*** LdapAuthentication.php.bck	Wed Nov 29 12:49:38 2006
--- LdapAuthentication.php	Thu Nov 30 08:47:58 2006
***************
*** 44,50 ****
  require_once( 'AuthPlugin.php' );
  
  class LdapAuthenticationPlugin extends AuthPlugin {
! 	var $email, $lang, $realname, $nickname, $SearchType;
  	/**
  	 * Check whether there exists a user account with the given name.
  	 * The name will be normalized to MediaWiki's requirements, so
--- 44,50 ----
  require_once( 'AuthPlugin.php' );
  
  class LdapAuthenticationPlugin extends AuthPlugin {
! 	var $email, $lang, $realname, $nickname, $SearchType, $groups, $allLdapGroups;
  	/**
  	 * Check whether there exists a user account with the given name.
  	 * The name will be normalized to MediaWiki's requirements, so
***************
*** 155,161 ****
--- 155,165 ----
  		global $wgLDAPProxyAgent;
  		global $wgLDAPGroupDN;
  		global $wgLDAPRequireAuthAttribute, $wgLDAPAuthAttribute;
+ 		global $wgLDAPGrpBase;
  		
+ 		$this->groups=Array();
+ 		$this->allLdapGroups=Array();
+ 
  		if ( '' == $password ) {
  			return false;
  		}
***************
*** 183,189 ****
  				if ($info["count"] < 1) { return false; }
                          }
  			if ($wgLDAPGroupDN) {
! 				return $this->isMemberOfLdapGroup($ldapconn, $userdn, $wgLDAPGroupDN);
  			}
  			if ($wgLDAPRetrievePrefs) {
  				$entry = @ldap_read($ldapconn, $userdn, "objectclass=*");
--- 187,194 ----
  				if ($info["count"] < 1) { return false; }
                          }
  			if ($wgLDAPGroupDN) {
! 				if (! $this->isMemberOfLdapGroup($ldapconn, $userdn, $wgLDAPGroupDN))
! 					return false;
  			}
  			if ($wgLDAPRetrievePrefs) {
  				$entry = @ldap_read($ldapconn, $userdn, "objectclass=*");
***************
*** 193,198 ****
--- 198,225 ----
  				$this->nickname = $info[0]["displayname"][0];
  				$this->realname = $info[0]["cn"][0];
  			}
+ 
+ 			// get information on ldap groups and this user group memberships
+ 		        $grpRes = ldap_search($ldapconn, $wgLDAPGrpBase[$_SESSION[wsDomain]], "memberUid=".strtolower($username)."",Array("cn"));
+ 			for ($entryID=ldap_first_entry($ldapconn,$grpRes);
+ 			      $entryID!=false;
+ 		              $entryID=ldap_next_entry($ldapconn,$entryID))
+ 			      {
+ 			      $cGroup = ldap_get_values($ldapconn,$entryID,'cn');
+ 			      $cGroup=$cGroup[0];
+ 			      $this->groups[] = $cGroup;
+ 			      }
+ 
+ 			$grpRes = ldap_search($ldapconn, $wgLDAPGrpBase[$_SESSION[wsDomain]], "objectClass=posixGroup",Array("cn"));
+ 			for ($entryID=ldap_first_entry($ldapconn,$grpRes);
+ 				$entryID!=false;
+ 				$entryID=ldap_next_entry($ldapconn,$entryID))
+ 				{
+ 				$cGroup = ldap_get_values($ldapconn,$entryID,'cn');
+ 				$cGroup=$cGroup[0];
+ 				$this->allLdapGroups[] = $cGroup;
+ 				}
+ 
  			// Lets clean up.
  			@ldap_unbind();
                  } else {
***************
*** 450,458 ****
--- 477,521 ----
  		if ('' != $this->email) {
                  	$user->setEmail($this->email);
  		}
+ 		# add groups permissions
+ 		$localAvailGrps = $user->getAllGroups();
+ 		$localUserGrps = $user->getEffectiveGroups();
+ 		# note: $localUserGrps does not need to be updated with $cGroup added,
+ 		#       as $localAvailGrps contains $cGroup only once.
+ 		foreach ($localAvailGrps as $cGroup) {
+ 			# did we once add the user to the group?
+ 			if (in_array($cGroup,$localUserGrps)) { 
+ 			   if ((!$this->hasLDAPGroup($cGroup)) && ($this->isLDAPGroup($cGroup))) {
+ 			      # the ldap group overrides the local group
+ 			      # so as the user is currently not a member of the ldap group, he shall be removed from the local group
+ 			      $user->removeGroup($cGroup);
+ 			      }
+ 			} else { # no, but maybe the user has recently been added to the ldap group?
+ 				if ($this->hasLDAPGroup($cGroup)) {
+ 					# so use the addGroup function
+ 					$user->addGroup($cGroup);
+ 					# completedfor $cGroup.
+ 				}
+ 			}
+ 		}
          }
  
  	/**
+ 	 * returns true if the last authenticated user is member of this group, else false
+ 	 * will always return false if the last user did not authenticate successfully with ldap
+ 	 */
+ 	function hasLDAPGroup($group) {
+ 		return in_array($group, $this->groups);
+ 	}
+ 
+ 	/**
+ 	 * returns true if a ldap group with this name exists, else false
+ 	 * will always return false if the last user did not authenticate successfully with ldap
+ 	 */
+ 	function isLDAPGroup($group) {
+ 		return in_array($group, $this->allLdapGroups);
+ 	}
+ 	/**
  	 * Return true to prevent logins that don't authenticate here from being
  	 * checked against the local database's password fields.
  	 *
***************
*** 553,559 ****
  			}
  		}
  		//we need to do a subbase search for the entry
! 		$filter = "(member=".$userDN.")";
  		$info=ldap_get_entries($ldapconn,@ldap_search($ldapconn, $groupDN, $filter));
  		return ($info["count"]>=1);
  	}
--- 616,622 ----
  			}
  		}
  		//we need to do a subbase search for the entry
! 		$filter = "(memberUid=".$userDN.")";
  		$info=ldap_get_entries($ldapconn,@ldap_search($ldapconn, $groupDN, $filter));
  		return ($info["count"]>=1);
  	}