Added #15506: Explicitly request used LDAP attributes #15507
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Couple changes here, with atomic commits to make it easier to review.
First commit refactors the
$ldap_result_*
variables inapp/Command/Console/LdapSync.php
into an associative array ($ldap_map
). By itself, this does not add functionality (of course; it's a refactor after all) but it is "self-contained" in that it can be applied without causing errors. And since most of the changes in this commit are a simple search/replace, separating it out has the benefit of making code review easier.The second commit contains the meat of the PR. It changes the
findLdapUsers
function inapp/Models/Ldap.php
to add an$attributes
parameter, which is used in theldap_search
call later. This parameter defaults to[]
, which is the existing behaviour. Thehandle
function inapp/Command/Console/LdapSync.php
is changed to make use of this new parameter, by passing a filtered version of the$ldap_map
with the empty values taken out.Fixes #15506
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
Local testing with a LDAP server that provides an
NSACCOUNTLOCK
operational attribute on "disabled" accounts. Before this PR, the attribute was not seen by Snipe-IT as by default, only non-operational attributes are returned. The specific setup I'm working with is rather complex to replicate, and I'm not sure what makes for an easy substsitute LDAP server (or server mockup).Checklist: