diff --git a/app/Http/Controllers/Api/SystemController.php b/app/Http/Controllers/Api/SystemController.php index aff427f01..4926b776a 100755 --- a/app/Http/Controllers/Api/SystemController.php +++ b/app/Http/Controllers/Api/SystemController.php @@ -326,7 +326,7 @@ class SystemController extends AbstractController * * @apiParam {String} type * - get: 获取（默认） - * - save: 保存设置（参数：['ldap_open', 'ldap_host', 'ldap_port', 'ldap_password', 'ldap_cn', 'ldap_dn']） + * - save: 保存设置（参数：['ldap_open', 'ldap_host', 'ldap_port', 'ldap_password', 'ldap_user_dn', 'ldap_base_dn', 'ldap_sync_local']） * - testldap: 测试ldap连接 * @apiSuccess {Number} ret 返回状态码（1正确、0错误） * @apiSuccess {String} msg 返回信息（错误描述） @@ -345,10 +345,10 @@ class SystemController extends AbstractController "hosts" => [$all['ldap_host']], "port" => intval($all['ldap_port']), "password" => $all['ldap_password'], - "username" => $all['ldap_cn'], - "base_dn" => $all['ldap_dn'], + "username" => $all['ldap_user_dn'], + "base_dn" => $all['ldap_base_dn'], ]); - if ($connection->auth()->attempt($all['ldap_cn'], $all['ldap_password'])) { + if ($connection->auth()->attempt($all['ldap_user_dn'], $all['ldap_password'])) { return Base::retSuccess('验证通过'); } else { return Base::retError('验证失败'); @@ -367,8 +367,9 @@ class SystemController extends AbstractController 'ldap_host', 'ldap_port', 'ldap_password', - 'ldap_cn', - 'ldap_dn' + 'ldap_user_dn', + 'ldap_base_dn', + 'ldap_sync_local' ])) { unset($all[$key]); } @@ -381,6 +382,7 @@ class SystemController extends AbstractController // $setting['ldap_open'] = $setting['ldap_open'] ?: 'close'; $setting['ldap_port'] = intval($setting['ldap_port']) ?: 389; + $setting['ldap_sync_local'] = $setting['ldap_sync_local'] ?: 'close'; // return Base::retSuccess('success', $setting ?: json_decode('{}')); } diff --git a/app/Http/Controllers/Api/UsersController.php b/app/Http/Controllers/Api/UsersController.php index 248d44677..20ec2711c 100755 --- a/app/Http/Controllers/Api/UsersController.php +++ b/app/Http/Controllers/Api/UsersController.php @@ -50,8 +50,6 @@ class UsersController extends AbstractController * @apiSuccess {Number} ret 返回状态码（1正确、0错误） * @apiSuccess {String} msg 返回信息（错误描述） * @apiSuccess {Object} data 返回数据（同"获取我的信息"接口） - * - * @throws \LdapRecord\Configuration\ConfigurationException */ public function login() { @@ -94,20 +92,23 @@ class UsersController extends AbstractController }; // $user = User::whereEmail($email)->first(); - $checkPassword = true; - if (LdapUser::isOpen() && (empty($user) || in_array('ldap', $user->identity))) { - $user = LdapUser::userLogin($email, $password, $user); - if ($user) { - $identity = array_merge(array_diff($user->identity, ['ldap']), ['ldap']); - $user->identity = "," . implode(",", $identity) . ","; - $user->save(); + $isLdap = true; + if (LdapUser::isOpen()) { + if (empty($user) || $user->isLdap()) { + $user = LdapUser::userLogin($email, $password, $user); + if ($user) { + $user->identity = Base::arrayImplode(array_merge(array_diff($user->identity, ['ldap']), ['ldap'])); + $user->save(); + } + $isLdap = false; } - $checkPassword = false; } if (empty($user)) { return $retError('帐号或密码错误'); } - if ($checkPassword && $user->password != Base::md52($password, $user->encrypt)) { + if ($isLdap) { + LdapUser::userSync($user, $password); + } elseif ($user->password != Base::md52($password, $user->encrypt)) { return $retError('帐号或密码错误'); } // @@ -276,12 +277,17 @@ class UsersController extends AbstractController $user = User::auth(); $data = Request::all(); $user->checkSystem(1); + $upLdap = []; // 头像 if (Arr::exists($data, 'userimg')) { $userimg = Request::input('userimg'); - $user->userimg = $userimg ? Base::unFillUrl(is_array($userimg) ? $userimg[0]['path'] : $userimg) : ''; - if (str_contains($user->userimg, 'avatar/')) { - $user->userimg = ''; + $userimg = $userimg ? Base::unFillUrl(is_array($userimg) ? $userimg[0]['path'] : $userimg) : ''; + if (str_contains($userimg, 'avatar/')) { + $userimg = ''; + } + $user->userimg = $userimg; + if (file_exists(public_path($userimg))) { + $upLdap['jpegPhoto'] = file_get_contents(public_path($userimg)); } } // 电话 @@ -294,6 +300,7 @@ class UsersController extends AbstractController return Base::retError('联系电话已存在'); } $user->tel = $tel; + $upLdap['mobile'] = $tel; } // 昵称 if (Arr::exists($data, 'nickname')) { @@ -306,6 +313,7 @@ class UsersController extends AbstractController $user->nickname = $nickname; $user->az = Base::getFirstCharter($nickname); $user->pinyin = Base::cn2pinyin($nickname); + $upLdap['displayName'] = $nickname; } } // 职位/职称 @@ -317,15 +325,14 @@ class UsersController extends AbstractController return Base::retError('职位/职称最多只能设置20个字'); } else { $user->profession = $profession; + $upLdap['employeeType'] = $profession; } } // $user->save(); User::token($user); + LdapUser::userUpdate($user->email, $upLdap); // - if (empty($user->userimg)) { - $user->userimg = $user->getUserimgAttribute(null); - } return Base::retSuccess('修改成功', $user); } @@ -366,6 +373,7 @@ class UsersController extends AbstractController $user->changepass = 0; $user->save(); User::token($user); + LdapUser::userUpdate($user->email, ['userPassword' => $newpass]); return Base::retSuccess('修改成功', $user); } @@ -675,6 +683,7 @@ class UsersController extends AbstractController $userInfo->checkSystem(1); // $upArray = []; + $upLdap = []; $transferUser = null; switch ($type) { case 'setadmin': @@ -751,10 +760,10 @@ class UsersController extends AbstractController break; } if (isset($upArray['identity'])) { - $upArray['identity'] = "," . implode(",", $upArray['identity']) . ","; + $upArray['identity'] = Base::arrayImplode($upArray['identity']); } if (isset($upArray['department'])) { - $upArray['department'] = "," . implode(",", $upArray['department']) . ","; + $upArray['department'] = Base::arrayImplode($upArray['department']); } // 邮箱 if (Arr::exists($data, 'email')) { @@ -762,6 +771,9 @@ class UsersController extends AbstractController if (User::whereEmail($email)->where('userid', '!=', $userInfo->userid)->exists()) { return Base::retError('邮箱地址已存在'); } + if ($userInfo->isLdap()) { + return Base::retError('LDAP 用户禁止修改邮箱'); + } $upArray['email'] = $email; } // 电话 @@ -771,6 +783,7 @@ class UsersController extends AbstractController return Base::retError('联系电话已存在'); } $upArray['tel'] = $tel; + $upLdap['mobile'] = $tel; } // 密码 if (Arr::exists($data, 'password')) { @@ -779,6 +792,7 @@ class UsersController extends AbstractController $upArray['encrypt'] = Base::generatePassword(6); $upArray['password'] = Base::md52($password, $upArray['encrypt']); $upArray['changepass'] = 1; + $upLdap['userPassword'] = $password; } // 昵称 if (Arr::exists($data, 'nickname')) { @@ -791,6 +805,7 @@ class UsersController extends AbstractController $upArray['nickname'] = $nickname; $upArray['az'] = Base::getFirstCharter($nickname); $upArray['pinyin'] = Base::cn2pinyin($nickname); + $upLdap['displayName'] = $nickname; } } // 职位/职称 @@ -802,14 +817,16 @@ class UsersController extends AbstractController return Base::retError('职位/职称最多只能设置20个字'); } else { $upArray['profession'] = $profession; + $upLdap['employeeType'] = $profession; } } if ($upArray) { - AbstractModel::transaction(function() use ($user, $type, $upArray, $userInfo, $transferUser) { + AbstractModel::transaction(function() use ($upLdap, $user, $type, $upArray, $userInfo, $transferUser) { $exitIds = array_diff($userInfo->department, Base::explodeInt($upArray['department'])); $joinIds = array_diff(Base::explodeInt($upArray['department']), $userInfo->department); $userInfo->updateInstance($upArray); $userInfo->save(); + LdapUser::userUpdate($userInfo->email, $upLdap); if ($type === 'department') { $userids = [$userInfo->userid]; // 退出群组 @@ -1146,6 +1163,10 @@ class UsersController extends AbstractController // $user->checkSystem(); // + if ($user->isLdap()) { + return Base::retError('LDAP 用户禁止修改邮箱'); + } + // $newEmail = trim(Request::input('newEmail')); $code = trim(Request::input('code')); if (!$newEmail) { diff --git a/app/Ldap/LdapUser.php b/app/Ldap/LdapUser.php index ddff75c3e..58aed1d19 100644 --- a/app/Ldap/LdapUser.php +++ b/app/Ldap/LdapUser.php @@ -5,6 +5,7 @@ namespace App\Ldap; use App\Exceptions\ApiException; use App\Models\User; use App\Module\Base; +use LdapRecord\Configuration\ConfigurationException; use LdapRecord\Container; use LdapRecord\LdapRecordException; use LdapRecord\Models\Model; @@ -25,6 +26,23 @@ class LdapUser extends Model 'posixAccount', ]; + /** + * @return mixed|null + */ + public function getPhoto() + { + return $this->jpegPhoto && is_array($this->jpegPhoto) ? $this->jpegPhoto[0] : null; + } + + /** + * @return mixed|null + */ + public function getDisplayName() + { + $nickname = $this->displayName ?: $this->uid; + return is_array($nickname) ? $nickname[0] : $nickname; + } + /** * @return LdapUser */ @@ -39,14 +57,21 @@ class LdapUser extends Model */ public static function isOpen(): bool { - $setting = Base::setting('thirdAccessSetting'); - return $setting['ldap_open'] === 'open'; + return Base::settingFind('thirdAccessSetting', 'ldap_open') === 'open'; + } + + /** + * 同步本地是否打开 + * @return bool + */ + public static function isSyncLocal(): bool + { + return Base::settingFind('thirdAccessSetting', 'ldap_sync_local') === 'open'; } /** * 初始化配置 * @return void - * @throws \LdapRecord\Configuration\ConfigurationException */ public static function initConfig() { @@ -57,13 +82,37 @@ class LdapUser extends Model // $setting = Base::setting('thirdAccessSetting'); $connection = Container::getDefaultConnection(); - $connection->setConfiguration([ - "hosts" => [$setting['ldap_host']], - "port" => intval($setting['ldap_port']), - "password" => $setting['ldap_password'], - "username" => $setting['ldap_cn'], - "base_dn" => $setting['ldap_dn'], - ]); + try { + $connection->setConfiguration([ + "hosts" => [$setting['ldap_host']], + "port" => intval($setting['ldap_port']), + "base_dn" => $setting['ldap_base_dn'], + "username" => $setting['ldap_user_dn'], + "password" => $setting['ldap_password'], + ]); + } catch (ConfigurationException $e) { + throw new ApiException($e->getMessage()); + } + } + + /** + * 获取 + * @param $username + * @param $password + * @return Model|null + */ + public static function userFirst($username, $password): ?Model + { + self::initConfig(); + try { + return self::static() + ->where([ + 'cn' => $username, + 'userPassword' => $password + ])->first(); + } catch (\Exception) { + return null; + } } /** @@ -72,50 +121,69 @@ class LdapUser extends Model * @param $password * @param User|null $user * @return User|mixed|null - * @throws \LdapRecord\Configuration\ConfigurationException */ public static function userLogin($username, $password, $user = null) { self::initConfig(); - $row = self::static() - ->where([ - 'cn' => $username, - 'userPassword' => $password - ])->first(); + $row = self::userFirst($username, $password); if (!$row) { return null; } - if ($user) { - return $user; + if (empty($user)) { + $user = User::reg($username, $password); } - return User::reg($username, Base::generatePassword(32)); + if ($user) { + $userimg = $row->getPhoto(); + if ($userimg) { + $path = "uploads/user/ldap/"; + Base::makeDir(public_path($path)); + file_put_contents(public_path("{$path}{$user->userid}.jpeg"), $userimg); + $user->userimg = "{$path}{$user->userid}.jpeg"; + } + $user->nickname = $row->getDisplayName(); + $user->save(); + } + return $user; } /** - * 添加 - * @param $userid - * @param $username + * 同步 + * @param User $user * @param $password - * @param $description * @return void - * @throws \LdapRecord\Configuration\ConfigurationException */ - public static function userReg($userid, $username, $password, $description = '') + public static function userSync(User $user, $password) { self::initConfig(); - try { - self::static()->create([ - 'cn' => $username, - 'gidNumber' => 0, - 'homeDirectory' => '/home/ldap/dootask/' . env("APP_NAME"), - 'sn' => $username, - 'uid' => $username, - 'uidNumber' => $userid, - 'userPassword' => $password, - 'description' => $description, - ]); - } catch (LdapRecordException $e) { - throw new ApiException("reg ldap fail: " . $e->getMessage()); + // + if (self::isSyncLocal()) { + $row = self::userFirst($user->email, $password); + if ($row) { + return; + } + try { + $userimg = public_path($user->getRawOriginal('userimg')); + if (file_exists($userimg)) { + $userimg = file_get_contents($userimg); + } else { + $userimg = ''; + } + self::static()->create([ + 'cn' => $user->email, + 'gidNumber' => 0, + 'homeDirectory' => '/home/ldap/dootask/' . env("APP_NAME"), + 'sn' => $user->email, + 'uid' => $user->email, + 'uidNumber' => $user->userid, + 'userPassword' => $password, + 'displayName' => $user->nickname, + 'jpegPhoto' => $userimg, + ]); + $user->identity = Base::arrayImplode(array_merge(array_diff($user->identity, ['ldap']), ['ldap'])); + $user->save(); + } catch (LdapRecordException $e) { + info("[LDAP] sync fail: " . $e->getMessage()); + } } } @@ -124,10 +192,12 @@ class LdapUser extends Model * @param $username * @param $array * @return void - * @throws \LdapRecord\Configuration\ConfigurationException */ public static function userUpdate($username, $array) { + if (empty($array)) { + return; + } self::initConfig(); $row = self::static() ->where([ @@ -136,7 +206,7 @@ class LdapUser extends Model try { $row?->update($array); } catch (LdapRecordException $e) { - throw new ApiException("update ldap fail: " . $e->getMessage()); + throw new ApiException("[LDAP] update fail: " . $e->getMessage()); } } @@ -144,7 +214,6 @@ class LdapUser extends Model * 删除 * @param $username * @return void - * @throws \LdapRecord\Configuration\ConfigurationException */ public static function userDelete($username) { @@ -156,7 +225,7 @@ class LdapUser extends Model try { $row?->delete(); } catch (LdapRecordException $e) { - throw new ApiException("delete ldap fail: " . $e->getMessage()); + throw new ApiException("[LDAP] delete fail: " . $e->getMessage()); } } } diff --git a/app/Models/User.php b/app/Models/User.php index 4dd86e2e6..afec671b4 100644 --- a/app/Models/User.php +++ b/app/Models/User.php @@ -170,10 +170,19 @@ class User extends AbstractModel return WebSocket::whereUserid($this->userid)->exists(); } + /** + * 返回是否LDAP用户 + * @return bool + */ + public function isLdap() + { + return in_array('ldap', $this->identity); + } + /** * 判断是否管理员 */ - public function isAdmin() + public function checkAdmin() { $this->identity('admin'); } diff --git a/app/Models/WebSocketDialog.php b/app/Models/WebSocketDialog.php index 6c30ab3b4..8b8ceab51 100644 --- a/app/Models/WebSocketDialog.php +++ b/app/Models/WebSocketDialog.php @@ -306,7 +306,7 @@ class WebSocketDialog extends AbstractModel case 'all': throw new ApiException('当前会话全员禁言'); case 'user': - if (!User::find($userid)?->isAdmin()) { + if (!User::find($userid)?->checkAdmin()) { throw new ApiException('当前会话禁言'); } } diff --git a/app/Module/Base.php b/app/Module/Base.php index 151597c64..f542d8fc2 100755 --- a/app/Module/Base.php +++ b/app/Module/Base.php @@ -917,6 +917,27 @@ class Base return array_values($array); } + /** + * 数组拼接字符串（前后也加上） + * @param $glue + * @param $pieces + * @param $around + * @return string + */ + public static function arrayImplode($glue = "", $pieces = null, $around = true) + { + if ($pieces == null) { + $pieces = $glue; + $glue = ','; + } + $pieces = array_values(array_filter(array_unique($pieces))); + $string = implode($glue, $pieces); + if ($around && $string) { + $string = ",{$string},"; + } + return $string; + } + /** * 判断是否二维数组 * @param $array diff --git a/composer.lock b/composer.lock index a8479fc2a..126eec241 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "1f71e1f0a7f452788cfd5285ba0ecf62", + "content-hash": "d09676319c2877afde501237e463d885", "packages": [ { "name": "asm89/stack-cors", @@ -193,6 +193,145 @@ }, "time": "2022-10-27T11:44:00+00:00" }, + { + "name": "directorytree/ldaprecord", + "version": "v2.19.3", + "source": { + "type": "git", + "url": "https://github.com/DirectoryTree/LdapRecord.git", + "reference": "3557d500b24b331852e4c9ebea1e712b7629cb09" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/DirectoryTree/LdapRecord/zipball/3557d500b24b331852e4c9ebea1e712b7629cb09", + "reference": "3557d500b24b331852e4c9ebea1e712b7629cb09", + "shasum": "" + }, + "require": { + "ext-json": "*", + "ext-ldap": "*", + "illuminate/contracts": "^5.0|^6.0|^7.0|^8.0|^9.0", + "nesbot/carbon": "^1.0|^2.0", + "php": ">=7.3", + "psr/log": "^1.0|^2.0|^3.0", + "psr/simple-cache": "^1.0|^2.0", + "symfony/polyfill-php80": "^1.25", + "tightenco/collect": "^5.6|^6.0|^7.0|^8.0|^9.0" + }, + "require-dev": { + "mockery/mockery": "^1.0", + "phpunit/phpunit": "^9.0", + "spatie/ray": "^1.24" + }, + "type": "library", + "autoload": { + "psr-4": { + "LdapRecord\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Steve Bauman", + "email": "steven_bauman@outlook.com", + "role": "Developer" + } + ], + "description": "A fully-featured LDAP ORM.", + "homepage": "https://www.ldaprecord.com", + "keywords": [ + "active directory", + "ad", + "adLDAP", + "adldap2", + "directory", + "ldap", + "ldaprecord", + "orm", + "windows" + ], + "support": { + "docs": "https://ldaprecord.com", + "email": "steven_bauman@outlook.com", + "issues": "https://github.com/DirectoryTree/LdapRecord/issues", + "source": "https://github.com/DirectoryTree/LdapRecord" + }, + "funding": [ + { + "url": "https://github.com/stevebauman", + "type": "github" + } + ], + "time": "2023-01-16T14:11:36+00:00" + }, + { + "name": "directorytree/ldaprecord-laravel", + "version": "v2.7.2", + "source": { + "type": "git", + "url": "https://github.com/DirectoryTree/LdapRecord-Laravel.git", + "reference": "35eb11817833da9f605ea0429c4e2ff42c481d3d" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/DirectoryTree/LdapRecord-Laravel/zipball/35eb11817833da9f605ea0429c4e2ff42c481d3d", + "reference": "35eb11817833da9f605ea0429c4e2ff42c481d3d", + "shasum": "" + }, + "require": { + "directorytree/ldaprecord": "^2.4.4", + "ext-ldap": "*", + "illuminate/support": "^5.6|^6.0|^7.0|^8.0|^9.0|^10.0", + "php": ">=7.3", + "ramsey/uuid": "*" + }, + "require-dev": { + "laravel/sanctum": "*", + "mockery/mockery": "^1.0", + "orchestra/testbench": "^3.7|^4.0|^5.0|^6.0|^7.0", + "phpunit/phpunit": "^7.0|^8.0|^9.0", + "spatie/ray": "^1.28" + }, + "type": "project", + "extra": { + "laravel": { + "providers": [ + "LdapRecord\\Laravel\\LdapServiceProvider", + "LdapRecord\\Laravel\\LdapAuthServiceProvider" + ] + } + }, + "autoload": { + "psr-4": { + "LdapRecord\\Laravel\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "description": "LDAP Authentication & Management for Laravel.", + "keywords": [ + "adldap2", + "laravel", + "ldap", + "ldaprecord" + ], + "support": { + "issues": "https://github.com/DirectoryTree/LdapRecord-Laravel/issues", + "source": "https://github.com/DirectoryTree/LdapRecord-Laravel/tree/v2.7.2" + }, + "funding": [ + { + "url": "https://github.com/stevebauman", + "type": "github" + } + ], + "time": "2023-01-16T14:13:28+00:00" + }, { "name": "doctrine/inflector", "version": "2.0.6", @@ -6653,6 +6792,60 @@ ], "time": "2022-10-07T08:01:20+00:00" }, + { + "name": "tightenco/collect", + "version": "v9.47.0", + "source": { + "type": "git", + "url": "https://github.com/tighten/collect.git", + "reference": "7bc3f863032e4458d798a4d2fa9379d32504aa97" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/tighten/collect/zipball/7bc3f863032e4458d798a4d2fa9379d32504aa97", + "reference": "7bc3f863032e4458d798a4d2fa9379d32504aa97", + "shasum": "" + }, + "require": { + "php": "^8.0", + "symfony/var-dumper": "^3.4 || ^4.0 || ^5.0 || ^6.0" + }, + "require-dev": { + "mockery/mockery": "^1.0", + "nesbot/carbon": "^2.23.0", + "phpunit/phpunit": "^8.3" + }, + "type": "library", + "autoload": { + "files": [ + "src/Collect/Support/helpers.php", + "src/Collect/Support/alias.php" + ], + "psr-4": { + "Tightenco\\Collect\\": "src/Collect" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Taylor Otwell", + "email": "taylorotwell@gmail.com" + } + ], + "description": "Collect - Illuminate Collections as a separate package.", + "keywords": [ + "collection", + "laravel" + ], + "support": { + "issues": "https://github.com/tighten/collect/issues", + "source": "https://github.com/tighten/collect/tree/v9.47.0" + }, + "time": "2023-01-13T19:14:21+00:00" + }, { "name": "tijsverkoyen/css-to-inline-styles", "version": "2.2.5", diff --git a/config/ldap.php b/config/ldap.php index fd94d32e7..c1a713a36 100644 --- a/config/ldap.php +++ b/config/ldap.php @@ -52,7 +52,7 @@ return [ | */ - 'logging' => env('LDAP_LOGGING', true), + 'logging' => (bool) env('APP_DEBUG', false), /* |-------------------------------------------------------------------------- diff --git a/resources/assets/js/pages/manage/setting/components/SystemThirdAccess.vue b/resources/assets/js/pages/manage/setting/components/SystemThirdAccess.vue index 87a0e605f..0220541c4 100644 --- a/resources/assets/js/pages/manage/setting/components/SystemThirdAccess.vue +++ b/resources/assets/js/pages/manage/setting/components/SystemThirdAccess.vue @@ -8,23 +8,31 @@ {{ $L('开启') }} {{ $L('关闭') }} +
{{$L('开启后可以直接使用 LDAP 帐号密码登录')}}