Skip to content

CFM-75_LdapConnector #396

Jump to bottom
Open
wants to merge 13 commits into
base: develop
Choose a base branch
from
Open

CFM-75_LdapConnector #396

wants to merge 13 commits into from

Conversation

@Ioannis
Copy link
Contributor

@Ioannis Ioannis commented Apr 30, 2026

No description provided.

@Ioannis Ioannis marked this pull request as draft April 30, 2026 08:40
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch 4 times, most recently from 4f41c6a to 4bd6725 Compare May 5, 2026 14:07
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch 3 times, most recently from fe6a6bc to a925a18 Compare May 10, 2026 04:05
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch 3 times, most recently from c581580 to e33005c Compare June 7, 2026 04:32
@Ioannis Ioannis marked this pull request as ready for review June 7, 2026 05:54
@Ioannis Ioannis requested review from arlen, benno and satkinson June 7, 2026 05:54
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch from e33005c to 47611bf Compare June 8, 2026 07:33
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch from 47611bf to 7f23079 Compare June 23, 2026 07:14
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch from 7f23079 to 9bae148 Compare July 5, 2026 05:56
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch 3 times, most recently from 540a350 to 711b65d Compare August 17, 2026 14:47
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch 3 times, most recently from d8335bb to 4fd7a73 Compare September 3, 2026 07:26
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch from 4fd7a73 to 6faeb79 Compare September 3, 2026 13:28
benno
benno requested changes Sep 4, 2026
View reviewed changes
Copy link
Contributor

@benno benno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So far I've only reviewed plugin.json and some associated files. There's some discussion to have in Slack, once we're done with this round I'll come back and review the next section.

app/plugins/LdapConnector/config/plugin.json
}
},
"changelog": true,
"indexes": {
Copy link
Contributor

@benno benno Sep 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should also define ldap_provisioners_i3 on dn_identifier_type_id so DBAL doesn't autogenerate an index with an opaque name.

app/plugins/LdapConnector/src/Model/Table/LdapSchemasTable.php

$validator->integer('ldap_provisioner_id')->requirePresence('ldap_provisioner_id', 'create');
$this->registerStringValidation($validator, $schema, 'plugin', true);
$this->registerStringValidation($validator, $schema, 'status', true);
Copy link
Contributor

@benno benno Sep 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

status is typically validated using the defined enum:

$validator->add('status', [
  'content' => ['rule' => ['inList', SuspendableStatusEnum::getConstValues()]]
]);
$validator->notEmptyString('status');

@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch from 6faeb79 to 0aeee46 Compare September 4, 2026 10:14
benno
benno reviewed Sep 4, 2026
View reviewed changes
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch from e77896a to 9f2b3c7 Compare September 15, 2026 06:59
@Ioannis
LdapConnector/LdapProvisioner Plugin
538ec43 
Added scope_suffix.Created assembleAttributes for EduPersonSchema.

LdapConnector: add supportsPeople/supportsGroups schema capabilities and skip inapplicable schemas during provisioning

Added VoPersonSchema config

Added attr_opts configuration parameter.Added assemlbe attributes for voPersonSchema.

Add route.php

LdapPublicKeySchemasTable

OrganizationalPersonSchemasTable

code improvements

Fix LDAP provisioning type errors, resolve missing entity imports, and add schema debug logging
@Ioannis
Refactor LDAP provisioning plan, fix duplicate plugin association ali…
a9bfee0 
…ases, and update PluggableModelTrait documentation.
@Ioannis
Bind plugin relations in GroupsTable initialization
74103bd
@Ioannis
Fix voPersonPolicyAgreement attribute calculation and assignment from…
8e3a443 
… the terms and conditions object
@Ioannis
LdapConnector: Use TAndCAgreement virtual URL field for voPersonPolic…
2f60c99 
…yAgreement
@Ioannis
Fix schema deletion redirects, modal title resolution, and single sch…
18462aa 
…ema instantiation in LdapConnector

- Configure 'deleted' redirect goal and permissions on LDAP schema tables to cleanly close modal dialogs on delete.
- Restrict LDAP schema plugin instantiation to a single instance per provisioning target.
- Update LdapSchemas add UI to filter out already-configured schemas and suppress submission when all schemas are exhausted.
- Fix modal dialog title resolution in the standard index template to dynamically display parent entity descriptions instead of static placeholders.
@Ioannis
Refactor LdapConnector schema to direct table columns and MVC archite…
56eed5c 
…cture

- Refactored plugin.json:
  * Migrated database schema from dynamic attribute storage (ldap_schema_attributes) to direct column definitions across all 12 LDAP schema tables.
  * Added a status enum column (SuspendableStatusEnum) to all schema tables.
  * Defined explicit foreign key constraints to cm_types for all type-based schema attribute columns (*_type_id).
  * Aligned column types, default values, and nullable constraints to match CakePHP and LDAP attribute specifications.

- Refactored templates and models:
  * Updated all 12 schema Table classes to establish belongsTo and hasManyPlugins associations to Types for attribute type foreign keys.
  * Configured setViewContains, setEditContains, and setAutoViewVars across schema tables for eager loading and automatic dropdown population.
  * Added validationDefault rules for boolean flags, type IDs, and status across all schema models.
  * Preserved getAttributes() and updated LdapSchemasTable::localAfterSave() and createSchemaPluginRow() to initialize schema plugin records with defaults.
  * Added bidirectional status synchronization between LdapSchemas and schema plugin entities via LdapObjectClassSchemaTrait and SchemaPluginCoIdTrait.
  * Refactored all 12 schema view templates (templates/*Schemas/fields.inc) to use direct $fields configurations instead of custom attribute elements.
  * Streamlined schema edit views to a single-tab subnavigation ($subnav) displaying status followed by schema attributes.
  * Protected required attributes (cn, sn, member, gid_number, uid_number, etc.) as locked/readonly checkboxes while signing them via $hidden to satisfy CakePHP FormProtector.
  * Implemented grouped address controls for OrganizationalPersonSchemas and InetOrgPersonSchemas.
  * Updated LdapSchemas index and edit templates for direct single-tab navigation to schema plugin forms.
  * Added human-readable labels, controller titles, and field descriptions in ldap_connector.po localization catalog.
  * Added PHPDoc notes to track upcoming data provisioning updates on assemblePluginAttributes().

- Removed functionality, traits, models, and tables:
  * Removed ldap_schema_attributes table from plugin.json.
  * Deleted obsolete LdapSchemaAttributesTable model and removed all references and associations across LdapProvisionersTable and LdapSchemasTable.
  * Deleted LdapSchemaAttributesController.
  * Deleted SchemaAttributeExportTrait and removed persistSchemaAttributeExports() calls from all schema controllers to leverage standard StandardPluginController::edit().
  * Deleted obsolete custom UI elements under templates/element/schemaAttributes/ (schemaAttributes.php, attributeControls.php, attributeRow.php, groupingSelector.php).
@Ioannis
Improve schema.json file
3bc789f
@Ioannis Ioannis force-pushed the CFM-75_LdapConnector branch from 7bbe2bb to 3bc789f Compare September 16, 2026 07:04
@Ioannis
Refactor LDAP schema attribute provisioning and UI type selector options
64adf3e 
- Refactored attribute assembly for data provisioning:
  * Updated assemblePluginAttributes() across all LDAP schema table classes (EduMemberSchemasTable, EduPersonSchemasTable, GroupOfNamesSchemasTable, InetOrgPersonSchemasTable, LdapPublicKeySchemasTable, OrganizationalPersonSchemasTable, PersonSchemasTable, PosixAccountSchemasTable, PosixGroupSchemasTable, VoPersonSchemasTable, VoPosixAccountSchemasTable, and VoPosixGroupSchemasTable) to inspect enabled flags and type foreign keys directly on schema model records instead of ldap_schema_attributes.
  * Added resolveSchemaRecordForProvisioningTarget() to LdapSchemaProvisioningConfigTrait to resolve active schema configuration entities for the current provisioning target.
  * Maintained all directory attribute mapping, objectclass registration, and data formatting pipelines.

- Removed deprecated attribute model leftovers:
  * Deleted obsolete entity LdapSchemaAttribute.php.
  * Removed loadLdapSchemaAttributeConfigByAttr() and ldapSchemaAttributeEnabled() from LdapSchemaProvisioningConfigTrait.
  * Removed ldapSchemaAttributesContain() from LdapObjectClassSchemaTrait.
  * Removed obsolete TODO comments and references to ldap_schema_attributes across schema table classes.

- Improved schema UI type dropdowns and localization:
  * Updated all attribute type select dropdowns across schema view templates (EduMemberSchemas, EduPersonSchemas, InetOrgPersonSchemas, OrganizationalPersonSchemas, VoPersonSchemas) to explicitly display Disabled instead of an empty option.
  * Added disabled and option.disabled translation keys to ldap_connector.po.
  * Fixed FieldHelper::formField() in FieldHelper.php to preserve custom string values supplied in fieldOptions empty parameter.
@Ioannis
Replace getAttributes() with getDefaults() across LDAP schema tables
e2aad6e 
- Streamline schema defaults initialization:
  * Replaced bulky, legacy getAttributes() array definitions across all 12 LDAP schema table classes with a unified, lightweight getDefaults(?int $coId = null): array method.
  * Ensured required LDAP attributes (e.g. cn, sn, member, gid_number, uid_number, home_directory, ssh_public_key, vo_posix_account_*) are consistently enabled (true) during schema row creation.
  * Pre-populated standard recommended type foreign keys (e.g. eppn, official, preferred, uid) using resolveDefaultTypeId() to eliminate manual administrative setup friction while leaving unassigned attributes explicitly disabled.

- Improve architecture and remove boilerplate:
  * Added resolveDefaultTypeId(?int $coId, string $attribute, string $value): ?int to LdapObjectClassSchemaTrait for resilient type foreign key resolution during provisioning setup.
  * Updated LdapSchemasTable::localAfterSave() and createSchemaPluginRow() to resolve the CO context and populate new schema plugin records directly via getDefaults($coId).
  * Removed obsolete getSchemaPluginAttributeDefinitions() helper from LdapSchemasTable, reducing over 500 lines of redundant metadata and improving execution efficiency and code maintainability.
@Ioannis
Modularize LDAP schema attribute assembly into dedicated methods
5d8e368 
- Modularize attribute assembly across LDAP schema tables:
  * Decomposed monolithic assemblePluginAttributes() implementations into focused, single-responsibility protected methods across all active schema tables to maximize code readability, maintainability, and unit testability.
  * PersonSchemasTable: Extracted assembleCn(), assembleSn(), assembleUserPassword(), and assemblePwdAccountLockedTime(). Updated password extraction to align with v5 PasswordAuthenticator structure (type column and {SSHA} formatting).
  * OrganizationalPersonSchemasTable: Streamlined attribute assembly using data-driven mapping loops over role fields (title, ou), telephone numbers (telephoneNumber, facsimileTelephoneNumber), and address attributes (street, l, st, postalCode), delegating to shared protected extractors and removing redundant wrapper methods.
  * InetOrgPersonSchemasTable: Extracted 10 dedicated assembly methods (assembleGivenName(), assembleDisplayName(), assembleO(), assembleLabeledUri(), assembleMail(), assembleMobile(), assembleEmployeeNumber(), assembleEmployeeType(), assembleRoomNumber(), assembleUid()) and imported App\Model\Entity\Person to fix entity type resolution.
  * EduPersonSchemasTable: Extracted 8 dedicated assembly methods covering affiliations, nicknames, ORCID, entitlements, and principal name variations.
  * VoPersonSchemasTable: Extracted 12 dedicated assembly methods covering VO affiliations, author names, external IDs, tokens, certificates, policy agreements, and passwords.
  * EduMemberSchemasTable: Extracted assembleIsMemberOf() for People provisioning and assembleHasMember() for Group provisioning.
  * GroupOfNamesSchemasTable: Extracted assembleCn(), assembleDescription(), assembleMember(), assembleOwner(), and resolvePersonDn().
  * LdapPublicKeySchemasTable: Extracted assembleSshPublicKey().

- Improve architectural clarity and reduce cognitive overhead:
  * Transformed complex multi-hundred-line methods into concise orchestration pipelines that evaluate enabled schema attributes and delegate value extraction directly to dedicated routines.
  * Preserved full backward compatibility with directory provisioning semantics, modify/rename attribute clearing behaviors, and LDAP objectclass assertions.
@Ioannis
Document provisioning data structures and improve/fix schema attribut…
7ae4604 
…e extraction

- Document provisioning data structures:
  * Added comprehensive PHPDoc example return payloads to marshalProvisioningData() across core provisionable models (PeopleTable, GroupsTable, CousTable, TypesTable).
  * Added example return payloads to marshalProvisioningData() in authenticator plugins (PasswordAuthenticatorsTable, SshKeyAuthenticatorsTable).
  * Detailed serialized structures for provisionable person entities (names, identifiers, roles, contacts, dynamically injected authenticators), group memberships, COUs, and type records.

- Align schema attribute extraction with v5 models:
  * VoPersonSchemasTable: Updated assembleVoPersonAffiliation() to resolve affiliation values directly from the associated affiliation_type record (edupersonaffiliation or value) instead of the deprecated v4 $pr->affiliation property.
  * OrganizationalPersonSchemasTable: Removed reference to the non-existent language column on telephone_numbers when resolving role-scoped attribute keys.

- Refactor provisioning trait annotations:
  * ProvisionableTrait: Added : void return type and updated PHPDoc parameter type declarations on requestProvisioning().
@Ioannis
Fix review comments related to the schema description.
8315662
Sign in to join this conversation on GitHub.

Reviewers

@benno benno benno requested changes

@arlen arlen Awaiting requested review from arlen

@satkinson satkinson Awaiting requested review from satkinson

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Ioannis @benno