private/desktop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ldaü
All checks were successful
Deploy / deploy-staging (push) Successful in 58s
Details
Deploy / deploy-production (push) Has been skipped
Details

Browse Source
This commit is contained in:
Lars Gebhardt-Kusche
2026-06-15 01:03:55 +02:00
parent cd5525ff2e
commit 344dbb9b79
9 changed files with 854 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
src/App/RegistrationService.php
View File

@@ -8,6 +8,8 @@ final class RegistrationService
{
private RegistrationStore $store;
private RegistrationLdifBuilder $ldifBuilder;
private RegistrationSecretBox $secretBox;
private LdapProvisioner $ldapProvisioner;
/**
* @param array<string, mixed> $config
@@ -19,6 +21,8 @@ final class RegistrationService
$storagePath = $this->resolveProjectPath((string) ($this->config['storage_path'] ?? 'data/registration-requests.json'));
$this->store = new RegistrationStore($storagePath);
$this->ldifBuilder = new RegistrationLdifBuilder($this->config);
$this->secretBox = new RegistrationSecretBox((string) ($this->config['password_crypto_key'] ?? ''));
$this->ldapProvisioner = new LdapProvisioner($this->config);
}
public function isEnabled(): bool
@@ -53,6 +57,8 @@ final class RegistrationService
$familyName = trim((string) ($input['family_name'] ?? ''));
$email = strtolower(trim((string) ($input['email'] ?? '')));
$note = trim((string) ($input['note'] ?? ''));
$password = (string) ($input['password'] ?? '');
$passwordConfirm = (string) ($input['password_confirm'] ?? '');
$displayName = trim($givenName . ' ' . $familyName);
$errors = [];
@@ -72,6 +78,18 @@ final class RegistrationService
$errors[] = 'Bitte gib eine gültige E-Mail-Adresse an.';
}
if (strlen($password) < 12) {
$errors[] = 'Das Passwort muss mindestens 12 Zeichen lang sein.';
}
if ($password !== $passwordConfirm) {
$errors[] = 'Die Passwörter stimmen nicht überein.';
}
if (!$this->secretBox->isConfigured()) {
$errors[] = 'Die Registrierungsverschlüsselung ist noch nicht konfiguriert.';
}
if ($note !== '' && mb_strlen($note) > 2000) {
$errors[] = 'Die Zusatzinfo ist zu lang.';
}
@@ -100,6 +118,7 @@ final class RegistrationService
'display_name' => $displayName,
'email' => $email,
'note' => $note,
'password_secret' => $this->secretBox->encrypt($password),
'origin' => [
'ip' => (string) ($_SERVER['REMOTE_ADDR'] ?? ''),
'user_agent' => (string) ($_SERVER['HTTP_USER_AGENT'] ?? ''),
@@ -131,7 +150,7 @@ final class RegistrationService
$gidNumber = trim((string) ($input['gid_number'] ?? ''));
$homeDirectory = trim((string) ($input['home_directory'] ?? ''));
$sambaSid = trim((string) ($input['samba_sid'] ?? ''));
$memberOfCsv = trim((string) ($input['member_of_csv'] ?? ''));
$memberOfList = trim((string) ($input['member_of_list'] ?? ''));
$adminNote = trim((string) ($input['admin_note'] ?? ''));
$errors = [];
@@ -156,7 +175,7 @@ final class RegistrationService
'gid_number' => $gidNumber,
'home_directory' => $homeDirectory,
'login_shell' => trim((string) ($input['login_shell'] ?? ($this->config['ldap']['default_login_shell'] ?? '/bin/sh'))),
'member_of_csv' => $memberOfCsv,
'member_of_list' => $memberOfList,
'samba_sid' => $sambaSid,
'apple_generateduid' => trim((string) ($input['apple_generateduid'] ?? '')),
'display_name' => trim((string) ($input['display_name'] ?? (string) ($request['display_name'] ?? ''))),
@@ -190,16 +209,50 @@ final class RegistrationService
$ldif = $this->ldifBuilder->build($request, $provisioning);
$ldifPath = $this->writeLdifDraft((string) ($request['id'] ?? ''), (string) ($request['username'] ?? ''), $ldif);
$request = $this->store->update(
$id,
static function (array $item) use ($ldifPath): array {
$item['updated_at'] = gmdate('c');
$item['provisioning']['ldif_path'] = $ldifPath;
$item['provisioning']['status'] = 'ldif_generated';
try {
$passwordSecret = (string) ($request['password_secret'] ?? '');
return $item;
if ($passwordSecret === '') {
throw new \RuntimeException('Für diese Registrierung ist kein Passwort mehr hinterlegt.');
}
);
$plainPassword = $this->secretBox->decrypt($passwordSecret);
$ldapResult = $this->ldapProvisioner->createInactiveUser($request, $provisioning, $plainPassword);
$request = $this->store->update(
$id,
static function (array $item) use ($ldifPath, $ldapResult): array {
$item['status'] = 'ldap_created_inactive';
$item['updated_at'] = gmdate('c');
$item['password_secret'] = null;
$item['provisioning']['ldif_path'] = $ldifPath;
$item['provisioning']['status'] = 'ldap_created_inactive';
$item['provisioning']['ldap_dn'] = $ldapResult['dn'];
$item['provisioning']['group_updates'] = $ldapResult['group_updates'];
return $item;
}
);
} catch (\Throwable $exception) {
$request = $this->store->update(
$id,
static function (array $item) use ($ldifPath, $exception): array {
$item['status'] = 'provisioning_failed';
$item['updated_at'] = gmdate('c');
$item['provisioning']['ldif_path'] = $ldifPath;
$item['provisioning']['status'] = 'provisioning_failed';
$item['provisioning']['error'] = $exception->getMessage();
return $item;
}
);
return [
'success' => false,
'errors' => ['LDAP-Provisionierung fehlgeschlagen: ' . $exception->getMessage()],
'request' => $request,
];
}
return [
'success' => true,