/**
* Fetches the raw schema array for the subschemaSubentry of the server. Note,
* this function has grown many hairs to accomodate more LDAP servers. It is
* needfully complicated as it now supports many popular LDAP servers that
* don't necessarily expose their schema "the right way".
*
* Please note: On FC systems, it seems that php_ldap uses /etc/openldap/ldap.conf in
* the search base if it is blank - so edit that file and comment out the BASE line.
*
* @param string $schema_to_fetch - A string indicating which type of schema to
* fetch. Five valid values: 'objectclasses', 'attributetypes',
* 'ldapsyntaxes', 'matchingruleuse', or 'matchingrules'.
* Case insensitive.
* @param dn $dn (optional) This paremeter is the DN of the entry whose schema you
* would like to fetch. Entries have the option of specifying
* their own subschemaSubentry that points to the DN of the system
* schema entry which applies to this attribute. If unspecified,
* this will try to retrieve the schema from the RootDSE subschemaSubentry.
* Failing that, we use some commonly known schema DNs. Default
* value is the Root DSE DN (zero-length string)
* @return array an array of strings of this form:
* Array (
* [0] => "(1.3.6.1.4.1.7165.1.2.2.4 NAME 'gidPool' DESC 'Pool ...
* [1] => "(1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' DESC 'Sa ...
* etc.
*/
function getRawSchema($schema_to_fetch, $dn = '')
{
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Entered with (%s,%s)', 25, get_class($this), $schema_to_fetch, $dn);
}
$valid_schema_to_fetch = array('objectclasses', 'attributetypes', 'ldapsyntaxes', 'matchingrules', 'matchingruleuse');
if (!$this->connect()) {
return false;
}
# error checking
$schema_to_fetch = strtolower($schema_to_fetch);
if (!is_null($this->_schema_entries) && isset($this->_schema_entries[$schema_to_fetch])) {
$schema = $this->_schema_entries[$schema_to_fetch];
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Returning CACHED (%s)', 25, get_class($this), $schema);
}
return $schema;
}
# This error message is not localized as only developers should ever see it
if (!in_array($schema_to_fetch, $valid_schema_to_fetch)) {
pla_error(sprintf('Bad parameter provided to function to %s::getRawSchema(). "%s" is not valid for the schema_to_fetch parameter.', get_class($this), htmlspecialchars($schema_to_fetch)));
}
# Try to get the schema DN from the specified entry.
$schema_dn = $this->getSchemaDN($dn);
# Do we need to try again with the Root DSE?
if (!$schema_dn) {
$schema_dn = $this->getSchemaDN('');
}
# Store the eventual schema retrieval in $schema_search
$schema_search = null;
if ($schema_dn) {
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Using Schema DN (%s)', 24, get_class($this), $schema_dn);
}
foreach (array('(objectClass=*)', '(objectClass=subschema)') as $schema_filter) {
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Looking for schema with Filter (%s)', 24, get_class($this), $schema_filter);
}
$schema_search = @ldap_read($this->connect(), $schema_dn, $schema_filter, array($schema_to_fetch), 0, 0, 0, LDAP_DEREF_ALWAYS);
if (is_null($schema_search)) {
continue;
}
$schema_entries = @ldap_get_entries($this->connect(), $schema_search);
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Search returned [%s]', 24, get_class($this), $schema_entries);
}
if (is_array($schema_entries) && isset($schema_entries['count'])) {
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Found schema with filter of (%s)', 24, get_class($this), $schema_filter);
}
break;
}
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Didnt find schema with filter (%s)', 24, get_class($this), $schema_filter);
}
unset($schema_entries);
$schema_search = null;
}
}
/* Second chance: If the DN or Root DSE didn't give us the subschemaSubentry, ie $schema_search
is still null, use some common subSchemaSubentry DNs as a work-around. */
if (is_null($schema_search)) {
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Attempting work-arounds for "broken" LDAP servers...', 24, get_class($this));
}
foreach ($this->getBaseDN() as $base) {
$ldap['W2K3 AD'][expand_dn_with_base($base, 'cn=Aggregate,cn=Schema,cn=configuration,')] = '(objectClass=*)';
$ldap['W2K AD'][expand_dn_with_base($base, 'cn=Schema,cn=configuration,')] = '(objectClass=*)';
$ldap['W2K AD'][expand_dn_with_base($base, 'cn=Schema,ou=Admin,')] = '(objectClass=*)';
}
# OpenLDAP and Novell
$ldap['OpenLDAP']['cn=subschema'] = '(objectClass=*)';
foreach ($ldap as $ldap_server_name => $ldap_options) {
foreach ($ldap_options as $ldap_dn => $ldap_filter) {
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Attempting [%s] (%s) (%s)<BR>', 24, get_class($this), $ldap_server_name, $ldap_dn, $ldap_filter);
}
$schema_search = @ldap_read($this->connect(), $ldap_dn, $ldap_filter, array($schema_to_fetch), 0, 0, 0, LDAP_DEREF_ALWAYS);
if (is_null($schema_search)) {
continue;
}
$schema_entries = @ldap_get_entries($this->connect(), $schema_search);
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Search returned [%s]', 24, get_class($this), $schema_entries);
}
if ($schema_entries && isset($schema_entries[0][$schema_to_fetch])) {
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Found schema with filter of (%s)', 24, get_class($this), $ldap_filter);
}
break;
}
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Didnt find schema with filter (%s)', 24, get_class($this), $ldap_filter);
}
unset($schema_entries);
$schema_search = null;
}
if ($schema_search) {
break;
}
}
}
if (is_null($schema_search)) {
/* Still cant find the schema, try with the RootDSE
Attempt to pull schema from Root DSE with scope "base", or
Attempt to pull schema from Root DSE with scope "one" (work-around for Isode M-Vault X.500/LDAP) */
foreach (array('base', 'one') as $ldap_scope) {
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Attempting to find schema with scope (%s), filter (objectClass=*) and a blank base.', 24, get_class($this), $ldap_scope);
}
switch ($ldap_scope) {
case 'base':
$schema_search = @ldap_read($this->connect(), '', '(objectClass=*)', array($schema_to_fetch), 0, 0, 0, LDAP_DEREF_ALWAYS);
break;
case 'one':
$schema_search = @ldap_list($this->connect(), '', '(objectClass=*)', array($schema_to_fetch), 0, 0, 0, LDAP_DEREF_ALWAYS);
break;
}
if (is_null($schema_search)) {
continue;
}
$schema_entries = @ldap_get_entries($this->connect(), $schema_search);
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Search returned [%s]', 24, get_class($this), $schema_entries);
}
if ($schema_entries && isset($schema_entries[0][$schema_to_fetch])) {
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Found schema with filter of (%s)', 24, get_class($this), '(objectClass=*)');
}
break;
}
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Didnt find schema with filter (%s)', 24, get_class($this), '(objectClass=*)');
}
unset($schema_entries);
$schema_search = null;
}
}
$schema_error_message = 'Please contact the phpLDAPadmin developers and let them know:<ul><li>Which LDAP server you are running, including which version<li>What OS it is running on<li>Which version of PHP<li>As well as a link to some documentation that describes how to obtain the SCHEMA information</ul><br />We\'ll then add support for your LDAP server in an upcoming release.';
$schema_error_message_array = array('objectclasses', 'attributetypes');
# Shall we just give up?
if (is_null($schema_search)) {
# We need to have objectclasses and attribues, so display an error, asking the user to get us this information.
if (in_array($schema_to_fetch, $schema_error_message_array)) {
pla_error(sprintf('Our attempts to find your SCHEMA for "%s" have FAILED.<br /><br />%s', $schema_to_fetch, $schema_error_message));
} else {
$return = false;
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Returning because schema_search is NULL (%s)', 25, get_class($this), $return);
}
return $return;
}
}
# Did we get something unrecognizable?
if (gettype($schema_search) != 'resource') {
if (in_array($schema_to_fetch, $schema_error_message_array)) {
pla_error(sprintf('Our attempts to find your SCHEMA for "%s" has return UNEXPECTED results.<br /><br /><small>(We expected a "resource" for $schema_search, instead, we got (%s))</small><br /><br />%s<br /><br />Dump of $schema_search:<hr /><pre><small>%s</small></pre>', $schema_to_fetch, gettype($schema_search), $schema_error_message, serialize($schema_search)));
} else {
$return = false;
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Returning because schema_search type is not a resource (%s)', 25, get_class($this), $return);
}
return $return;
}
}
if (!$schema_entries) {
$return = false;
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Returning false since ldap_get_entries() returned false.', 25, get_class($this), $return);
}
return $return;
}
if (!isset($schema_entries[0][$schema_to_fetch])) {
if (in_array($schema_to_fetch, $schema_error_message_array)) {
pla_error(sprintf('Our attempts to find your SCHEMA for "%s" has return UNEXPECTED results.<br /><br /><small>(We expected a "%s" in the $schema array but it wasnt there.)</small><br /><br />%s<br /><br />Dump of $schema_search:<hr /><pre><small>%s</small></pre>', $schema_to_fetch, gettype($schema_search), $schema_error_message, serialize($schema_entries)));
} else {
$return = false;
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Returning because (%s) isnt in the schema array. (%s)', 25, get_class($this), $schema_to_fetch, $return);
}
return $return;
}
}
/* Make a nice array of this form:
Array (
[0] => "(1.3.6.1.4.1.7165.1.2.2.4 NAME 'gidPool' DESC 'Pool ...)"
[1] => "(1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' DESC 'Sa ...)"
etc.) */
$schema = $schema_entries[0][$schema_to_fetch];
unset($schema['count']);
$this->_schema_entries[$schema_to_fetch] = $schema;
if (DEBUG_ENABLED) {
debug_log('%s::getRawSchema(): Returning (%s)', 25, get_class($this), $schema);
}
return $schema;
}
/**
* Fetches the raw schema array for the subschemaSubentry of the server. Note,
* this function has grown many hairs to accomodate more LDAP servers. It is
* needfully complicated as it now supports many popular LDAP servers that
* don't necessarily expose their schema "the right way".
*
* Please note: On FC systems, it seems that php_ldap uses /etc/openldap/ldap.conf in
* the search base if it is blank - so edit that file and comment out the BASE line.
*
* @param string Which connection method resource to use
* @param string A string indicating which type of schema to
* fetch. Five valid values: 'objectclasses', 'attributetypes',
* 'ldapsyntaxes', 'matchingruleuse', or 'matchingrules'.
* Case insensitive.
* @param dn (optional) This paremeter is the DN of the entry whose schema you
* would like to fetch. Entries have the option of specifying
* their own subschemaSubentry that points to the DN of the system
* schema entry which applies to this attribute. If unspecified,
* this will try to retrieve the schema from the RootDSE subschemaSubentry.
* Failing that, we use some commonly known schema DNs. Default
* value is the Root DSE DN (zero-length string)
* @return array an array of strings of this form:
* Array (
* [0] => "(1.3.6.1.4.1.7165.1.2.2.4 NAME 'gidPool' DESC 'Pool ...
* [1] => "(1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' DESC 'Sa ...
* etc.
*/
private function getRawSchema($method, $schema_to_fetch, $dn = '')
{
if (DEBUG_ENABLED && (($fargs = func_get_args()) || ($fargs = 'NOARGS'))) {
debug_log('Entered (%%)', 25, 0, __FILE__, __LINE__, __METHOD__, $fargs);
}
$valid_schema_to_fetch = array('objectclasses', 'attributetypes', 'ldapsyntaxes', 'matchingrules', 'matchingruleuse');
if (!$this->connect($method) || $this->noconnect) {
return false;
}
# error checking
$schema_to_fetch = strtolower($schema_to_fetch);
if (!is_null($this->_schema_entries) && isset($this->_schema_entries[$schema_to_fetch])) {
$schema = $this->_schema_entries[$schema_to_fetch];
if (DEBUG_ENABLED) {
debug_log('Returning CACHED (%s)', 25, 0, __FILE__, __LINE__, __METHOD__, $schema);
}
return $schema;
}
# This error message is not localized as only developers should ever see it
if (!in_array($schema_to_fetch, $valid_schema_to_fetch)) {
error(sprintf('Bad parameter provided to function to %s::getRawSchema(). "%s" is not valid for the schema_to_fetch parameter.', get_class($this), $schema_to_fetch), 'error', 'index.php');
}
# Try to get the schema DN from the specified entry.
$schema_dn = $this->getSchemaDN($method, $dn);
# Do we need to try again with the Root DSE?
if (!$schema_dn && trim($dn)) {
$schema_dn = $this->getSchemaDN($method, '');
}
# Store the eventual schema retrieval in $schema_search
$schema_search = null;
if ($schema_dn) {
if (DEBUG_ENABLED) {
debug_log('Using Schema DN (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, $schema_dn);
}
foreach (array('(objectClass=*)', '(objectClass=subschema)') as $schema_filter) {
if (DEBUG_ENABLED) {
debug_log('Looking for schema with Filter (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, $schema_filter);
}
$schema_search = @ldap_read($this->connect($method), $schema_dn, $schema_filter, array($schema_to_fetch), false, 0, 10, LDAP_DEREF_NEVER);
if (is_null($schema_search)) {
continue;
}
$schema_entries = @ldap_get_entries($this->connect($method), $schema_search);
if (DEBUG_ENABLED) {
debug_log('Search returned [%s]', 24, 0, __FILE__, __LINE__, __METHOD__, $schema_entries);
}
if (is_array($schema_entries) && isset($schema_entries['count']) && $schema_entries['count']) {
if (DEBUG_ENABLED) {
debug_log('Found schema with (DN:%s) (FILTER:%s) (ATTR:%s)', 24, 0, __FILE__, __LINE__, __METHOD__, $schema_dn, $schema_filter, $schema_to_fetch);
}
break;
}
if (DEBUG_ENABLED) {
debug_log('Didnt find schema with filter (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, $schema_filter);
}
unset($schema_entries);
$schema_search = null;
}
}
/* Second chance: If the DN or Root DSE didn't give us the subschemaSubentry, ie $schema_search
* is still null, use some common subSchemaSubentry DNs as a work-around. */
if (is_null($schema_search)) {
if (DEBUG_ENABLED) {
debug_log('Attempting work-arounds for "broken" LDAP servers...', 24, 0, __FILE__, __LINE__, __METHOD__);
}
foreach ($this->getBaseDN() as $base) {
$ldap['W2K3 AD'][expand_dn_with_base($base, 'cn=Aggregate,cn=Schema,cn=configuration,')] = '(objectClass=*)';
$ldap['W2K AD'][expand_dn_with_base($base, 'cn=Schema,cn=configuration,')] = '(objectClass=*)';
$ldap['W2K AD'][expand_dn_with_base($base, 'cn=Schema,ou=Admin,')] = '(objectClass=*)';
}
# OpenLDAP and Novell
$ldap['OpenLDAP']['cn=subschema'] = '(objectClass=*)';
foreach ($ldap as $ldap_server_name => $ldap_options) {
foreach ($ldap_options as $ldap_dn => $ldap_filter) {
if (DEBUG_ENABLED) {
debug_log('Attempting [%s] (%s) (%s)<BR>', 24, 0, __FILE__, __LINE__, __METHOD__, $ldap_server_name, $ldap_dn, $ldap_filter);
}
$schema_search = @ldap_read($this->connect($method), $ldap_dn, $ldap_filter, array($schema_to_fetch), false, 0, 10, LDAP_DEREF_NEVER);
if (is_null($schema_search)) {
continue;
}
$schema_entries = @ldap_get_entries($this->connect($method), $schema_search);
if (DEBUG_ENABLED) {
debug_log('Search returned [%s]', 24, 0, __FILE__, __LINE__, __METHOD__, $schema_entries);
}
if ($schema_entries && isset($schema_entries[0][$schema_to_fetch])) {
if (DEBUG_ENABLED) {
debug_log('Found schema with filter of (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, $ldap_filter);
}
break;
}
if (DEBUG_ENABLED) {
debug_log('Didnt find schema with filter (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, $ldap_filter);
}
unset($schema_entries);
$schema_search = null;
}
if ($schema_search) {
break;
}
}
}
# Option 3: try cn=config
$olc_schema = 'olc' . $schema_to_fetch;
$olc_schema_found = false;
if (is_null($schema_search)) {
if (DEBUG_ENABLED) {
debug_log('Attempting cn=config work-around...', 24, 0, __FILE__, __LINE__, __METHOD__);
}
$ldap_dn = 'cn=schema,cn=config';
$ldap_filter = '(objectClass=*)';
$schema_search = @ldap_search($this->connect($method), $ldap_dn, $ldap_filter, array($olc_schema), false, 0, 10, LDAP_DEREF_NEVER);
if (!is_null($schema_search)) {
$schema_entries = @ldap_get_entries($this->connect($method), $schema_search);
if (DEBUG_ENABLED) {
debug_log('Search returned [%s]', 24, 0, __FILE__, __LINE__, __METHOD__, $schema_entries);
}
if ($schema_entries) {
if (DEBUG_ENABLED) {
debug_log('Found schema with filter of (%s) and attribute filter (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, $ldap_filter, $olc_schema);
}
$olc_schema_found = true;
} else {
if (DEBUG_ENABLED) {
debug_log('Didnt find schema with filter (%s) and attribute filter (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, $ldap_filter, $olc_schema);
}
unset($schema_entries);
$schema_search = null;
}
}
}
if (is_null($schema_search)) {
/* Still cant find the schema, try with the RootDSE
* Attempt to pull schema from Root DSE with scope "base", or
* Attempt to pull schema from Root DSE with scope "one" (work-around for Isode M-Vault X.500/LDAP) */
foreach (array('base', 'one') as $ldap_scope) {
if (DEBUG_ENABLED) {
debug_log('Attempting to find schema with scope (%s), filter (objectClass=*) and a blank base.', 24, 0, __FILE__, __LINE__, __METHOD__, $ldap_scope);
}
switch ($ldap_scope) {
case 'base':
$schema_search = @ldap_read($this->connect($method), '', '(objectClass=*)', array($schema_to_fetch), false, 0, 10, LDAP_DEREF_NEVER);
break;
case 'one':
$schema_search = @ldap_list($this->connect($method), '', '(objectClass=*)', array($schema_to_fetch), false, 0, 10, LDAP_DEREF_NEVER);
break;
}
if (is_null($schema_search)) {
continue;
}
$schema_entries = @ldap_get_entries($this->connect($method), $schema_search);
if (DEBUG_ENABLED) {
debug_log('Search returned [%s]', 24, 0, __FILE__, __LINE__, __METHOD__, $schema_entries);
}
if ($schema_entries && isset($schema_entries[0][$schema_to_fetch])) {
if (DEBUG_ENABLED) {
debug_log('Found schema with filter of (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, '(objectClass=*)');
}
break;
}
if (DEBUG_ENABLED) {
debug_log('Didnt find schema with filter (%s)', 24, 0, __FILE__, __LINE__, __METHOD__, '(objectClass=*)');
}
unset($schema_entries);
$schema_search = null;
}
}
$schema_error_message = 'Please contact the phpLDAPadmin developers and let them know:<ul><li>Which LDAP server you are running, including which version<li>What OS it is running on<li>Which version of PHP<li>As well as a link to some documentation that describes how to obtain the SCHEMA information</ul><br />We\'ll then add support for your LDAP server in an upcoming release.';
$schema_error_message_array = array('objectclasses', 'attributetypes');
# Shall we just give up?
if (is_null($schema_search)) {
# We need to have objectclasses and attribues, so display an error, asking the user to get us this information.
if (in_array($schema_to_fetch, $schema_error_message_array)) {
system_message(array('title' => sprintf('%s (%s)', _('Our attempts to find your SCHEMA have failed'), $schema_to_fetch), 'body' => sprintf('<b>%s</b>: %s', _('Error'), $schema_error_message), 'type' => 'error'));
} else {
if (DEBUG_ENABLED) {
debug_log('Returning because schema_search is NULL ()', 25, 0, __FILE__, __LINE__, __METHOD__);
}
}
# We'll set this, so if we return here our cache will return the known false.
$this->_schema_entries[$schema_to_fetch] = false;
return false;
}
if (!$schema_entries) {
$return = false;
if (DEBUG_ENABLED) {
debug_log('Returning false since ldap_get_entries() returned false.', 25, 0, __FILE__, __LINE__, __METHOD__, $return);
}
return $return;
}
if ($olc_schema_found) {
unset($schema_entries['count']);
foreach ($schema_entries as $entry) {
if (isset($entry[$olc_schema])) {
unset($entry[$olc_schema]['count']);
foreach ($entry[$olc_schema] as $schema_definition) {
/* Schema definitions in child nodes prefix the schema entries with "{n}"
the preg_replace call strips out this prefix. */
$schema[] = preg_replace('/^\\{\\d*\\}\\(/', '(', $schema_definition);
}
}
}
if (isset($schema)) {
$this->_schema_entries[$olc_schema] = $schema;
if (DEBUG_ENABLED) {
debug_log('Returning (%s)', 25, 0, __FILE__, __LINE__, __METHOD__, $schema);
}
return $schema;
} else {
return null;
}
}
if (!isset($schema_entries[0][$schema_to_fetch])) {
if (in_array($schema_to_fetch, $schema_error_message_array)) {
error(sprintf('Our attempts to find your SCHEMA for "%s" have return UNEXPECTED results.<br /><br /><small>(We expected a "%s" in the $schema array but it wasnt there.)</small><br /><br />%s<br /><br />Dump of $schema_search:<hr /><pre><small>%s</small></pre>', $schema_to_fetch, gettype($schema_search), $schema_error_message, serialize($schema_entries)), 'error', 'index.php');
} else {
$return = false;
if (DEBUG_ENABLED) {
debug_log('Returning because (%s) isnt in the schema array. (%s)', 25, 0, __FILE__, __LINE__, __METHOD__, $schema_to_fetch, $return);
}
return $return;
}
}
/* Make a nice array of this form:
Array (
[0] => "(1.3.6.1.4.1.7165.1.2.2.4 NAME 'gidPool' DESC 'Pool ...)"
[1] => "(1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' DESC 'Sa ...)"
etc.) */
$schema = $schema_entries[0][$schema_to_fetch];
unset($schema['count']);
$this->_schema_entries[$schema_to_fetch] = $schema;
if (DEBUG_ENABLED) {
debug_log('Returning (%s)', 25, 0, __FILE__, __LINE__, __METHOD__, $schema);
}
return $schema;
}
