  => $self->{scope},
        filter => "(&(objectclass=posixGroup)(memberUid=$user))"
    );
    $mesg->code && die $mesg->error;

    my $entry;
    while ( $entry = $mesg->shift_entry() ) {
        push( @groups, scalar( $entry->get_value('cn') ) );
    }

    # OX Search
    my $userdn = "uid=$user,$self->{usersdn}";
    my $mesg2  = $ldap->search(
        base   => $self->{suffix},
        scope  => 'sub',
        filter => "(&(objectclass=groupOfNames)(member=$userdn))"
    );
    $mesg2->code && die $mesg2->error;

    my $entry2;
    while ( $entry2 = $mesg2->shift_entry() ) {
        push( @groups, scalar( $entry2->get_value('cn') ) );
    }

    return (@groups);
}

#------------------------------------------------------------------------
# parse_group( $userGidNumber )
#
# Check the group is either a name or number
#------------------------------------------------------------------------

sub parse_group {
    my $self          = shift;
    my $userGidNumber = shift;

    if ( $userGidNumber =~ /[^\d]/ ) {
        my $gname  = $userGidNumber;
        my $gidnum = getgrnam($gname);
        if ( $gidnum !~ /\d+/ ) {
            return -1;
        }
        else {
            $userGidNumber = $gidnum;
        }
    }
    elsif ( !defined( getgrgid($userGidNumber) ) ) {
        return -2;
    }
    return $userGidNumber;
}

#------------------------------------------------------------------------
# remove_from_group( $group, $username )
#
# Remove the user from $group
#------------------------------------------------------------------------

sub remove_from_group {
    my $self  = shift;
    my $group = shift;
    my $user  = shift;

    my $members = q{};

    my $grp_line = $self->_get_group_dn($group);
    if ( !defined($grp_line) ) {
        return 0;
    }

    ( my $dn = $grp_line ) =~ s{\A dn: [ ] }{};

    # we test if the user exist in the group
    my $is_member = $self->is_group_member( $dn, $user );

    if ( $is_member == 1 ) {

        # delete only the user from the group
        my $ldap = Samba::LDAP->new();
        $ldap = $ldap->connect_ldap_master();
        my $modify = $ldap->modify(
            "$dn",
            changes => [
                delete => [
                    memberUid => ["$user"],
                    member    => ["uid=$user,$self->{usersdn}"],
                ],
            ]
        );
        $modify->code && die "failed to delete entry: ", $modify->error;
    }
    return 1;
}

#========================================================================
#                         -- PRIVATE METHODS --
#========================================================================

#------------------------------------------------------------------------
# _get_group_dn( $group )
#
# Searches for a groups distinguised name
#------------------------------------------------------------------------

sub _get_group_dn {
    my $self  = shift;
    my $group = shift;

    my $ldap = Samba::LDAP->new();
    $ldap = $ldap->connect_ldap_master();

    if ( $group =~ /\A \d+ \z/ ) {
        $self->{filter} =
          "(&(objectclass=posixGroup)(|(cn=$group)(gidNumber=$group)))";
    }
    else {
        $self->{filter} = "(&(objectclass=posixGroup)(cn=$group))";
    }

    my $mesg = $ldap->search(
        base   => $self->{groupsdn},
        scope  => $self->{scope},
        filter => $self->{filter},
    );
    $mesg->code && croak $mesg->error;

    for my $entry ( $mesg->all_entries ) {
        $self->{dn} = $entry->dn;
    }

    # For OX AddressAdmins search
    my $mesg2  = $ldap->search(
        base   => $self->{suffix},
        scope  => $self->{scope},
        filter => "(&(objectclass=groupOfNames)(cn=$group))"
    );
    $mesg2->code && die $mesg2->error;

    for my $entry ( $mesg2->all_entries ) {
        $self->{dn} = $entry->dn;
    }

    if ( !$self->{dn} ) {
        croak "Can not find $group Group";
    }

    my $dn = $self->{dn};
    chomp($dn);

    $dn = "dn: " . $dn;

    return $dn;
}

#------------------------------------------------------------------------
# _read_group( $group )
#
# Search for members of a group
#------------------------------------------------------------------------

sub _read_group {
    my $self  = shift;
    my $group = shift;

    my $ldap_slave = Samba::LDAP->new();
    $ldap_slave = $ldap_slave->connect_ldap_slave();

    my $mesg = $ldap_slave->search(
        base   => $self->{groupsdn},
        scope  => $self->{scope},
        filter => "(&(objectclass=posixGroup)(cn=$group))"
    );
    $mesg->code && croak $mesg->error;

    my $lines = '';
    for my $entry ( $mesg->all_entries ) {
        $lines .= "dn: " . $entry->dn . "\n";
        for my $attr ( $entry->attributes ) {
            {
                $lines .=
                  $attr . ": " . join( ',', $entry->get_value($attr) ) . "\n";
            }
        }
    }

    # take down session
    $ldap_slave->unbind;

    chomp $lines;
    if ( $lines eq '' ) {
        return undef;
    }

    return $lines;
}

1;    # Magic true value required at end of module

__END__