<?php

class Ldap {

	private $conn = null;
	
	public function __construct($host, $port = 389) {
		$this->conn = ldap_connect($host, $port);
		if( $this->conn == null ) {
			throw new Exception("Could not connect to ldap server `$host:$port'");
		}
		ldap_set_option($this->conn, LDAP_OPT_PROTOCOL_VERSION, 3);
	}


	public function __destruct() {
		ldap_close($this->conn);
	}

	public function getConn() {
		return $this->conn;
	}

	private function bind() {
		if( !ldap_bind($this->conn, BIND_USER, BIND_PASS) ) {
			throw new Exception("ERROR: Could not bind to ldap server.");
		}
	}

	private function unbind() {
		/* Seems the ldap_unbind() function closes the connection,
		 * so we just drop the unbind process. Some security risk
		 * as the script continues bound to the already bound user,
		 * but what can one do?... */
	}
    public function testBind($username, $password) {
        $password = strtr($password, array("\'"=>"'"));
        $baseDn = USUFFIX . "," . SUFFIX;
        if ( ($isBound = @ldap_bind($this->conn, $username, $password)) === false ) {
            // @see wpLDAP comment at http://ashay.org/?page_id=133#comment-558
            $isBound = @ldap_bind($this->conn, "uid=$username, $baseDn", $password);
        }
        return $isBound;
    }

	public function search($baseDn, $filter, $attrs, $bind = false) {
		if( $bind === true ) {
			$this->bind();
		}
		$res = ldap_search($this->conn, $baseDn, $filter, $attrs);
		if(!$res) {
			return false;
		}

		$entries = ldap_get_entries($this->conn, $res);

		if( $bind === true ) {
			$this->unbind();
		}

		return $entries;
	}

	public function read($dn, $filter, $attrs, $bind = false) {
		if( $bind === true ) {
			$this->bind();
		}
		$res = ldap_read($this->conn, $dn, $filter, $attrs);
		if(!$res) {
			return false;
		}

		$entries = ldap_get_entries($this->conn, $res);

		if( $bind === true ) {
			$this->unbind();
		}

		return $entries;
	}

	private function userDn($username) {
		return "uid=". $username . "," . USUFFIX . "," . SUFFIX;
	}

	private function groupDn($groupname) {
		return "cn=". $groupname . "," . GSUFFIX . "," . SUFFIX;
	}
	
	private function homeAutomountDn($username) {
		return "cn=". $username . ",ou=auto.home," . ASUFFIX . "," . SUFFIX;
	}

	private function kerberosPrincipalDn($username) {
		return "krbPrincipalName=". $username . "@". KERBEROS_DOMAIN .",cn=". KERBEROS_DOMAIN . ","
			. KSUFFIX . "," . SUFFIX;
	}

	private function ldapAdd($dn, $record) {
		$this->bind();
		$res = ldap_add($this->conn, $dn, $record);
/*		if ( !$res ) {
			_log(ldap_error($this->conn));
		}*/
		$this->unbind();

		if( $res ) {
			debug("Added $dn");
		} else {
			debug("Could not add $dn");
		}

		return $res;
	}

	public function ldapDelete($dn) {
		$this->bind();
		$res = ldap_delete($this->conn, $dn);
		$this->unbind();

		if( $res ) {
			debug("Deleted $dn");
		} else {
			debug("Could not delete $dn");
		}
		return $res;
	}

	public function getUser($username) {

		$filter = "(&(uid=$username)(objectClass=posixAccount))";
		$attrs = array();
		
		$info = $this->search(USUFFIX .",". SUFFIX, $filter, $attrs);

		if( $info['count'] != 1 ) {
			throw new Exception("Error retreiving user " . $username . ".");
		}

		$fl = $this->flatten($info);

		if( count($fl) != 1 ) {
			throw new Exception("Unexpected size of user array.");
		}

		/* Removing objectclass... */
		unset($fl[0]['objectclass']);

		return $fl[0];

	}
	public function getUserWithMail($mail) {

		$filter = "(&(mail=$mail)(objectClass=posixAccount))";
		$attrs = array();
		
		$info = $this->search(USUFFIX .",". SUFFIX, $filter, $attrs);

		if( $info['count'] != 1 ) {
			throw new Exception("Error retreiving user " . $username . ".");
		}

		$fl = $this->flatten($info);

		if( count($fl) != 1 ) {
			throw new Exception("Unexpected size of user array.");
		}

		/* Removing objectclass... */
		unset($fl[0]['objectclass']);

		return $fl[0];

	}

	private function flatten($info) {
		$res = array();

		for($i=0;$i<$info['count'];$i++) {
			$obj_i = $info[$i];
			for($j=0;$j<$obj_i['count'];$j++) {
				if( $obj_i[$obj_i[$j]]['count'] == 1) {
					$res[$i][$obj_i[$j]] = $obj_i[$obj_i[$j]][0];
				} else {
					for($k=0;$k<$obj_i[$obj_i[$j]]['count'];$k++) {
						$res[$i][$obj_i[$j]][] = $obj_i[$obj_i[$j]][$k];
					}
				}
			}
		}
		return $res;
	}

	public function getAllUsers() {
		$filter = "(uid=*)";
		$attrs = array();
		$res = ldap_search($this->conn, USUFFIX . "," . SUFFIX, $filter, $attrs);
		if(! $res ) {
			throw new Exception("Could not search ldap directory for users.");
		}

		$users = array();

		$info = ldap_get_entries($this->conn, $res);
		for($i=0;$i<$info['count'];$i++) {
			$users[] = $info[$i];
		}
		return $users;
	}

	public function getAllUsernames() {
		$filter = "(&(uid=*))";
		$attrs = array("uid");
		$res = $this->search(USUFFIX .",". SUFFIX, $filter, $attrs);
		if(!$res) {
			throw new Exception("Could not search ldap directory for users.");
		}

		$users = array();
		for($i=0;$i<$res['count'];$i++) {
			$users[] = $res[$i]['uid'][0];
		}
		return $users;
	}

	public function getAllPrivateGroups() {
		$filter = "(&(!(cn=dns-*))(objectclass=posixGroup))";
		$attrs = array();
		$res = $this->search(GSUFFIX . "," . SUFFIX, $filter, $attrs);
		if(!$res) {
			throw new Exception("Could not search ldap directory for private groups.");
		}

		$groups = array();

		for($i=0;$i<$res['count'];$i++) {
			$group = array();
			$group['cn'] = $res[$i]['cn'][0];
			$group['description'] = $res[$i]['description'][0];
			$group['gidNumber'] = (int) $res[$i]['gidnumber'][0];
			$groups[] = $group;
		}


		return $groups;
	}

	public function getAllDnsGroups() {
		$filter = "(&(cn=dns-*)(objectclass=posixGroup))";
		$attrs = array();
		$res = $this->search(GSUFFIX . "," . SUFFIX, $filter, $attrs);
		if(!$res) {
			throw new Exception("Could not search ldap directory for dns groups.");
		}

		$groups = array();

		for($i=0;$i<$res['count'];$i++) {
			$group = array();
			$group['cn'] = $res[$i]['cn'][0];
			$group['description'] = $res[$i]['description'][0];
			$group['gidNumber'] = (int) $res[$i]['gidnumber'][0];
			$groups[] = $group;
		}

		return $groups;
	}

	public function getGroupMembers($group) {
		$filter = "(&(cn=".$group.")(objectclass=posixGroup))";
		$attrs = array("memberUid");
		$res = $this->read($this->groupDn($group), $filter, $attrs);
		
		$members = array();
		
		if( ! $res ) {
			return $members;
		}
		/* Return an empty array for the groups that do not
		* contain any members */
		if( $res[0]['count'] == 0 ) return $members;

		for($i=0;$i<$res[0]['memberuid']['count'];$i++) {
			$members[] = $res[0]['memberuid'][$i];
		}

		return $members;
	}

	public function getUserGroups($username) {
		$filter = "(&(memberUid=$username))";
		$attrs = array("cn");
		$attrsonly = 0;
		$res = ldap_search($this->conn, GSUFFIX . "," . SUFFIX,
			$filter, $attrs, $attrsonly);
		if( !$res ) {
			throw new Exception("ERROR. An error occured while searching for usergroups.");
		}
		$info = ldap_get_entries($this->conn, $res);

		$groups = array();
		for($i = 0; $i < $info['count']; $i++) {
			array_push($groups, $info[$i]['cn'][0]);
		}

		return $groups;
	}

	public function userExists($username) {
		if( empty($username) ) {
			throw new Exception("<". __FUNCTION__  ."> ERROR: username is empty or null.");
		}
		$dn = $this->userDn($username);
		$filter = "(&(uid=$username))";
		$attrs = array("dn");
		$attrsonly = 1;
		
		$res = ldap_search($this->conn, USUFFIX . "," . SUFFIX,
			$filter, $attrs, $attrsonly);

		if( !$res ) {
			throw new Exception("ERROR: An error occured while searching for user.");
		}
		
		$info = ldap_get_entries($this->conn, $res);

		return ($info['count'] == 0? false : true);
	}
	public function mailExists($mail) {
		if( empty($mail) ) {
			throw new Exception("<". __FUNCTION__  ."> ERROR: mail is empty or null.");
		}
                $dn = USUFFIX . "," . SUFFIX;
		$filter = "(mail=$mail)";
		$attrs = array("mail");
		$attrsonly = 1;
		
		$res = ldap_search($this->conn, USUFFIX . "," . SUFFIX,
			$filter, $attrs, $attrsonly);

		if( !$res ) {
			throw new Exception("ERROR: An error occured while searching for user.");
		}
		
		$info = ldap_get_entries($this->conn, $res);

		return ($info['count'] == 0? false : true);
	}

	public function groupExists($groupname) {
		if( empty($groupname) ) {
			throw new Exception("<". __FUNCTION__  ."> ERROR: groupname is empty or null.");
		}
		$filter = "(objectclass=*)";
		$attrs = array("cn");
		$res = ldap_read($this->conn, $this->groupDn($groupname), $filter, $attrs);

		if( !$res ) {
			return false;
//			throw new Exception("<". __FUNCTION__ ."> ERROR: could not read group");
		}

		$count = ldap_count_entries($this->conn, $res);

		return ($count == 1? true : false);
	}

	public function homeDirectoryMountExists($username) {
		if( empty($username) ) {
			throw new Exception("<". __FUNCTION__  ."> ERROR: username is empty or null.");
		}
		$filter = "(objectclass=*)";
		$attrs = array("cn");
		$res = ldap_read($this->conn, $this->homeAutomountDn($username), $filter, $attrs);

		if( !$res ) {
			return false;
//			throw new Exception("<". __FUNCTION__ ."> ERROR: could not read automount");
		}

		$count = ldap_count_entries($this->conn, $res);

		return ($count == 1? true : false);
	
	}
	private function ldapError() {
		return ldap_error($this->conn);
	}

	public function kerberosPrincipalExists($username) {
		if( empty($username) ) {
			throw new Exception("<". __FUNCTION__  ."> ERROR: username is empty or null.");
		}

		$filter = "(objectclass=*)";
		$attrs = array("krbprincipalname");
		$res = ldap_read($this->conn, $this->kerberosPrincipalDn($username), $filter, $attrs);

		if( !$res ) {
			return false;
		}

		$count = ldap_count_entries($this->conn, $res);

		return ($count == 1? true : false);
	
	}

	private function getNextGid() {
		$dn = GSUFFIX . "," . SUFFIX;
		$filter = "(&(cn=dns-*))";
		$attrs = array("gidNumber");
		$res = ldap_search($this->conn, $dn, $filter, $attrs);

		if( !$res ) {
			throw new Exception("ERROR: could not perform search for gid.");
		}

		$info = ldap_get_entries($this->conn, $res);

		$num = (int) GID_MIN;		

		for($i = 0; $i < $info['count']; $i++) {
			if( $num < $info[$i]['gidnumber'][0] ) {
				$num = (int) $info[$i]['gidnumber'][0];
			}
		}

		if( $num >= (int) GID_MAX ) {
			throw new Exception("ERROR: Gid number larger then GID_MAX");
		}
		
		return $num + 1;
	}

	private function getNextUserGid() {
		$dn = GSUFFIX . "," . SUFFIX;
		$filter = "(&(!(cn=dns-*))(gidNumber=*))";
		$attrs = array("gidNumber");
		$res = ldap_search($this->conn, $dn, $filter, $attrs);

		if( !$res ) {
			throw new Exception("ERROR: could not perform search for gid.");
		}

		$info = ldap_get_entries($this->conn, $res);

		$num = (int) USER_GID_MIN;
		for($i = 0; $i < $info['count']; $i++) {
			if( $num < $info[$i]['gidnumber'][0] ) {
				$num = (int) $info[$i]['gidnumber'][0];
			}
		}

		if( $num >= (int) USER_GID_MAX ) {
			throw new Exception("Error: Gid number larger then USER_GID_MAX");
		}

		return $num + 1;
	}

	private function getNextUid() {
		$dn = USUFFIX . "," . SUFFIX;
		$filter = "(&(uid=*))";
		$attrs = array("uidNumber");
		$res = ldap_search($this->conn, $dn, $filter, $attrs);
		if( !$res ) {
			throw new Exception("ERROR: could not perform search for uid.");
		}
		$info = ldap_get_entries($this->conn, $res);
		$num = (int) UID_MIN;
		for($i = 0; $i < $info['count']; $i++) {
			if( $num < $info[$i]['uidnumber'][0] ) {
				$num = (int) $info[$i]['uidnumber'][0];
			}
		}

		if( $num >= (int) UID_MAX ) {
			throw new Exception("ERROR: UID number larger then UID_MAX");
		}

		return $num + 1;
	}

	private function createUserHomeDirectory($user) {
		$username = $user['username'];
		$res = exec("sudo -u localedb /opt/edb/inside_ldap/create_user_home_directory.sh $username",
			$output, $retval);
		if( $retval != 0 ) {
			throw new Exception("Could not create users home directory: $res");
		}
		debug("Created home directory");
		return true;
	}

	private function createUserHomeDirectoryMount($username) {
		$info = array();
		
		$info['objectClass'] = array("top", "automount");

		$info['cn'] = $username;
		$info['automountInformation'] = "-fstype=nfs4,rw,sec=krb5 " . FILESERVER . ":" . FILESERVER_HOMES .
			"/" . $username;
		
		$dn = "cn=" . $username .",ou=auto.home,ou=Automount," . SUFFIX;

		return $this->ldapAdd($dn, $info);
	}

	private function deleteUserHomeDirectoryMount($username) {
		
		$dn = "cn=" . $username .",ou=auto.home,ou=Automount," . SUFFIX;

		return $this->ldapDelete($dn);
	}

	private function createUserKerberosCredentials($username, $password) {
		$str = "sudo -u localedb /opt/edb/inside_ldap/create_user_kerberos_credentials.sh $username $password";
		$res = exec($str, $output, $retval);
		if( $retval != 0 ) {
			ldap_log("ERROR creating kerberos credentials: " . implode(",", $output));
			throw new Exception("Could not create users kerberos credentials");
		}
		debug("Created users kerberos credentials");
		return true;
	}

	private function deleteUserKerberosCredentials($username) {
		$dn = "krbPrincipalName=$username@NEUF.NO,cn=NEUF.NO,cn=krbcontainer," . SUFFIX;
		return $this->ldapDelete($dn);
	}

	public function addGroup($name, $description, $gid = null) {
		$dn = $this->groupDn($name);

		$info = array();
		$info['objectClass'] = array();
		$info['objectClass'][0] = "posixGroup";
		$info['description'] = $description;
		$info['gidNumber'] = (int) ($gid == null? $this->getNextGid() : $gid);

		return $this->ldapAdd($dn, $info);
	}


	public function addUser($userinfo) {
		if( !is_array($userinfo) ) {
			throw new Exception("ERROR: Userinfo is not an array");
		}

		$info = array();
		/* Objectclass */
		$info['objectClass'] = array();
		$info['objectClass'][0] = "inetOrgPerson";
		$info['objectClass'][1] = "posixAccount";
		$info['objectClass'][2] = "shadowAccount"; 
		
		/* User dn (identifies this record in LDAP) */
		$dn = $this->userDn($userinfo['username']);
		
		/* General user info */
		$info['uid'] = $userinfo['username'];
		$info['givenname'] = $userinfo['firstname'];
		$info['sn'] = $userinfo['lastname'];
		$info['cn'] = $userinfo['firstname'] . " " . $userinfo['lastname'];
		$info['displayname'] = $userinfo['firstname'] . " " . $userinfo['lastname'];
		$info['gecos'] = $this->gecos($userinfo['username']);
		$info['mail'] = $userinfo['email'];
		
		/* System specific user info */
		$info['userpassword'] = "{SSHA}". ssha($userinfo['password']);
		$info['loginshell'] = LOGIN_SHELL;
		$info['shadowexpire'] = (int) SHADOW_EXPIRE;
		$info['shadowflag'] = (int) SHADOW_FLAG;
		$info['shadowwarning'] = (int) SHADOW_WARNING;
		$info['shadowmin'] = (int) SHADOW_MIN;
		$info['shadowmax'] = (int) SHADOW_MAX;
		$info['shadowlastchange'] = (int) SHADOW_LAST_CHANGE;
		$info['homedirectory'] = HOME_DIRECTORY_PREFIX . "/" . $userinfo['username'];
		$info['uidnumber'] = (int) $this->getNextUid();
		$info['gidnumber'] = (int) $this->getNextUserGid();

		/* Check if the user is already in the LDAP directory */
		$user = $this->userExists($userinfo['username']);
		if( $user == true ) {
			throw new Exception("User ". $userinfo['username'] . " already exists.");
		}
		
		if( $this->addGroup($userinfo['username'], "Usergroup", $info['gidnumber']) 
			=== false ) {
			throw new Exception("ERROR: ldap_add `group' failed.");
		}

		if( $this->ldapAdd($dn, $info) === false ) {
			throw new Exception("ERROR: ldap_add user: `". $info['uid']."' failed.");
		}

		if( $this->createUserHomeDirectory($userinfo) === false ) {
			throw new Exception("ERROR: could not create user home directory.");
		}

		if( $this->createUserHomeDirectoryMount($userinfo['username']) === false ) {
			throw new Exception("ERROR: could not create home directory mount in ldap");
		}

		if( $this->createUserKerberosCredentials($userinfo['username'], $userinfo['password']) === false) {
			throw new Exception("ERROR: could not create user kerberos credentials.");
		}
		return true;
	}

	public function addUserToGroup($username, $groupname) {
		$dn = $this->groupDn($groupname);
		$attr = array();
		$attr['memberUid'][] = $username;
		
		$this->bind();
		$res = ldap_mod_add($this->conn, $dn, $attr);
		$this->unbind();
		
		if( $res ) {
			debug("Added $username to $dn");
		} else {
			debug("Could not add $username to $dn");
		}

		return $res;
	}

	public function removeUserFromGroup($username, $groupname) {
		$dn = $this->groupDn($groupname);
		$attr = array();
		$attr['memberUid'][] = $username;
		
		$this->bind();
		$res = ldap_mod_del($this->conn, $dn, $attr);
		$this->unbind();
		
		if( $res ) {
			debug("Removed $username from $dn");
		} else {
			debug("Could not remove $username from $dn");
		}

		return $res;
	}

	public function deleteUser($username) {
		/* Find all groups the user is a member of */
		$usergroups = $this->getUserGroups($username);
	
		foreach($usergroups as $group) {
			$this->removeUserFromGroup($username, $group);
		}

		$this->deleteUserHomeDirectoryMount($username);
		$this->deleteUserKerberosCredentials($username);

		/* Delete the users usergroup */
		$this->ldapDelete($this->groupDn($username));

		/* Delete the user */
		$this->ldapDelete($this->userDn($username));

		return true;
	}

	public function setUserPassword($username, $password) {
		$dn = $this->userDn($username);
		$this->bind();
		$attrs = array();
		$attrs['userPassword'] = ssha($password);
		$res = ldap_mod_replace($this->conn, $dn, $attrs);

		if( $res ) {
			debug("Password set/change for $dn");
		} else {
			debug("Could not set password for $dn");
		}

		return $res;
	}

	private function gecos($string) {
		return $string;
	}

	public function printIntegrityCheckStart($name) {
//		debug("Running integrity check <" . $name . ">");
		_log_check("Running integrity check <" . $name . ">");
	}

	public function printIntegrityCheckStop($name) {
//		debug("Completed integrity check <" . $name . ">");
		_log_check("Completed integrity check <" . $name . ">");
	}

	public function runAllIntegrityChecks() {
		_log_check("------ Starting all integrity checks ------");
		$pass = true;
		$methods = get_class_methods(__CLASS__);
		foreach($methods as $method) {
			if( strpos($method, "check") === 0 ) {
				$this->printIntegrityCheckStart($method);
				try {
					if( $this->$method() === false ) {
						$pass = false;
					}
					
				} catch( Exception $e ) {
					_log_check($e->getMessage());
				}
				$this->printIntegrityCheckStop($method);
			}
		}

		if( $pass === false ) {
			mail_admins("Integrity check failed, please review log.");
		}
		
		_log_check("------ Completed all integrity checks (pass=". ($pass? "true":"false") .") ------");
	}

	public function checkUserPrimaryGroup() {
		$filter = "(&(uid=*))";
		$attrs = array("uid");
		$res = $this->search(USUFFIX .",". SUFFIX, $filter, $attrs, true);
		if(!$res) {
			return false;
		}

		$return_val = true;

		for($i=0;$i<$res['count'];$i++) {
			$user = $res[$i];
			if( $this->groupExists($user['uid'][0]) === false ) {
				_log_check_error("User `". $user['uid'][0] ."' does not have a primary group.");
				$return_val = false;
			}
		}

		return $return_val;
	}

	public function checkUserKerberosPrincipal() {
		$users = $this->getAllUsernames();
		$return_val = true;
		foreach($users as $user) {
			if( $this->kerberosPrincipalExists($user) === false ) {
				_log_check_error("User `". $user . "' does not have a kerberos principal.");
				$return_val = false;
			}
		}

		return $return_val;
	}

	public function checkUserAutomountHomeDirectory() {
		$users = $this->getAllUsernames();
		$return_val = true;
		foreach($users as $user) {
			if( $this->homeDirectoryMountExists($user) === false ) {
				_log_check_error("User `". $user . "' does not have a home directory mount record.");
				$return_val = false;
			}
		}

		return $return_val;
	}

	public function checkPrivateGroupUserExists() {
		$private_groups = $this->getAllPrivateGroups();
		$return_val = true;
		foreach($private_groups as $group) {
			/* Special groups that don't require a user */
			if( $group['cn'] == "edb" ) continue;
			if( $group['cn'] == "edbadmin" ) continue;

			if( $this->userExists($group['cn']) === false ) {
				_log_check_error("Private Group `" . $group['cn'] . "' exists but user does not.");
				$return_val = false;
			}
		}

		return $return_val;
	}

	public function checkDnsGroupMembersExists() {
		$dns_groups = $this->getAllDnsGroups();

		$return_val = true;

		foreach($dns_groups as $group) {
//			debug("Getting members for " . $group['cn']);
			$members = $this->getGroupMembers($group['cn']);
			foreach($members as $member) {
				if( !$this->userExists($member) ) {
					_log_check_error("Group `". $group['cn'] ."' contain user `". $member .
						"', but the user does not exist.");
					$return_val = false;
				}
			}
		}

		/* These two are special groups */
		foreach(array("edb", "edbadmin") as $group) {
			$members = $this->getGroupMembers($group);
			foreach($members as $member) {
				if( !$this->userExists($member) ) {
					_log_check_error("Group `". $group ."' contain user `". $member .
						"', but the user does not exist.");
					$return_val = false;
				}
			}
		}

		return $return_val;
	}

	public function checkKerberosPrincipalUserExists() {
		_log_check_error("Not implemented");
		return false;
	}

	public function checkAutomountHomeDirectoryUserExists() {
		_log_check_error("Not implemented");
		return false;
	}

}