[Sommaire] [Imprimer]

   1  <?php
   2  /**
   3   * The Group_ldap class provides an LDAP backend for the Horde groups
   4   * system.
   5   *
   6   * $Horde: framework/Group/Group/ldap.php,v 1.18.2.2 2006/01/01 21:28:19 jan Exp $
   7   *
   8   * Copyright 2005-2006 Ben Chavet <ben@horde.org>
   9   *
  10   * See the enclosed file COPYING for license information (LGPL). If you
  11   * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html.
  12   *
  13   * @author  Ben Chavet <ben@horde.org>
  14   * @since   Horde 3.1
  15   * @package Horde_Group
  16   */
  17  class Group_ldap extends Group {
  18  
  19      /**
  20       * LDAP connection handle
  21       */
  22      var $_ds;
  23  
  24      /**
  25       * Local copy of the global $conf['group']['params'] array.  Simply
  26       * for coding convenience.
  27       */
  28      var $_params;
  29  
  30      /**
  31       * Generated LDAP filter based on the config parameters
  32       */
  33      var $_filter;
  34  
  35      /**
  36       * Constructor.
  37       */
  38      function Group_ldap()
  39      {
  40          global $conf;
  41          $this->_params = $conf['group']['params'];
  42  
  43          $this->_params['gid'] = strtolower($this->_params['gid']);
  44          $this->_params['memberuid'] = strtolower($this->_params['memberuid']);
  45          foreach ($this->_params['newgroup_objectclass'] as $key => $val) {
  46              $this->_params['newgroup_objectclass'][$key] = strtolower($val);
  47          }
  48  
  49          /* Generate LDAP search filter. */
  50          if (!empty($this->_params['filter'])) {
  51              $this->_filter = $this->_params['filter'];
  52          } elseif (!is_array($this->_params['objectclass'])) {
  53              $this->_filter = 'objectclass=' . $this->_params['objectclass'];
  54          } else {
  55              $this->_filter = '';
  56              foreach ($this->_params['objectclass'] as $objectclass) {
  57                  $this->_filter = '(&' . $this->_filter;
  58                  $this->_filter .= '(objectclass=' . $objectclass . '))';
  59              }
  60          }
  61  
  62          $this->_filter = strtolower($this->_filter);
  63      }
  64  
  65      /**
  66       * Connects to the LDAP server.
  67       *
  68       * @return boolean  True or False based on success of connect and bind.
  69       */
  70      function _connect()
  71      {
  72          /* Connect to the LDAP server. */
  73          $this->_ds = @ldap_connect($this->_params['hostspec']);
  74          if (!$this->_ds) {
  75              return PEAR::raiseError(_("Failed to connect to LDAP server."));
  76          }
  77  
  78          if (!ldap_set_option($this->_ds, LDAP_OPT_PROTOCOL_VERSION,
  79                               $this->_params['version'])) {
  80              Horde::logMessage(
  81                  sprintf('Set LDAP protocol version to %d failed: [%d] %s',
  82                          $this->_params['version'],
  83                          ldap_errno($conn),
  84                          ldap_error($conn),
  85                          __FILE__, __LINE__));
  86          }
  87  
  88          if (isset($this->_params['binddn'])) {
  89              $bind = @ldap_bind($this->_ds, $this->_params['binddn'],
  90                                 $this->_params['password']);
  91          } else {
  92              $bind = @ldap_bind($this->_ds);
  93          }
  94  
  95          if (!$bind) {
  96              return PEAR::raiseError(_("Could not bind to LDAP server."));
  97          }
  98  
  99          return true;
 100      }
 101  
 102      /**
 103       * Recursively deletes $dn. $this->_ds MUST already be connected.
 104       *
 105       * @return mixed  True if delete was successful, PEAR_Error otherwise.
 106       */
 107      function _recursive_delete($dn)
 108      {
 109          $search = @ldap_list($this->_ds, $dn, 'objectclass=*', array(''));
 110          if (!$search) {
 111              return PEAR::raiseError(_("Could not reach the LDAP server."));
 112          }
 113  
 114          $children = @ldap_get_entries($this->_ds, $search);
 115          for ($i = 0; $i < $children['count']; $i++) {
 116              $result = $this->_recursive_delete($children[$i]['dn']);
 117              if (!$result) {
 118                  return PEAR::raiseError(sprintf(_("Group_ldap: Unable to delete group %s"), $this->getName($children[$i]['dn'])));
 119              }
 120          }
 121  
 122          $result = @ldap_delete($this->_ds, $dn);
 123          if (!$result) {
 124              return PEAR::raiseError(sprintf(_("Group_ldap: Unable to delete group %s"), $dn));
 125          }
 126  
 127          return $result;
 128      }
 129  
 130      /**
 131       * Searches existing groups for the highest gidnumber, and returns
 132       * one higher.
 133       */
 134      function _nextGid()
 135      {
 136          /* Connect to the LDAP server. */
 137          $success = $this->_connect();
 138          if (is_a($success, 'PEAR_Error')) {
 139              return PEAR::raiseError($success->getMessage());
 140          }
 141  
 142          $search = @ldap_search($this->_ds, $dn, $this->_filter);
 143          if (!$search) {
 144              return PEAR::raiseError(_("Could not reach the LDAP server."));
 145          }
 146  
 147          @ldap_sort($this->_ds, $search, 'gidnumber');
 148          $result = @ldap_get_entries($this->_ds, $search);
 149          @ldap_close($this->_ds);
 150  
 151          if (!is_array($result) || (count($result) <= 1)) {
 152              return 0;
 153          }
 154  
 155          return $result[$result['count'] - 1]['gidnumber'][0] + 1;
 156      }
 157  
 158      /**
 159       * Return a new group object.
 160       *
 161       * @param string $name    The group's name.
 162       * @param string $parent  The group's parent's name.
 163       *
 164       * @return LDAP_Group  A new group object.
 165       */
 166      function &newGroup($name, $parent = null)
 167      {
 168          if (empty($name)) {
 169              return PEAR::raiseError(_("Group names must be non-empty"));
 170          }
 171  
 172          global $conf;
 173          if (!empty($conf['hooks']['groupldap'])) {
 174              @include HORDE_BASE . '/config/hooks.php';
 175              if (function_exists('_horde_hook_groupldap')) {
 176                  $entry = call_user_func('_horde_hook_groupldap', $name, $parent);
 177              }
 178          } else {
 179              // Try this simple default and hope it works.
 180              $entry[$this->_params['gid']] = $name;
 181              $entry['objectclass'] = $this->_params['newgroup_objectclass'];
 182              $entry['gidnumber'] = $this->_nextGid();
 183          }
 184  
 185          $group = &new LDAP_Group($name, $parent);
 186          $group->_fromAttributes($entry);
 187          $group->setGroupOb($this);
 188          return $group;
 189      }
 190  
 191      /**
 192       * Return an LDAP_Group object corresponding to the named group, with the
 193       * users and other data retrieved appropriately.
 194       *
 195       * NOTE: getGroupById() should be used where possible instead of
 196       * getGroup() because group names are potentially non-unique values.
 197       *
 198       * @param string $name  The name of the group to retrieve.
 199       *
 200       * @return LDAP_Group  The requested group.
 201       */
 202      function &getGroup($name)
 203      {
 204          $dn = $this->getGroupId($name);
 205          if (is_a($dn, 'PEAR_Error')) {
 206              return PEAR::raiseError($dn->getMessage());
 207          }
 208          $group = &$this->getGroupById($dn);
 209          return $group;
 210      }
 211  
 212      /**
 213       * Return an LDAP_Object object corresponding to the given dn, with the
 214       * users and other data retrieved appropriately.
 215       *
 216       * @param string $dn  The dn of the group to retrieve.
 217       *
 218       * @return LDAP_Object  The requested group.
 219       */
 220      function &getGroupById($dn)
 221      {
 222          static $cache;
 223  
 224          if (!is_array($cache)) {
 225              $cache = array();
 226          }
 227  
 228          if (!isset($cache[$dn])) {
 229              /* Connect to the LDAP server. */
 230              $success = $this->_connect();
 231              if (is_a($success, 'PEAR_Error')) {
 232                  return PEAR::raiseError($success->getMessage());
 233              }
 234  
 235              $search = @ldap_search($this->_ds, $dn, $this->_filter);
 236              if (!$search) {
 237                  return PEAR::raiseError(_("Could not reach the LDAP server."));
 238              }
 239  
 240              $result = @ldap_get_entries($this->_ds, $search);
 241              @ldap_close($this->_ds);
 242              if (!is_array($result) || (count($result) <= 1)) {
 243                  return PEAR::raiseError(_("Empty result."));
 244              }
 245  
 246              $attributes = array();
 247              for ($i = 0; $i < $result[0]['count']; $i++) {
 248                  if ($result[0][$result[0][$i]]['count'] > 1) {
 249                      $attributes[$result[0][$i]] = array();
 250                      for ($j = 0; $j < $result[0][$result[0][$i]]['count']; $j++) {
 251                          $attributes[$result[0][$i]][] = $result[0][$result[0][$i]][$j];
 252                      }
 253                  } else {
 254                      $attributes[$result[0][$i]] = $result[0][$result[0][$i]][0];
 255                  }
 256              }
 257              $attributes['dn'] = $result[0]['dn'];
 258  
 259              $group = new LDAP_Group($this->getGroupName($dn));
 260              $group->_fromAttributes($attributes);
 261              $group->setGroupOb($this);
 262              $cache[$dn] = $group;
 263          }
 264          return $cache[$dn];
 265      }
 266  
 267      /**
 268       * Get a globally unique ID for a group.  This really just returns the dn
 269       * for the group, but is included for compatibility with the Group class.
 270       *
 271       * @param LDAP_Object $group  The group.
 272       *
 273       * @return string  a GUID referring to $group.
 274       */
 275      function getGUID($group)
 276      {
 277          return $group->get('dn');
 278      }
 279  
 280      /**
 281       * Add a group to the groups system.  The group must first be created with
 282       * Group_ldap::newGroup(), and have any initial users added to it, before
 283       * this function is called.
 284       *
 285       * @param LDAP_Group $group  The new group object.
 286       *
 287       * @return mixed  True if successful, PEAR_Error otherwise.
 288       */
 289      function addGroup($group)
 290      {
 291          if (!is_a($group, 'DataTreeObject_Group')) {
 292              return PEAR::raiseError('Groups must be DataTreeObject_Group objects or extend that class.');
 293          }
 294  
 295          /* Connect to the LDAP server. */
 296          $success = $this->_connect();
 297          if (is_a($success, 'PEAR_Error')) {
 298              return PEAR::raiseError($success->getMessage());
 299          }
 300  
 301          $dn = $group->get('dn');
 302  
 303          $entry = $group->_toAttributes();
 304          $success = @ldap_add($this->_ds, $dn, $entry);
 305  
 306          if (!$success) {
 307              return PEAR::raiseError(sprintf(_("Group_ldap: Unable to add group %s. This is what the server said: "), $group->getName()) . @ldap_error($this->_ds));
 308          }
 309  
 310          @ldap_close($this->_ds);
 311  
 312          return true;
 313      }
 314  
 315      /**
 316       * Store updated data - users, etc. - of a group to the backend system.
 317       *
 318       * @param LDAP_Object $group  The group to update
 319       *
 320       * @return mixed  True on success, PEAR_Error otherwise.
 321       */
 322      function updateGroup($group)
 323      {
 324          if (!is_a($group, 'DataTreeObject_Group')) {
 325              return PEAR::raiseError('Groups must be DataTreeObject_Group objects or extend that class.');
 326          }
 327  
 328          $entry = $group->_toAttributes();
 329  
 330          /* Connect to the LDAP server. */
 331          $success = $this->_connect();
 332          if (is_a($success, 'PEAR_Error')) {
 333              return PEAR::raiseError($success->getMessage());
 334          }
 335  
 336          $result = @ldap_modify($this->_ds, $group->getId(), $entry);
 337          if (!$result) {
 338              return PEAR::raiseError(sprintf(_("Group_ldap: Unable to update group %s"), $group->getName()));
 339          }
 340  
 341          @ldap_close($this->_ds);
 342  
 343          /* Log the update of the group users on the history log. */
 344          $history = &Horde_History::singleton();
 345          $guid = $this->getGUID($group);
 346          foreach ($group->getAuditLog() as $userId => $action) {
 347              $history->log($guid, array('action' => $action, 'user' => $userId), true);
 348          }
 349          $group->clearAuditLog();
 350  
 351          /* Log the group modification. */
 352          $history->log($guid, array('action' => 'modify'), true);
 353          return $result;
 354      }
 355  
 356      /**
 357       * Change the name of a group.
 358       *
 359       * @param DataTreeObject_Group $group  The group to rename.
 360       * @param string $newName              The group's new name.
 361       */
 362      function renameGroup($group, $newName)
 363      {
 364          if (!is_a($group, 'DataTreeObject_Group')) {
 365              return PEAR::raiseError('Groups must be DataTreeObject_Group objects or extend that class.');
 366          }
 367  
 368          $group->set($this->_params['gid'], $newName);
 369          $entry = $group->_toAttributes();
 370  
 371          /* Connect to the LDAP server. */
 372          $success = $this->_connect();
 373          if (is_a($success, 'PEAR_Error')) {
 374              return PEAR::raiseError($success->getMessage());
 375          }
 376  
 377          $result = @ldap_modify($this->_ds, $group->getId(), $entry);
 378          if (!$result) {
 379              return PEAR::raiseError(sprintf(_("Group_ldap: Unable to update group %s"), $group->getName()));
 380          }
 381  
 382          @ldap_close($this->_ds);
 383  
 384          /* History Log the name change of the group. */
 385          $history = &Horde_History::singleton();
 386          $history->log($group->get('dn'), array('action' => 'rename'), true);
 387          return $result;
 388  
 389      }
 390  
 391      /**
 392       * Remove a group from the groups system permanently.
 393       *
 394       * @param LDAP_Group $group  The group to remove.
 395       * @param boolean $force     Recursively delete children groups if true.
 396       *
 397       * @return mixed  True on success, PEAR_Error otherwise.
 398       */
 399      function removeGroup($group, $force = false)
 400      {
 401          if (!is_a($group, 'DataTreeObject_Group')) {
 402              return PEAR::raiseError('Groups must be DataTreeObject_Group objects or extend that class.');
 403          }
 404  
 405          $dn = $group->getId();
 406  
 407          /* Connect to the LDAP server. */
 408          $success = $this->_connect();
 409          if (is_a($success, 'PEAR_Error')) {
 410              return PEAR::raiseError($success->getMessage());
 411          }
 412  
 413          if ($force) {
 414              return $this->_recursive_delete($dn);
 415          } else {
 416              $result = @ldap_delete($this->_ds, $dn);
 417              if (!$result) {
 418                  return PEAR::raiseError(sprintf(_("Group_ldap: Unable to delete group %s"), $dn));
 419              }
 420          }
 421      }
 422  
 423      /**
 424       * Retrieve the name of a group.
 425       *
 426       * @param string $dn  The dn of the group to retrieve the name for.
 427       *
 428       * @return string  The group's name.
 429       */
 430      function getGroupName($dn)
 431      {
 432          $result = ldap_explode_dn($dn, 1);
 433          return $result[0];
 434      }
 435  
 436      /**
 437       * DataTreeObject full names include references to parents, but LDAP does
 438       * not have this concept.  This function simply returns the $group
 439       * parameter and is included for compatibility with the Group class.
 440       *
 441       * @param string $group  Group name.
 442       *
 443       * @return string  $group.
 444       */
 445      function getGroupShortName($group)
 446      {
 447          return $group;
 448      }
 449  
 450      /**
 451       * Retrieve the ID of the given group.
 452       *
 453       * NOTE: If given a group name, this function can be unreliable if more
 454       * than one group exists with the same name.
 455       *
 456       * @param mixed $group   LDAP_Group object, or a group name (string)
 457       *
 458       * @return string  The group's ID.
 459       */
 460      function getGroupId($group)
 461      {
 462          if (is_a($group, 'LDAP_Group')) {
 463              return $group->get('dn');
 464          }
 465  
 466          static $cache;
 467  
 468          if (!is_array($cache)) {
 469              $cache = array();
 470          }
 471  
 472          if (!isset($cache[$group])) {
 473              $this->_connect();
 474              $search = @ldap_search($this->_ds, $this->_params['basedn'],
 475                                     $this->_params['gid'] . '=' . $group,
 476                                     array($this->_params['gid']));
 477              if (!$search) {
 478                  return PEAR::raiseError(_("Could not reach the LDAP server."));
 479              }
 480  
 481              $result = @ldap_get_entries($this->_ds, $search);
 482              @ldap_close($this->_ds);
 483              if (!is_array($result) || (count($result) <= 1)) {
 484                  return PEAR::raiseError(_("Empty result."));
 485              }
 486              $cache[$group] = $result[0]['dn'];
 487          }
 488  
 489          return $cache[$group];
 490      }
 491  
 492      /**
 493       * Check if a group exists in the system.
 494       *
 495       * @param string $group  The group name to check for.
 496       *
 497       * @return boolean  True if the group exists, False otherwise.
 498       */
 499      function exists($group)
 500      {
 501          static $cache;
 502  
 503          if (!is_array($cache)) {
 504              $cache = array();
 505          }
 506  
 507          if (!isset($cache[$group])) {
 508              /* Connect to the LDAP server. */
 509              $success = $this->_connect();
 510              if (is_a($success, 'PEAR_Error')) {
 511                  return PEAR::raiseError($success->getMessage());
 512              }
 513  
 514              $search = @ldap_search($this->_ds, $dn, '(&' . $this->_filter . '(' . $this->_params['gid'] . '=' . $group . '))');
 515              if (!$search) {
 516                  return PEAR::raiseError(_("Could not reach the LDAP server."));
 517              }
 518  
 519              $result = @ldap_get_entries($this->_ds, $search);
 520              @ldap_close($this->_ds);
 521              $cache[$group] = (is_array($result) && (count($result > 1)));
 522          }
 523  
 524          return $cache[$group];
 525      }
 526  
 527      /**
 528       * Get a list of the parents of a child group.
 529       *
 530       * @param string $dn  The dn of the child group.
 531       *
 532       * @return array  The dn and name of the parent group.
 533       */
 534      function getGroupParents($dn)
 535      {
 536          $parent = $this->getGroupParent($dn);
 537          return array($parent => $this->getGroupName($parent));
 538      }
 539  
 540      /**
 541       * Get the parent of the given group.
 542       *
 543       * @param string $dn  The dn of the child group.
 544       *
 545       * @return string  The dn of the parent group.
 546       */
 547      function getGroupParent($dn)
 548      {
 549          $result = ldap_explode_dn($dn, 0);
 550          unset($result['count']);
 551          unset($result[0]);
 552          $parent_dn = implode(',', $result);
 553  
 554          if ($parent_dn == $GLOBALS['conf']['group']['params']['basedn']) {
 555              return DATATREE_ROOT;
 556          } else {
 557              return $parent_dn;
 558          }
 559      }
 560  
 561      /**
 562       * Get a list of parents all the way up to the root object for the given
 563       * group.
 564       *
 565       * @param string $dn  The dn of the group.
 566       *
 567       * @return array  A flat list of all of the parents of the given group,
 568       *                hashed in $dn => $name format.
 569       */
 570      function getGroupParentList($dn)
 571      {
 572          $result = ldap_explode_dn($dn, 0);
 573          $num = $result['count'];
 574  
 575          unset($result['count']);
 576          unset($result[0]);
 577  
 578          $count = 0;
 579          $parents = array();
 580          $parent_dn = implode(',', $result);
 581          while ($parent_dn != $this->_params['basedn'] && $count++ != $num) {
 582              $parents[$parent_dn] = $this->getGroupName($parent_dn);
 583              unset($result[$count]);
 584              $parent_dn = implode(',', $result);
 585          }
 586          $parents[DATATREE_ROOT] = DATATREE_ROOT;
 587  
 588          return $parents;
 589      }
 590  
 591      /**
 592       * Get a list of every group, in the format dn => groupname.
 593       *
 594       * @param boolean $refresh  If true, the cached value is ignored and the
 595       *                          group list is refreshed from the group backend.
 596       *
 597       * @return array  dn => groupname hash.
 598       */
 599      function listGroups($refresh = false)
 600      {
 601          static $groups;
 602  
 603          if ($refresh || is_null($groups)) {
 604              /* Connect to the LDAP server. */
 605              $success = $this->_connect();
 606              if (is_a($success, 'PEAR_Error')) {
 607                  return PEAR::raiseError($success->getMessage());
 608              }
 609  
 610              $search = @ldap_search($this->_ds, $this->_params['basedn'], $this->_filter, array($this->_params['gid']));
 611              if (!$search) {
 612                  return PEAR::raiseError(_("Could not reach the LDAP server."));
 613              }
 614  
 615              @ldap_sort($this->_ds, $search, $this->_params['gid']);
 616  
 617              $result = @ldap_get_entries($this->_ds, $search);
 618              @ldap_close($this->_ds);
 619              if (!is_array($result) || (count($result) <= 1)) {
 620                  return array();
 621              }
 622  
 623              $groups = array();
 624              for ($i = 0; $i < $result['count']; $i++) {
 625                  $groups[$result[$i]['dn']] = $result[$i][$this->_params['gid']][0];
 626              }
 627          }
 628  
 629          return $groups;
 630      }
 631  
 632      /**
 633       * Get a list of every user that is part of the specified group and any
 634       * of its subgroups.
 635       *
 636       * @param string $dn  The dn of the parent group.
 637       *
 638       * @return array  The complete user list.
 639       */
 640      function listAllUsers($dn)
 641      {
 642          static $cache;
 643  
 644          if (!is_array($cache)) {
 645              $cache = array();
 646          }
 647  
 648          if (!isset($cache[$dn])) {
 649              $success = $this->_connect();
 650              if (is_a($success, 'PEAR_Error')) {
 651                  return PEAR::raiseError($success->getMessage());
 652              }
 653  
 654              $search = @ldap_search($this->_ds, $this->getGroupParent($dn), $this->_filer);
 655              if (!$search) {
 656                  return PEAR::raiseError(_("Could not reach the LDAP server."));
 657              }
 658  
 659              $result = @ldap_get_entries($this->_ds, $search);
 660              @ldap_close($this->_ds);
 661              if (!is_array($result) || (count($result) <= 1)) {
 662                  return PEAR::raiseError(_("Empty result."));
 663              }
 664  
 665              $users = array();
 666              for ($i = 0; $i < $result['count']; $i++) {
 667                  for ($j = 0; $j < $result[$i][$this->_params['memberuid']]['count']; $j++) {
 668                      $users[] = $result[$i][$this->_params['memberuid']][$j];
 669                  }
 670              }
 671  
 672              $cache[$dn] = array_unique($users);
 673          }
 674  
 675          return $cache[$dn];
 676      }
 677  
 678      /**
 679       * Get a list of every group that the given user is a member of.
 680       *
 681       * @param string  $user          The user to get groups for.
 682       * @param boolean $parentGroups  Also return the parents of any groups?
 683       *
 684       * @return array  An array of all groups the user is in.
 685       */
 686      function getGroupMemberships($user, $parentGroups = false)
 687      {
 688          static $cache;
 689  
 690          if (empty($cache[$user])) {
 691              /* Connect to the LDAP server. */
 692              $success = $this->_connect();
 693              if (is_a($success, 'PEAR_Error')) {
 694                  return PEAR::raiseError($success->getMessage());
 695              }
 696  
 697              $search = @ldap_search($this->_ds, $this->_params['basedn'], '(' . $this->_params['memberuid'] . '=' . $user . ')');
 698              if (!$search) {
 699                  return PEAR::raiseError(_("Could not reach the LDAP server."));
 700              }
 701  
 702              $result = @ldap_get_entries($this->_ds, $search);
 703              @ldap_close($this->_ds);
 704              if (!is_array($result) || (count($result) <= 1)) {
 705                  return PEAR::raiseError(_("Empty result."));
 706              }
 707  
 708              $groups = array();
 709              for ($i = 0; $i < $result['count']; $i++) {
 710                  $groups[$result[$i]['dn']] = $result[$i][$this->_params['gid']][0];
 711              }
 712  
 713              $cache[$user] = $groups;
 714          }
 715  
 716          return $cache[$user];
 717      }
 718  
 719      /**
 720       * Returns the tree depth of the given group, relative to the base dn.
 721       * 0 is returned for any object directly below the base dn.
 722       *
 723       * @param string $dn  The dn of the object.
 724       *
 725       * @return intenger  The tre depth of the group.
 726       */
 727      function getLevel($dn)
 728      {
 729          $base = @ldap_explode_dn($this->_params['basedn'], 0);
 730          $group = @ldap_explode_dn($dn, 0);
 731          return $group['count'] - $base['count'] - 1;
 732      }
 733  
 734  }
 735  
 736  /**
 737   * Extension of the DataTreeObject_Group class for storing group information
 738   * in an LDAP directory.
 739   *
 740   * @author  Ben Chavet <ben@horde.org>
 741   * @since   Horde 3.1
 742   * @package Horde_Group
 743   */
 744  class LDAP_Group extends DataTreeObject_Group {
 745  
 746      /**
 747       * Constructor.
 748       *
 749       * @param string $name    The name of this group.
 750       * @param string $parent  The dn of the parent of this group.
 751       */
 752      function LDAP_Group($name, $parent = null)
 753      {
 754          parent::DataTreeObject_Group($name);
 755          if ($parent) {
 756              $this->data['dn'] = strtolower($GLOBALS['conf']['group']['params']['gid']) . '=' . $name . ',' . $parent;
 757          } else {
 758              $this->data['dn'] = strtolower($GLOBALS['conf']['group']['params']['gid']) . '=' . $name .
 759                  ',' . strtolower($GLOBALS['conf']['group']['params']['basedn']);
 760          }
 761      }
 762  
 763      /**
 764       * Get a list of every user that is part of this group (and only
 765       * this group).
 766       *
 767       * @return array  The user list.
 768       */
 769      function listUsers()
 770      {
 771          return $this->_groupOb->listUsers($this->data['dn']);
 772      }
 773  
 774      /**
 775       * Get a list of every user that is a member of this group and any of
 776       * it's subgroups.
 777       *
 778       * @return array  The complete user list.
 779       */
 780      function listAllUsers()
 781      {
 782          return $this->_groupOb->listAllUsers($this->data['dn']);
 783      }
 784  
 785      /**
 786       * Take in a list of attributes from the backend and map it to our
 787       * internal data array.
 788       *
 789       * @param array $attributes  The list of attributes from the backend.
 790       */
 791      function _fromAttributes($attributes = array())
 792      {
 793          $this->data['users'] = array();
 794          foreach ($attributes as $key => $value) {
 795              if ($key == strtolower($GLOBALS['conf']['group']['params']['memberuid'])) {
 796                  if (is_array($value)) {
 797                      foreach ($value as $user) {
 798                          $this->data['users'][$user] = '1';
 799                      }
 800                  } else {
 801                      $this->data['users'][$value] = '1';
 802                  }
 803              } elseif ($key == 'mail') {
 804                  $this->data['email'] = $value;
 805              } else {
 806                  $this->data[$key] = $value;
 807              }
 808          }
 809      }
 810  
 811      /**
 812       * Map this object's attributes from the data array into a format that
 813       * can be stored in an LDAP entry.
 814       *
 815       * @return array  The entry array.
 816       */
 817      function _toAttributes()
 818      {
 819          $attributes = array();
 820          foreach ($this->data as $key => $value) {
 821              if ($key == 'users') {
 822                  foreach ($value as $user => $membership) {
 823                      $attributes[strtolower($GLOBALS['conf']['group']['params']['memberuid'])][] = $user;
 824                  }
 825              } elseif ($key == 'email') {
 826                  $attributes['mail'] = !empty($value) ? $value : ' ';
 827              } elseif ($key != 'dn' && $key != strtolower($GLOBALS['conf']['group']['params']['memberuid'])) {
 828                  $attributes[$key] = !empty($value) ? $value : ' ';
 829              }
 830          }
 831  
 832          return $attributes;
 833      }
 834  
 835  }