public function groupUserMembershipsFromUserAttr($user, $nested = NULL) {

    if (!$this->groupUserMembershipsConfigured) {
      return FALSE;
    }
    if ($nested === NULL) {
      $nested = $this->groupNested;
    }

    $not_user_ldap_entry = empty($user['attr'][$this->groupUserMembershipsAttr]);
    if ($not_user_ldap_entry) { // if drupal user passed in, try to get user_ldap_entry
      $user = $this->userUserToExistingLdapEntry($user);
      $not_user_ldap_entry = empty($user['attr'][$this->groupUserMembershipsAttr]);
      if ($not_user_ldap_entry) {
        return FALSE; // user's membership attribute is not present.  either misconfigured or query failed
      }
    }
    // if not exited yet, $user must be user_ldap_entry.
    $user_ldap_entry = $user;
    $all_group_dns = array();
    $tested_group_ids = array();
    $level = 0;

    $member_group_dns = $user_ldap_entry['attr'][$this->groupUserMembershipsAttr];
    if (isset($member_group_dns['count'])) {
      unset($member_group_dns['count']);
    }
    $ors = array();
    foreach ($member_group_dns as $i => $member_group_dn) {
      $all_group_dns[] = $member_group_dn;
      if ($nested) {
        if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
          $member_value = $member_group_dn;
        }
        else {
          $member_value = ldap_servers_get_first_rdn_value_from_dn($member_group_dn, $this->groupMembershipsAttrMatchingUserAttr);
        }
        $ors[] =  $this->groupMembershipsAttr . '=' . ldap_pear_escape_filter_value($member_value);
      }
    }

    if ($nested && count($ors)) {
      $count = count($ors);
      for ($i=0; $i < $count; $i=$i+LDAP_SERVER_LDAP_QUERY_CHUNK) { // only 50 or so per query
        $current_ors = array_slice($ors, $i, LDAP_SERVER_LDAP_QUERY_CHUNK);
        $or = '(|(' . join(")(", $current_ors) . '))';  // e.g. (|(cn=group1)(cn=group2)) or   (|(dn=cn=group1,ou=blah...)(dn=cn=group2,ou=blah...))
        $query_for_parent_groups = '(&(objectClass=' . $this->groupObjectClass . ')' . $or . ')';

        foreach ($this->basedn as $base_dn) {  // need to search on all basedns one at a time
          // debug("query for parent groups, base_dn=$base_dn, $query_for_parent_groups");
          $group_entries = $this->search($base_dn, $query_for_parent_groups);  // no attributes, just dns needed
          if ($group_entries !== FALSE  && $level < LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT) {
            $this->groupMembershipsFromEntryRecursive($group_entries, $all_group_dns, $tested_group_ids, $level + 1, LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT);
          }
        }
      }
    }

    return $all_group_dns;
  }
public function groupUserMembershipsFromUserAttr($user, $nested = NULL) {

    if (!$this->groupUserMembershipsConfigured) {
      return FALSE;
    }
    if ($nested === NULL) {
      $nested = $this->groupNested;
    }

    $not_user_ldap_entry = empty($user['attr'][$this->groupUserMembershipsAttr]);
    if ($not_user_ldap_entry) { // if drupal user passed in, try to get user_ldap_entry
      $user = $this->userUserToExistingLdapEntry($user);
      $not_user_ldap_entry = empty($user['attr'][$this->groupUserMembershipsAttr]);
      if ($not_user_ldap_entry) {
        return FALSE; // user's membership attribute is not present.  either misconfigured or query failed
      }
    }
    // if not exited yet, $user must be user_ldap_entry.
    $user_ldap_entry = $user;
    $all_group_dns = array();
    $tested_group_ids = array();
    $level = 0;

    $member_group_dns = $user_ldap_entry['attr'][$this->groupUserMembershipsAttr];
    if (isset($member_group_dns['count'])) {
      unset($member_group_dns['count']);
    }
    $ors = array();
    foreach ($member_group_dns as $i => $member_group_dn) {
      $all_group_dns[] = $member_group_dn;
      if ($nested) {
        if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
          $member_value = $member_group_dn;
        }
        else {
          $member_value = ldap_servers_get_first_rdn_value_from_dn($member_group_dn, $this->groupMembershipsAttrMatchingUserAttr);
        }
        $ors[] =  $this->groupMembershipsAttr . '=' . ldap_pear_escape_filter_value($member_value);
      }
    }

    if ($nested && count($ors)) {
      $count = count($ors);
      for ($i=0; $i < $count; $i=$i+LDAP_SERVER_LDAP_QUERY_CHUNK) { // only 50 or so per query
        $current_ors = array_slice($ors, $i, LDAP_SERVER_LDAP_QUERY_CHUNK);
        $or = '(|(' . join(")(", $current_ors) . '))';  // e.g. (|(cn=group1)(cn=group2)) or   (|(dn=cn=group1,ou=blah...)(dn=cn=group2,ou=blah...))
        $query_for_parent_groups = '(&(objectClass=' . $this->groupObjectClass . ')' . $or . ')';

        foreach ($this->basedn as $base_dn) {  // need to search on all basedns one at a time
          // debug("query for parent groups, base_dn=$base_dn, $query_for_parent_groups");
          $group_entries = $this->search($base_dn, $query_for_parent_groups);  // no attributes, just dns needed
          if ($group_entries !== FALSE  && $level < LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT) {
            $this->groupMembershipsFromEntryRecursive($group_entries, $all_group_dns, $tested_group_ids, $level + 1, LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT);
          }
        }
      }
    }

    return $all_group_dns;
  }
public function groupUserMembershipsFromUserAttr ( $ user , $ nested = NULL ) { if ( ! $ this -> groupUserMembershipsConfigured ) { return FALSE ; } if ( $ nested === NULL ) { $ nested = $ this -> groupNested ; } $ not_user_ldap_entry = empty ( $ user [ 'attr' ] [ $ this -> groupUserMembershipsAttr ] ) ; if ( $ not_user_ldap_entry ) { // if drupal user passed in, try to get user_ldap_entry $ user = $ this -> userUserToExistingLdapEntry ( $ user ) ; $ not_user_ldap_entry = empty ( $ user [ 'attr' ] [ $ this -> groupUserMembershipsAttr ] ) ; if ( $ not_user_ldap_entry ) { return FALSE ; // user's membership attribute is not present.  either misconfigured or query failed } } // if not exited yet, $user must be user_ldap_entry. $ user_ldap_entry = $ user ; $ all_group_dns = array ( ) ; $ tested_group_ids = array ( ) ; $ level = 0 ; $ member_group_dns = $ user_ldap_entry [ 'attr' ] [ $ this -> groupUserMembershipsAttr ] ; if ( isset ( $ member_group_dns [ 'count' ] ) ) { unset ( $ member_group_dns [ 'count' ] ) ; } $ ors = array ( ) ; foreach ( $ member_group_dns as $ i => $ member_group_dn ) { $ all_group_dns [ ] = $ member_group_dn ; if ( $ nested ) { if ( $ this -> groupMembershipsAttrMatchingUserAttr == 'dn' ) { $ member_value = $ member_group_dn ; } else { $ member_value = ldap_servers_get_first_rdn_value_from_dn ( $ member_group_dn , $ this -> groupMembershipsAttrMatchingUserAttr ) ; } $ ors [ ] = $ this -> groupMembershipsAttr . '=' . ldap_pear_escape_filter_value ( $ member_value ) ; } } if ( $ nested && count ( $ ors ) ) { $ count = count ( $ ors ) ; for ( $ i = 0 ; $ i < $ count ; $ i = $ i + LDAP_SERVER_LDAP_QUERY_CHUNK ) { // only 50 or so per query $ current_ors = array_slice ( $ ors , $ i , LDAP_SERVER_LDAP_QUERY_CHUNK ) ; $ or = '(|(' . join ( ")(" , $ current_ors ) . '))' ; // e.g. (|(cn=group1)(cn=group2)) or   (|(dn=cn=group1,ou=blah...)(dn=cn=group2,ou=blah...)) $ query_for_parent_groups = '(&(objectClass=' . $ this -> groupObjectClass . ')' . $ or . ')' ; foreach ( $ this -> basedn as $ base_dn ) { // need to search on all basedns one at a time // debug("query for parent groups, base_dn=$base_dn, $query_for_parent_groups"); $ group_entries = $ this -> search ( $ base_dn , $ query_for_parent_groups ) ; // no attributes, just dns needed if ( $ group_entries !== FALSE && $ level < LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT ) { $ this -> groupMembershipsFromEntryRecursive ( $ group_entries , $ all_group_dns , $ tested_group_ids , $ level + 1 , LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT ) ; } } } } return $ all_group_dns ; }
get list of all groups that a user is a member of by using memberOf attribute first,
then if nesting is true, using group entries to find parent groups

If $nested = TRUE,
list will include all parent group.  That is if user is a member of "programmer" group
and "programmer" group is a member of "it" group, user is a member of
both "programmer" and "it" groups.

If $nested = FALSE, list will only include groups user is in directly.

@param mixed
- drupal user object (stdClass Object)
- ldap entry of user (array) (with top level keys of 'dn', 'mail', 'sid' and 'attr' )
- ldap dn of user (array)
- drupal username of user (string)
@param boolean $nested if groups should be recursed or not.

@return array of group dns
get list of all groups that a user is a member of by using memberOf attribute first then if nesting is true using group entries to find parent groups