Proyectos de Subversion Moodle

<?php

// This file is part of Moodle - http://moodle.org/

//

// Moodle is free software: you can redistribute it and/or modify

// it under the terms of the GNU General Public License as published by

// the Free Software Foundation, either version 3 of the License, or

// (at your option) any later version.

//

// Moodle is distributed in the hope that it will be useful,

// but WITHOUT ANY WARRANTY; without even the implied warranty of

// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

// GNU General Public License for more details.

//

// You should have received a copy of the GNU General Public License

// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

/**

 * Authentication Plugin: LDAP Authentication

 * Authentication using LDAP (Lightweight Directory Access Protocol).

 *

 * @package auth_ldap

 * @author Martin Dougiamas

 * @author Iñaki Arenaza

 * @license http://www.gnu.org/copyleft/gpl.html GNU Public License

 */

defined('MOODLE_INTERNAL') || die();

// See http://support.microsoft.com/kb/305144 to interprete these values.

if (!defined('AUTH_AD_ACCOUNTDISABLE')) {

    define('AUTH_AD_ACCOUNTDISABLE', 0x0002);

}

if (!defined('AUTH_AD_NORMAL_ACCOUNT')) {

    define('AUTH_AD_NORMAL_ACCOUNT', 0x0200);

}

if (!defined('AUTH_NTLMTIMEOUT')) {  // timewindow for the NTLM SSO process, in secs...

    define('AUTH_NTLMTIMEOUT', 10);

}

// UF_DONT_EXPIRE_PASSWD value taken from MSDN directly

if (!defined('UF_DONT_EXPIRE_PASSWD')) {

    define ('UF_DONT_EXPIRE_PASSWD', 0x00010000);

}

// The Posix uid and gid of the 'nobody' account and 'nogroup' group.

if (!defined('AUTH_UID_NOBODY')) {

    define('AUTH_UID_NOBODY', -2);

}

if (!defined('AUTH_GID_NOGROUP')) {

    define('AUTH_GID_NOGROUP', -2);

}

// Regular expressions for a valid NTLM username and domain name.

if (!defined('AUTH_NTLM_VALID_USERNAME')) {

    define('AUTH_NTLM_VALID_USERNAME', '[^/\\\\\\\\\[\]:;|=,+*?<>@"]+');

}

if (!defined('AUTH_NTLM_VALID_DOMAINNAME')) {

    define('AUTH_NTLM_VALID_DOMAINNAME', '[^\\\\\\\\\/:*?"<>|]+');

}

// Default format for remote users if using NTLM SSO

if (!defined('AUTH_NTLM_DEFAULT_FORMAT')) {

    define('AUTH_NTLM_DEFAULT_FORMAT', '%domain%\\%username%');

}

if (!defined('AUTH_NTLM_FASTPATH_ATTEMPT')) {

    define('AUTH_NTLM_FASTPATH_ATTEMPT', 0);

}

if (!defined('AUTH_NTLM_FASTPATH_YESFORM')) {

    define('AUTH_NTLM_FASTPATH_YESFORM', 1);

}

if (!defined('AUTH_NTLM_FASTPATH_YESATTEMPT')) {

    define('AUTH_NTLM_FASTPATH_YESATTEMPT', 2);

}

// Allows us to retrieve a diagnostic message in case of LDAP operation error

if (!defined('LDAP_OPT_DIAGNOSTIC_MESSAGE')) {

    define('LDAP_OPT_DIAGNOSTIC_MESSAGE', 0x0032);

}

require_once($CFG->libdir.'/authlib.php');

require_once($CFG->libdir.'/ldaplib.php');

require_once($CFG->dirroot.'/user/lib.php');

require_once($CFG->dirroot.'/auth/ldap/locallib.php');

/**

 * LDAP authentication plugin.

 */

class auth_plugin_ldap extends auth_plugin_base {

    /** @var string */

    protected $roleauth;

    /** @var string */

    public $pluginconfig;

    /** @var LDAP\Connection LDAP connection. */

    protected $ldapconnection;

    /** @var int */

    protected $ldapconns = 0;

    /**

     * Init plugin config from database settings depending on the plugin auth type.

     */

    function init_plugin($authtype) {

        $this->pluginconfig = 'auth_'.$authtype;

        $this->config = get_config($this->pluginconfig);

        if (empty($this->config->ldapencoding)) {

            $this->config->ldapencoding = 'utf-8';

        }

        if (empty($this->config->user_type)) {

            $this->config->user_type = 'default';

        }

        $ldap_usertypes = ldap_supported_usertypes();

        $this->config->user_type_name = $ldap_usertypes[$this->config->user_type];

        unset($ldap_usertypes);

        $default = ldap_getdefaults();

        // Use defaults if values not given

        foreach ($default as $key => $value) {

            // watch out - 0, false are correct values too

            if (!isset($this->config->{$key}) or $this->config->{$key} == '') {

                $this->config->{$key} = $value[$this->config->user_type];

            }

        }

        // Hack prefix to objectclass

        $this->config->objectclass = ldap_normalise_objectclass($this->config->objectclass);

    }

    /**

     * Constructor with initialisation.

     */

    public function __construct() {

        $this->authtype = 'ldap';

        $this->roleauth = 'auth_ldap';

        $this->errorlogtag = '[AUTH LDAP] ';

        $this->init_plugin($this->authtype);

    }

    /**

     * Old syntax of class constructor. Deprecated in PHP7.

     *

     * @deprecated since Moodle 3.1

     */

    public function auth_plugin_ldap() {

        debugging('Use of class name as constructor is deprecated', DEBUG_DEVELOPER);

        self::__construct();

    }

    /**

     * Returns true if the username and password work and false if they are

     * wrong or don't exist.

     *

     * @param string $username The username (without system magic quotes)

     * @param string $password The password (without system magic quotes)

     *

     * @return bool Authentication success or failure.

     */

    function user_login($username, $password) {

        if (! function_exists('ldap_bind')) {

            throw new \moodle_exception('auth_ldapnotinstalled', 'auth_ldap');

            return false;

        }

        if (!$username or !$password) {    // Don't allow blank usernames or passwords

            return false;

        }

        $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);

        $extpassword = core_text::convert($password, 'utf-8', $this->config->ldapencoding);

        // Before we connect to LDAP, check if this is an AD SSO login

        // if we succeed in this block, we'll return success early.

        //

        $key = sesskey();

        if (!empty($this->config->ntlmsso_enabled) && $key === $password) {

            $sessusername = get_cache_flag($this->pluginconfig.'/ntlmsess', $key);

            // We only get the cache flag if we retrieve it before

            // it expires (AUTH_NTLMTIMEOUT seconds).

            if (empty($sessusername)) {

                return false;

            }

            if ($username === $sessusername) {

                unset($sessusername);

                // Check that the user is inside one of the configured LDAP contexts

                $validuser = false;

                $ldapconnection = $this->ldap_connect();

                // if the user is not inside the configured contexts,

                // ldap_find_userdn returns false.

                if ($this->ldap_find_userdn($ldapconnection, $extusername)) {

                    $validuser = true;

                }

                $this->ldap_close();

                // Shortcut here - SSO confirmed

                return $validuser;

            }

        } // End SSO processing

        unset($key);

        $ldapconnection = $this->ldap_connect();

        $ldap_user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);

        // If ldap_user_dn is empty, user does not exist

        if (!$ldap_user_dn) {

            $this->ldap_close();

            return false;

        }

        // Try to bind with current username and password

        $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, $extpassword);

        // If login fails and we are using MS Active Directory, retrieve the diagnostic

        // message to see if this is due to an expired password, or that the user is forced to

        // change the password on first login. If it is, only proceed if we can change

        // password from Moodle (otherwise we'll get stuck later in the login process).

        if (!$ldap_login && ($this->config->user_type == 'ad')

            && $this->can_change_password()

            && (!empty($this->config->expiration) and ($this->config->expiration == 1))) {

            // We need to get the diagnostic message right after the call to ldap_bind(),

            // before any other LDAP operation.

            ldap_get_option($ldapconnection, LDAP_OPT_DIAGNOSTIC_MESSAGE, $diagmsg);

            if ($this->ldap_ad_pwdexpired_from_diagmsg($diagmsg)) {

                // If login failed because user must change the password now or the

                // password has expired, let the user in. We'll catch this later in the

                // login process when we explicitly check for expired passwords.

                $ldap_login = true;

            }

        }

        $this->ldap_close();

        return $ldap_login;

    }

    /**

     * Reads user information from ldap and returns it in array()

     *

     * Function should return all information available. If you are saving

     * this information to moodle user-table you should honor syncronization flags

     *

     * @param string $username username

     *

     * @return mixed array with no magic quotes or false on error

     */

    function get_userinfo($username) {

        $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);

        $ldapconnection = $this->ldap_connect();

        if(!($user_dn = $this->ldap_find_userdn($ldapconnection, $extusername))) {

            $this->ldap_close();

            return false;

        }

        $search_attribs = array();

        $attrmap = $this->ldap_attributes();

        foreach ($attrmap as $key => $values) {

            if (!is_array($values)) {

                $values = array($values);

            }

            foreach ($values as $value) {

                if (!in_array($value, $search_attribs)) {

                    array_push($search_attribs, $value);

                }

            }

        }

        if (!$user_info_result = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs)) {

            $this->ldap_close();

            return false; // error!

        }

        $user_entry = ldap_get_entries_moodle($ldapconnection, $user_info_result);

        if (empty($user_entry)) {

            $this->ldap_close();

            return false; // entry not found

        }

        $result = array();

        foreach ($attrmap as $key => $values) {

            if (!is_array($values)) {

                $values = array($values);

            }

            $ldapval = NULL;

            foreach ($values as $value) {

                $entry = $user_entry[0];

                if (($value == 'dn') || ($value == 'distinguishedname')) {

                    $result[$key] = $user_dn;

                    continue;

                }

                if (!array_key_exists($value, $entry)) {

                    continue; // wrong data mapping!

                }

                if (is_array($entry[$value])) {

                    $newval = core_text::convert($entry[$value][0], $this->config->ldapencoding, 'utf-8');

                } else {

                    $newval = core_text::convert($entry[$value], $this->config->ldapencoding, 'utf-8');

                }

                if (!empty($newval)) { // favour ldap entries that are set

                    $ldapval = $newval;

                }

            }

            if (!is_null($ldapval)) {

                $result[$key] = $ldapval;

            }

        }

        $this->ldap_close();

        return $result;

    }

    /**

     * Reads user information from ldap and returns it in an object

     *

     * @param string $username username (with system magic quotes)

     * @return mixed object or false on error

     */

    function get_userinfo_asobj($username) {

        $user_array = $this->get_userinfo($username);

        if ($user_array == false) {

            return false; //error or not found

        }

        $user_array = truncate_userinfo($user_array);

        $user = new stdClass();

        foreach ($user_array as $key=>$value) {

            $user->{$key} = $value;

        }

        return $user;

    }

    /**

     * Returns all usernames from LDAP

     *

     * get_userlist returns all usernames from LDAP

     *

     * @return array

     */

    function get_userlist() {

        return $this->ldap_get_userlist("({$this->config->user_attribute}=*)");

    }

    /**

     * Checks if user exists on LDAP

     *

     * @param string $username

     */

    function user_exists($username) {

        $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);

        // Returns true if given username exists on ldap

        $users = $this->ldap_get_userlist('('.$this->config->user_attribute.'='.ldap_filter_addslashes($extusername).')');

        return count($users);

    }

    /**

     * Creates a new user on LDAP.

     * By using information in userobject

     * Use user_exists to prevent duplicate usernames

     *

     * @param mixed $userobject  Moodle userobject

     * @param mixed $plainpass   Plaintext password

     */

    function user_create($userobject, $plainpass) {

        $extusername = core_text::convert($userobject->username, 'utf-8', $this->config->ldapencoding);

        $extpassword = core_text::convert($plainpass, 'utf-8', $this->config->ldapencoding);

        switch ($this->config->passtype) {

            case 'md5':

                $extpassword = '{MD5}' . base64_encode(pack('H*', md5($extpassword)));

                break;

            case 'sha1':

                $extpassword = '{SHA}' . base64_encode(pack('H*', sha1($extpassword)));

                break;

            case 'plaintext':

            default:

                break; // plaintext

        }

        $ldapconnection = $this->ldap_connect();

        $attrmap = $this->ldap_attributes();

        $newuser = array();

        foreach ($attrmap as $key => $values) {

            if (!is_array($values)) {

                $values = array($values);

            }

            foreach ($values as $value) {

                if (!empty($userobject->$key) ) {

                    $newuser[$value] = core_text::convert($userobject->$key, 'utf-8', $this->config->ldapencoding);

                }

            }

        }

        //Following sets all mandatory and other forced attribute values

        //User should be creted as login disabled untill email confirmation is processed

        //Feel free to add your user type and send patches to paca@sci.fi to add them

        //Moodle distribution

        switch ($this->config->user_type)  {

            case 'edir':

                $newuser['objectClass']   = array('inetOrgPerson', 'organizationalPerson', 'person', 'top');

                $newuser['uniqueId']      = $extusername;

                $newuser['logindisabled'] = 'TRUE';

                $newuser['userpassword']  = $extpassword;

                $uadd = ldap_add($ldapconnection, $this->config->user_attribute.'='.ldap_addslashes($extusername).','.$this->config->create_context, $newuser);

                break;

            case 'rfc2307':

            case 'rfc2307bis':

                // posixAccount object class forces us to specify a uidNumber

                // and a gidNumber. That is quite complicated to generate from

                // Moodle without colliding with existing numbers and without

                // race conditions. As this user is supposed to be only used

                // with Moodle (otherwise the user would exist beforehand) and

                // doesn't need to login into a operating system, we assign the

                // user the uid of user 'nobody' and gid of group 'nogroup'. In

                // addition to that, we need to specify a home directory. We

                // use the root directory ('/') as the home directory, as this

                // is the only one can always be sure exists. Finally, even if

                // it's not mandatory, we specify '/bin/false' as the login

                // shell, to prevent the user from login in at the operating

                // system level (Moodle ignores this).

                $newuser['objectClass']   = array('posixAccount', 'inetOrgPerson', 'organizationalPerson', 'person', 'top');

                $newuser['cn']            = $extusername;

                $newuser['uid']           = $extusername;

                $newuser['uidNumber']     = AUTH_UID_NOBODY;

                $newuser['gidNumber']     = AUTH_GID_NOGROUP;

                $newuser['homeDirectory'] = '/';

                $newuser['loginShell']    = '/bin/false';

                // IMPORTANT:

                // We have to create the account locked, but posixAccount has

                // no attribute to achive this reliably. So we are going to

                // modify the password in a reversable way that we can later

                // revert in user_activate().

                //

                // Beware that this can be defeated by the user if we are not

                // using MD5 or SHA-1 passwords. After all, the source code of

                // Moodle is available, and the user can see the kind of

                // modification we are doing and 'undo' it by hand (but only

                // if we are using plain text passwords).

                //

                // Also bear in mind that you need to use a binding user that

                // can create accounts and has read/write privileges on the

                // 'userPassword' attribute for this to work.

                $newuser['userPassword']  = '*'.$extpassword;

                $uadd = ldap_add($ldapconnection, $this->config->user_attribute.'='.ldap_addslashes($extusername).','.$this->config->create_context, $newuser);

                break;

            case 'ad':

                // User account creation is a two step process with AD. First you

                // create the user object, then you set the password. If you try

                // to set the password while creating the user, the operation

                // fails.

                // Passwords in Active Directory must be encoded as Unicode

                // strings (UCS-2 Little Endian format) and surrounded with

                // double quotes. See http://support.microsoft.com/?kbid=269190

                if (!function_exists('mb_convert_encoding')) {

                    throw new \moodle_exception('auth_ldap_no_mbstring', 'auth_ldap');

                }

                // Check for invalid sAMAccountName characters.

                if (preg_match('#[/\\[\]:;|=,+*?<>@"]#', $extusername)) {

                    throw new \moodle_exception ('auth_ldap_ad_invalidchars', 'auth_ldap');

                }

                // First create the user account, and mark it as disabled.

                $newuser['objectClass'] = array('top', 'person', 'user', 'organizationalPerson');

                $newuser['sAMAccountName'] = $extusername;

                $newuser['userAccountControl'] = AUTH_AD_NORMAL_ACCOUNT |

                                                 AUTH_AD_ACCOUNTDISABLE;

                $userdn = 'cn='.ldap_addslashes($extusername).','.$this->config->create_context;

                if (!ldap_add($ldapconnection, $userdn, $newuser)) {

                    throw new \moodle_exception('auth_ldap_ad_create_req', 'auth_ldap');

                }

                // Now set the password

                unset($newuser);

                $newuser['unicodePwd'] = mb_convert_encoding('"' . $extpassword . '"',

                                                             'UCS-2LE', 'UTF-8');

                if(!ldap_modify($ldapconnection, $userdn, $newuser)) {

                    // Something went wrong: delete the user account and error out

                    ldap_delete ($ldapconnection, $userdn);

                    throw new \moodle_exception('auth_ldap_ad_create_req', 'auth_ldap');

                }

                $uadd = true;

                break;

            default:

               throw new \moodle_exception('auth_ldap_unsupportedusertype', 'auth_ldap', '', $this->config->user_type_name);

        }

        $this->ldap_close();

        return $uadd;

    }

    /**

     * Returns true if plugin allows resetting of password from moodle.

     *

     * @return bool

     */

    function can_reset_password() {

        return !empty($this->config->stdchangepassword);

    }

    /**

     * Returns true if plugin can be manually set.

     *

     * @return bool

     */

    function can_be_manually_set() {

        return true;

    }

    /**

     * Returns true if plugin allows signup and user creation.

     *

     * @return bool

     */

    function can_signup() {

        return (!empty($this->config->auth_user_create) and !empty($this->config->create_context));

    }

    /**

     * Sign up a new user ready for confirmation.

     * Password is passed in plaintext.

     *

     * @param object $user new user object

     * @param boolean $notify print notice with link and terminate

     * @return boolean success

     */

    function user_signup($user, $notify=true) {

        global $CFG, $DB, $PAGE, $OUTPUT;

        require_once($CFG->dirroot.'/user/profile/lib.php');

        require_once($CFG->dirroot.'/user/lib.php');

        if ($this->user_exists($user->username)) {

            throw new \moodle_exception('auth_ldap_user_exists', 'auth_ldap');

        }

        $plainslashedpassword = $user->password;

        unset($user->password);

        if (! $this->user_create($user, $plainslashedpassword)) {

            throw new \moodle_exception('auth_ldap_create_error', 'auth_ldap');

        }

        $user->id = user_create_user($user, false, false);

        user_add_password_history($user->id, $plainslashedpassword);

        // Save any custom profile field information

        profile_save_data($user);

        $userinfo = $this->get_userinfo($user->username);

        $this->update_user_record($user->username, false, false, $this->is_user_suspended((object) $userinfo));

        // This will also update the stored hash to the latest algorithm

        // if the existing hash is using an out-of-date algorithm (or the

        // legacy md5 algorithm).

        update_internal_user_password($user, $plainslashedpassword);

        $user = $DB->get_record('user', array('id'=>$user->id));

        \core\event\user_created::create_from_userid($user->id)->trigger();

        if (! send_confirmation_email($user)) {

            throw new \moodle_exception('noemail', 'auth_ldap');

        }

        if ($notify) {

            $emailconfirm = get_string('emailconfirm');

            $PAGE->set_url('/auth/ldap/auth.php');

            $PAGE->navbar->add($emailconfirm);

            $PAGE->set_title($emailconfirm);

            $PAGE->set_heading($emailconfirm);

            echo $OUTPUT->header();

            notice(get_string('emailconfirmsent', '', $user->email), "{$CFG->wwwroot}/index.php");

        } else {

            return true;

        }

    }

    /**

     * Returns true if plugin allows confirming of new users.

     *

     * @return bool

     */

    function can_confirm() {

        return $this->can_signup();

    }

    /**

     * Confirm the new user as registered.

     *

     * @param string $username

     * @param string $confirmsecret

     */

    function user_confirm($username, $confirmsecret) {

        global $DB;

        $user = get_complete_user_data('username', $username);

        if (!empty($user)) {

            if ($user->auth != $this->authtype) {

                return AUTH_CONFIRM_ERROR;

            } else if ($user->secret === $confirmsecret && $user->confirmed) {

                return AUTH_CONFIRM_ALREADY;

            } else if ($user->secret === $confirmsecret) {   // They have provided the secret key to get in

                if (!$this->user_activate($username)) {

                    return AUTH_CONFIRM_FAIL;

                }

                $user->confirmed = 1;

                user_update_user($user, false);

                return AUTH_CONFIRM_OK;

            }

        } else {

            return AUTH_CONFIRM_ERROR;

        }

    }

    /**

     * Return number of days to user password expires

     *

     * If userpassword does not expire it should return 0. If password is already expired

     * it should return negative value.

     *

     * @param mixed $username username

     * @return integer

     */

    function password_expire($username) {

        $result = 0;

        $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);

        $ldapconnection = $this->ldap_connect();

        $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);

        $search_attribs = array($this->config->expireattr);

        $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);

        if ($sr)  {

            $info = ldap_get_entries_moodle($ldapconnection, $sr);

            if (!empty ($info)) {

                $info = $info[0];

                if (isset($info[$this->config->expireattr][0])) {

                    $expiretime = $this->ldap_expirationtime2unix($info[$this->config->expireattr][0], $ldapconnection, $user_dn);

                    if ($expiretime != 0) {

                        $now = time();

                        if ($expiretime > $now) {

                            $result = ceil(($expiretime - $now) / DAYSECS);

                        } else {

                            $result = floor(($expiretime - $now) / DAYSECS);

                        }

                    }

                }

            }

        } else {

            error_log($this->errorlogtag.get_string('didtfindexpiretime', 'auth_ldap'));

        }

        return $result;

    }

    /**

     * Synchronise users from the external LDAP server to Moodle's user table.

     *

     * Calls sync_users_update_callback() with default callback if appropriate.

     *

     * @param bool $doupdates will do pull in data updates from LDAP if relevant

     * @return bool success

     */

    public function sync_users($doupdates = true) {

        return $this->sync_users_update_callback($doupdates ? [$this, 'update_users'] : null);

    }

    /**

     * Synchronise users from the external LDAP server to Moodle's user table (callback).

     *

     * Sync is now using username attribute.

     *

     * Syncing users removes or suspends users that dont exists anymore in external LDAP.

     * Creates new users and updates coursecreator status of users.

     *

     * @param callable|null $updatecallback will do pull in data updates from LDAP if relevant

     * @return bool success

     */

    public function sync_users_update_callback(?callable $updatecallback = null): bool {

        global $CFG, $DB;

        require_once($CFG->dirroot . '/user/profile/lib.php');

        print_string('connectingldap', 'auth_ldap');

        $ldapconnection = $this->ldap_connect();

        $dbman = $DB->get_manager();

    /// Define table user to be created

        $table = new xmldb_table('tmp_extuser');

        $table->add_field('id', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, XMLDB_SEQUENCE, null);

        $table->add_field('username', XMLDB_TYPE_CHAR, '100', null, XMLDB_NOTNULL, null, null);

        $table->add_field('mnethostid', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null);

        $table->add_key('primary', XMLDB_KEY_PRIMARY, array('id'));

        $table->add_index('username', XMLDB_INDEX_UNIQUE, array('mnethostid', 'username'));

        print_string('creatingtemptable', 'auth_ldap', 'tmp_extuser');

        $dbman->create_temp_table($table);

        ////

        //// get user's list from ldap to sql in a scalable fashion

        ////

        // prepare some data we'll need

        $filter = '(&('.$this->config->user_attribute.'=*)'.$this->config->objectclass.')';

        $servercontrols = array();

        $contexts = explode(';', $this->config->contexts);

        if (!empty($this->config->create_context)) {

            array_push($contexts, $this->config->create_context);

        }

        $ldappagedresults = ldap_paged_results_supported($this->config->ldap_version, $ldapconnection);

        $ldapcookie = '';

        foreach ($contexts as $context) {

            $context = trim($context);

            if (empty($context)) {

                continue;

            }

            do {

                if ($ldappagedresults) {

                    $servercontrols = array(array(

                        'oid' => LDAP_CONTROL_PAGEDRESULTS, 'value' => array(

                            'size' => $this->config->pagesize, 'cookie' => $ldapcookie)));

                }

                if ($this->config->search_sub) {

                    // Use ldap_search to find first user from subtree.

                    $ldapresult = ldap_search($ldapconnection, $context, $filter, array($this->config->user_attribute),

                        0, -1, -1, LDAP_DEREF_NEVER, $servercontrols);

                } else {

                    // Search only in this context.

                    $ldapresult = ldap_list($ldapconnection, $context, $filter, array($this->config->user_attribute),

                        0, -1, -1, LDAP_DEREF_NEVER, $servercontrols);

                }

                if (!$ldapresult) {

                    continue;

                }

                if ($ldappagedresults) {

                    // Get next server cookie to know if we'll need to continue searching.

                    $ldapcookie = '';

                    // Get next cookie from controls.

                    ldap_parse_result($ldapconnection, $ldapresult, $errcode, $matcheddn,

                        $errmsg, $referrals, $controls);

                    if (isset($controls[LDAP_CONTROL_PAGEDRESULTS]['value']['cookie'])) {

                        $ldapcookie = $controls[LDAP_CONTROL_PAGEDRESULTS]['value']['cookie'];

                    }

                }

                if ($entry = @ldap_first_entry($ldapconnection, $ldapresult)) {

                    do {

                        $value = ldap_get_values_len($ldapconnection, $entry, $this->config->user_attribute);

                        $value = core_text::convert($value[0], $this->config->ldapencoding, 'utf-8');

                        $value = trim($value);

                        $this->ldap_bulk_insert($value);

                    } while ($entry = ldap_next_entry($ldapconnection, $entry));

                }

                unset($ldapresult); // Free mem.

            } while ($ldappagedresults && $ldapcookie !== null && $ldapcookie != '');

        }

        // If LDAP paged results were used, the current connection must be completely

        // closed and a new one created, to work without paged results from here on.

        if ($ldappagedresults) {

            $this->ldap_close(true);

            $ldapconnection = $this->ldap_connect();

        }

        /// preserve our user database

        /// if the temp table is empty, it probably means that something went wrong, exit

        /// so as to avoid mass deletion of users; which is hard to undo

        $count = $DB->count_records_sql('SELECT COUNT(username) AS count, 1 FROM {tmp_extuser}');

        if ($count < 1) {

            print_string('didntgetusersfromldap', 'auth_ldap');

            $dbman->drop_table($table);

            $this->ldap_close();

            return false;

        } else {

            print_string('gotcountrecordsfromldap', 'auth_ldap', $count);

        }

/// User removal

        // Find users in DB that aren't in ldap -- to be removed!

        // this is still not as scalable (but how often do we mass delete?)

        if ($this->config->removeuser == AUTH_REMOVEUSER_FULLDELETE) {

            $sql = "SELECT u.*

                      FROM {user} u

                 LEFT JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)

                     WHERE u.auth = :auth

                           AND u.deleted = 0

                           AND e.username IS NULL";

            $remove_users = $DB->get_records_sql($sql, array('auth'=>$this->authtype));

            if (!empty($remove_users)) {

                print_string('userentriestoremove', 'auth_ldap', count($remove_users));

                foreach ($remove_users as $user) {

                    if (delete_user($user)) {

                        echo "\t"; print_string('auth_dbdeleteuser', 'auth_db', array('name'=>$user->username, 'id'=>$user->id)); echo "\n";

                    } else {

                        echo "\t"; print_string('auth_dbdeleteusererror', 'auth_db', $user->username); echo "\n";

                    }

                }

            } else {

                print_string('nouserentriestoremove', 'auth_ldap');

            }

            unset($remove_users); // Free mem!

        } else if ($this->config->removeuser == AUTH_REMOVEUSER_SUSPEND) {

            $sql = "SELECT u.*

                      FROM {user} u

                 LEFT JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)

                     WHERE u.auth = :auth

                           AND u.deleted = 0

                           AND u.suspended = 0

                           AND e.username IS NULL";

            $remove_users = $DB->get_records_sql($sql, array('auth'=>$this->authtype));

            if (!empty($remove_users)) {

                print_string('userentriestoremove', 'auth_ldap', count($remove_users));

                foreach ($remove_users as $user) {

                    $updateuser = new stdClass();

                    $updateuser->id = $user->id;

                    $updateuser->suspended = 1;

                    user_update_user($updateuser, false);

                    echo "\t"; print_string('auth_dbsuspenduser', 'auth_db', array('name'=>$user->username, 'id'=>$user->id)); echo "\n";

                    \core\session\manager::destroy_user_sessions($user->id);

                }

            } else {

                print_string('nouserentriestoremove', 'auth_ldap');

            }

            unset($remove_users); // Free mem!

        }

/// Revive suspended users

        if (!empty($this->config->removeuser) and $this->config->removeuser == AUTH_REMOVEUSER_SUSPEND) {

            $sql = "SELECT u.id, u.username

                      FROM {user} u

                      JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)

                     WHERE (u.auth = 'nologin' OR (u.auth = ? AND u.suspended = 1)) AND u.deleted = 0";

            // Note: 'nologin' is there for backwards compatibility.

            $revive_users = $DB->get_records_sql($sql, array($this->authtype));

            if (!empty($revive_users)) {

                print_string('userentriestorevive', 'auth_ldap', count($revive_users));

                foreach ($revive_users as $user) {

                    $updateuser = new stdClass();

                    $updateuser->id = $user->id;

                    $updateuser->auth = $this->authtype;

                    $updateuser->suspended = 0;

                    user_update_user($updateuser, false);

                    echo "\t"; print_string('auth_dbreviveduser', 'auth_db', array('name'=>$user->username, 'id'=>$user->id)); echo "\n";

                }

            } else {

                print_string('nouserentriestorevive', 'auth_ldap');

            }

            unset($revive_users);

        }

/// User Updates - time-consuming (optional)

        if ($updatecallback && $updatekeys = $this->get_profile_keys()) { // Run updates only if relevant.

            $users = $DB->get_records_sql('SELECT u.username, u.id

                                             FROM {user} u

                                            WHERE u.deleted = 0 AND u.auth = ? AND u.mnethostid = ?',

                                          array($this->authtype, $CFG->mnet_localhost_id));

            if (!empty($users)) {

                // Update users in chunks as specified in sync_updateuserchunk.

                if (!empty($this->config->sync_updateuserchunk)) {

                    foreach (array_chunk($users, $this->config->sync_updateuserchunk) as $chunk) {

                        call_user_func($updatecallback, $chunk, $updatekeys);

                    }

                } else {

                    call_user_func($updatecallback, $users, $updatekeys);

                }

                unset($users); // Free mem.

            }

        } else {

            print_string('noupdatestobedone', 'auth_ldap');

        }

/// User Additions

        // Find users missing in DB that are in LDAP

        // and gives me a nifty object I don't want.

        // note: we do not care about deleted accounts anymore, this feature was replaced by suspending to nologin auth plugin

        $sql = 'SELECT e.id, e.username

                  FROM {tmp_extuser} e

                  LEFT JOIN {user} u ON (e.username = u.username AND e.mnethostid = u.mnethostid)

                 WHERE u.id IS NULL';

        $add_users = $DB->get_records_sql($sql);

        if (!empty($add_users)) {

            print_string('userentriestoadd', 'auth_ldap', count($add_users));

            $errors = 0;

            foreach ($add_users as $user) {

                $transaction = $DB->start_delegated_transaction();

                $user = $this->get_userinfo_asobj($user->username);

                // Prep a few params

                $user->modified   = time();

                $user->confirmed  = 1;

                $user->auth       = $this->authtype;

                $user->mnethostid = $CFG->mnet_localhost_id;

                // get_userinfo_asobj() might have replaced $user->username with the value

                // from the LDAP server (which can be mixed-case). Make sure it's lowercase

                $user->username = trim(core_text::strtolower($user->username));

                // It isn't possible to just rely on the configured suspension attribute since

                // things like active directory use bit masks, other things using LDAP might

                // do different stuff as well.

                //

                // The cast to int is a workaround for MDL-53959.

                $user->suspended = (int)$this->is_user_suspended($user);

                if (empty($user->calendartype)) {

                    $user->calendartype = $CFG->calendartype;

                }

                // $id = user_create_user($user, false);

                try {

                    $id = user_create_user($user, false);

                } catch (Exception $e) {

                    print_string('invaliduserexception', 'auth_ldap', print_r($user, true) .  $e->getMessage());

                    $errors++;

                    $transaction->allow_commit();

                    continue;

                }

                echo "\t"; print_string('auth_dbinsertuser', 'auth_db', array('name'=>$user->username, 'id'=>$id)); echo "\n";

                $euser = $DB->get_record('user', array('id' => $id));

                if (!empty($this->config->forcechangepassword)) {

                    set_user_preference('auth_forcepasswordchange', 1, $id);

                }

                // Save custom profile fields.

                $this->update_user_record($user->username, $this->get_profile_keys(true), false);

                // Add roles if needed.

                $this->sync_roles($euser);

                $transaction->allow_commit();

            }

            // Display number of user creation errors, if any.

            if ($errors) {

                print_string('invalidusererrors', 'auth_ldap', $errors);

            }

            unset($add_users); // free mem

        } else {

            print_string('nouserstobeadded', 'auth_ldap');

        }

        $dbman->drop_table($table);

        $this->ldap_close();

        return true;

    }

    /**

     * Update users from the external LDAP server into Moodle's user table.

     *

     * Sync helper

     *

     * @param array $users chunk of users to update

     * @param array $updatekeys fields to update

     */

    public function update_users(array $users, array $updatekeys): void {

        global $DB;

        print_string('userentriestoupdate', 'auth_ldap', count($users));

        foreach ($users as $user) {

            $transaction = $DB->start_delegated_transaction();

            echo "\t";

            print_string('auth_dbupdatinguser', 'auth_db', ['name' => $user->username, 'id' => $user->id]);

            $userinfo = $this->get_userinfo($user->username);

            if (!$this->update_user_record($user->username, $updatekeys, true,

                    $this->is_user_suspended((object) $userinfo))) {

                echo ' - '.get_string('skipped');

            }

            echo "\n";

            // Update system roles, if needed.

            $this->sync_roles($user);

            $transaction->allow_commit();

        }