AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix role precedence in LDAP integration

Browse Source
This commit is contained in:
DebianRoxx
2018-03-08 22:20:33 +01:00
committed by Frédéric Guillot
parent a66d080698
commit d34a5c50c4
2 changed files with 24 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
app/Core/Ldap/User.php
View File

@@ -120,17 +120,25 @@ class User
return null; return null;
} }
// Init with smallest role
$role = Role::APP_USER ;
foreach ($groupIds as $groupId) { foreach ($groupIds as $groupId) {
$groupId = strtolower($groupId); $groupId = strtolower($groupId);
if ($groupId === strtolower($this->getGroupAdminDn())) { if ($groupId === strtolower($this->getGroupAdminDn())) {
return Role::APP_ADMIN; // Highest role found : we can and we must exit the loop
} elseif ($groupId === strtolower($this->getGroupManagerDn())) { $role = Role::APP_ADMIN;
return Role::APP_MANAGER; break;
}
if ($groupId === strtolower($this->getGroupManagerDn())) {
// Intermediate role found : we must continue to loop, maybe admin role after ?
$role = Role::APP_MANAGER;
} }
} }
return Role::APP_USER; return $role;
} }
/** /**

15
tests/units/Core/Ldap/LdapUserTest.php
View File

@@ -231,8 +231,10 @@ class LdapUserTest extends Base
0 => 'my_ldap_user', 0 => 'my_ldap_user',
), ),
'memberof' => array( 'memberof' => array(
'count' => 1, 'count' => 3,
0 => 'CN=Kanboard-Admins,CN=Users,DC=kanboard,DC=local', 0 => 'CN=Kanboard-Users,CN=Users,DC=kanboard,DC=local',
1 => 'CN=Kanboard-Managers,CN=Users,DC=kanboard,DC=local',
2 => 'CN=Kanboard-Admins,CN=Users,DC=kanboard,DC=local',
), ),
0 => 'displayname', 0 => 'displayname',
1 => 'mail', 1 => 'mail',
@@ -301,7 +303,14 @@ class LdapUserTest extends Base
$this->assertEquals('My LDAP user', $user->getName()); $this->assertEquals('My LDAP user', $user->getName());
$this->assertEquals('user1@localhost', $user->getEmail()); $this->assertEquals('user1@localhost', $user->getEmail());
$this->assertEquals(Role::APP_ADMIN, $user->getRole()); $this->assertEquals(Role::APP_ADMIN, $user->getRole());
$this->assertEquals(array('CN=Kanboard-Admins,CN=Users,DC=kanboard,DC=local'), $user->getExternalGroupIds()); $this->assertEquals(
array(
'CN=Kanboard-Users,CN=Users,DC=kanboard,DC=local',
'CN=Kanboard-Managers,CN=Users,DC=kanboard,DC=local',
'CN=Kanboard-Admins,CN=Users,DC=kanboard,DC=local',
),
$user->getExternalGroupIds()
);
$this->assertEquals(array('is_ldap_user' => 1), $user->getExtraAttributes()); $this->assertEquals(array('is_ldap_user' => 1), $user->getExtraAttributes());
} }