sync_groups_ldap2dolibarr.php

Go to the documentation of this file.

#!/usr/bin/env php
<?php
if (!defined('NOSESSION')) {
  define('NOSESSION', '1');
}
 
$sapi_type = php_sapi_name();
$script_file = basename(__FILE__);
$path = __DIR__.'/';
 
// Test if batch mode
if (substr($sapi_type, 0, 3) == 'cgi') {
  echo "Error: You are using PHP for CGI. To execute ".$script_file." from command line, you must use PHP for CLI mode.\n";
  exit(1);
}
 
require_once $path."../../htdocs/master.inc.php";
require_once DOL_DOCUMENT_ROOT.'/core/lib/functionscli.lib.php';
require_once DOL_DOCUMENT_ROOT."/core/lib/date.lib.php";
require_once DOL_DOCUMENT_ROOT."/core/class/ldap.class.php";
require_once DOL_DOCUMENT_ROOT."/user/class/user.class.php";
require_once DOL_DOCUMENT_ROOT."/user/class/usergroup.class.php";
 
$langs->loadLangs(array("main", "errors"));
 
// Global variables
$version = DOL_VERSION;
$error = 0;
$forcecommit = 0;
$confirmed = 0;
 
$hookmanager->initHooks(array('cli'));
 
 
/*
 * Main
 */
 
@set_time_limit(0);
print "***** ".$script_file." (".$version.") pid=".dol_getmypid()." *****\n";
dol_syslog($script_file." launched with arg ".implode(',', $argv));
 
// List of fields to get from LDAP
$required_fields = array(getDolGlobalString('LDAP_KEY_GROUPS'), getDolGlobalString('LDAP_GROUP_FIELD_FULLNAME'), getDolGlobalString('LDAP_GROUP_FIELD_DESCRIPTION'), getDolGlobalString('LDAP_GROUP_FIELD_GROUPMEMBERS'));
 
// Remove from required_fields all entries not configured in LDAP (empty) and duplicated
$required_fields = array_unique(array_values(array_filter($required_fields, "dolValidLdapElement2")));
 
if (!isset($argv[1])) {
  // print "Usage: $script_file (nocommitiferror|commitiferror) [id_group]\n";
  print "Usage:  $script_file (nocommitiferror|commitiferror) [--server=ldapserverhost] [--excludeuser=user1,user2...] [-y]\n";
  exit(1);
}
 
foreach ($argv as $key => $val) {
  if ($val == 'commitiferror') {
    $forcecommit = 1;
  }
  if (preg_match('/--server=([^\s]+)$/', $val, $reg)) {
    $conf->global->LDAP_SERVER_HOST = $reg[1];
  }
  if (preg_match('/--excludeuser=([^\s]+)$/', $val, $reg)) {
    $excludeuser = explode(',', $reg[1]);
  }
  if (preg_match('/-y$/', $val, $reg)) {
    $confirmed = 1;
  }
}
 
print "Mails sending disabled (useless in batch mode)\n";
$conf->global->MAIN_DISABLE_ALL_MAILS = 1; // We block email sending
print "\n";
print "----- Synchronize all records from LDAP database:\n";
print "host=" . getDolGlobalString('LDAP_SERVER_HOST')."\n";
print "port=" . getDolGlobalString('LDAP_SERVER_PORT')."\n";
print "login=" . getDolGlobalString('LDAP_ADMIN_DN')."\n";
print "pass=".preg_replace('/./i', '*', getDolGlobalString('LDAP_ADMIN_PASS'))."\n";
print "DN to extract=" . getDolGlobalString('LDAP_GROUP_DN')."\n";
if (getDolGlobalString('LDAP_GROUP_FILTER')) {
  print 'Filter=(' . getDolGlobalString('LDAP_GROUP_FILTER').')'."\n"; // Note: filter is defined into function getRecords
} else {
  print 'Filter=(' . getDolGlobalString('LDAP_KEY_GROUPS').'=*)'."\n";
}
print "----- To Dolibarr database:\n";
print "type=".$conf->db->type."\n";
print "host=".$conf->db->host."\n";
print "port=".$conf->db->port."\n";
print "login=".(string) $conf->db->user."\n";
print "database=".$conf->db->name."\n";
print "----- Options:\n";
print "commitiferror=".$forcecommit."\n";
print "Mapped LDAP fields=".implode(',', $required_fields)."\n";
print "\n";
 
if (!$confirmed) {
  print "Hit Enter to continue or CTRL+C to stop...\n";
  $input = trim(fgets(STDIN));
}
 
if (!getDolGlobalString('LDAP_GROUP_DN')) {
  print $langs->trans("Error").': '.$langs->trans("LDAP setup for groups not defined inside Dolibarr");
  exit(1);
}
 
$ldap = new Ldap();
$result = $ldap->connectBind();
if ($result >= 0) {
  $justthese = array();
 
  // We disable synchro Dolibarr-LDAP
  $conf->global->LDAP_SYNCHRO_ACTIVE = 0;
 
  $ldaprecords = $ldap->getRecords('*', getDolGlobalString('LDAP_GROUP_DN'), getDolGlobalString('LDAP_KEY_GROUPS'), $required_fields, 'group', array(getDolGlobalString('LDAP_GROUP_FIELD_GROUPMEMBERS')));
  if (is_array($ldaprecords)) {
    $db->begin();
 
    // Warning $ldapuser has a key in lowercase
    foreach ($ldaprecords as $key => $ldapgroup) {
      $group = new UserGroup($db);
 
      $group->fetch(0, $ldapgroup[getDolGlobalString('LDAP_KEY_GROUPS')], true); // Fetch LDAP groups AND members
      // fetch() searches by group name, but LDAP_KEY_GROUPS may not be the name (ex: 'member' on Active Directory).
      // If the group was not found, try again with the name so that existing groups are updated, not created twice.
      if (empty($group->id) && !empty($ldapgroup[getDolGlobalString('LDAP_GROUP_FIELD_FULLNAME')])) {
        $group->fetch(0, $ldapgroup[getDolGlobalString('LDAP_GROUP_FIELD_FULLNAME')]);
      }
      $group->name = $ldapgroup[getDolGlobalString('LDAP_GROUP_FIELD_FULLNAME')] ?? '';
      $group->nom = $group->name; // For backward compatibility
      $group->note = $ldapgroup[getDolGlobalString('LDAP_GROUP_FIELD_DESCRIPTION')] ?? '';
      $group->entity = $conf->entity;
 
      // print_r($ldapgroup);
 
      if ($group->id > 0) { // Group update
        print $langs->transnoentities("GroupUpdate").' # '.$key.': name='.$group->name;
        $res = $group->update();
 
        if ($res > 0) {
          print ' --> Updated group id='.$group->id.' name='.$group->name;
        } else {
          $error++;
          print ' --> '.$res.' '.$group->error;
        }
        print "\n";
      } else { // Group creation
        print $langs->transnoentities("GroupCreate").' # '.$key.': name='.$group->name;
        $res = $group->create();
 
        if ($res > 0) {
          print ' --> Created group id='.$group->id.' name='.$group->name;
        } else {
          $error++;
          print ' --> '.$res.' '.$group->error;
        }
        print "\n";
      }
 
      // print_r($group);
 
      // Management of the users associated with the group
      // 1 - Association of users in the LDAP group with the Dolibarr group
      $userList = array();
      $userIdList = array();
      $groupMembers = $ldapgroup[getDolGlobalString('LDAP_GROUP_FIELD_GROUPMEMBERS')];
      if (!is_array($groupMembers)) {
        $groupMembers = array();
      }
      foreach ($groupMembers as $tmpkey => $userdn) {  // @phpstan-ignore-line
        if ($tmpkey === 'count') {  // @phpstan-ignore-line
          continue;
        }
        if (empty($userList[$userdn])) { // Fetch the user
          // rfc2307 schema: members are listed in the memberUid attribute as login names only
          if (getDolGlobalString('LDAP_GROUP_FIELD_GROUPMEMBERS') === 'memberUid') {
            $userKey = array($userdn);
          } else { // For other schemas, members are listed as full DNs
            $userFilter = explode(',', $userdn);
            $userKey = $ldap->getAttributeValues('('.$userFilter[0].')', getDolGlobalString('LDAP_KEY_USERS'));
          }
          if (!is_array($userKey)) {
            continue;
          }
 
          $fuser = new User($db);
 
          if (getDolGlobalString('LDAP_KEY_USERS') == getDolGlobalString('LDAP_FIELD_SID')) {
            $fuser->fetch(0, '', $userKey[0]); // Load the user matched by SID
          } elseif (getDolGlobalString('LDAP_KEY_USERS') == getDolGlobalString('LDAP_FIELD_LOGIN')) {
            $fuser->fetch(0, $userKey[0]); // Load the user matched by login
          }
 
          $userList[$userdn] = $fuser;
        } else {
          $fuser = &$userList[$userdn];
        }
 
        if (empty($fuser->id)) {
          // Member of the LDAP group but not a Dolibarr user: nothing to link
          continue;
        }
 
        $userIdList[$userdn] = $fuser->id;
 
        // Add the user in the group
        if (!in_array($fuser->id, array_keys($group->members))) {
          $fuser->SetInGroup($group->id, $group->entity);
          echo $fuser->login.' added'."\n";
        }
      }
 
      // 2 - Delete users from the Dolibarr group that are no longer in the LDAP group
      foreach ($group->members as $guser) {
        if (!in_array($guser->id, $userIdList)) {
          $guser->RemoveFromGroup($group->id, $group->entity);
          echo $guser->login.' removed'."\n";
        }
      }
    }
 
    if (!$error || $forcecommit) {
      if (!$error) {
        print $langs->transnoentities("NoErrorCommitIsDone")."\n";
      } else {
        print $langs->transnoentities("ErrorButCommitIsDone")."\n";
      }
      $db->commit();
    } else {
      print $langs->transnoentities("ErrorSomeErrorWereFoundRollbackIsDone", (string) $error)."\n";
      $db->rollback();
    }
    print "\n";
  } else {
    dol_print_error(null, $ldap->error);
    $error++;
  }
} else {
  dol_print_error(null, $ldap->error);
  $error++;
}
 
exit($error);
 
 
function dolValidLdapElement2($element)
{
  return (trim($element) != '');
}