Add getStartDate and getEndDate methods

ltb-project · Dec 27, 2024 · 2fc003b · 2fc003b
1 parent 5f4ce80
commit 2fc003b
Show file tree

Hide file tree

Showing 4 changed files with 124 additions and 23 deletions.
diff --git a/src/Ltb/Directory.php b/src/Ltb/Directory.php
@@ -89,4 +89,14 @@ public function getDnAttribute() : string;
      * Is account valid? Relies on start and end validity dates
      */
     public function isAccountValid($ldap, $dn) : bool;
+
+    /*
+     * Get validity start date
+     */
+    public function getStartDate($ldap, $dn) : ?DateTime;
+
+    /*
+     * Get validity end date
+     */
+    public function getEndDate($ldap, $dn) : ?DateTime;
 }
diff --git a/src/Ltb/Directory/ActiveDirectory.php b/src/Ltb/Directory/ActiveDirectory.php
@@ -332,28 +332,48 @@ public function getDnAttribute() : string {
 
     public function isAccountValid($ldap, $dn) : bool {
 
-        # Get entry
+        $time = time();
+        $startdate = $this->getStartDate($ldap, $dn);
+        $enddate = $this->getEndDate($ldap, $dn);
+
+        if ( isset($startdate) ) {
+            if ( $time <= $startdate->getTimestamp() ) {
+                return false;
+            }
+        }
+
+        if ( isset($enddate) ) {
+            if ( $time >= $enddate->getTimestamp() ) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    public function getStartDate($ldap, $dn) : ?DateTime {
+
+        // No start date in AD
+        return null;
+    }
+
+    public function getEndDate($ldap, $dn) : ?DateTime {
+
         $search = \Ltb\PhpLDAP::ldap_read($ldap, $dn, "(objectClass=*)", array('accountExpires'));
         $errno = \Ltb\PhpLDAP::ldap_errno($ldap);
 
         if ( $errno ) {
             error_log("LDAP - Search error $errno  (".ldap_error($ldap).")");
-            return false;
+            return null;
         } else {
             $entry = \Ltb\PhpLDAP::ldap_get_entries($ldap, $search);
         }
 
-        if (!isset($entry[0]['accountexpires'])) {
-            return true;
+        if (!isset($entry[0]['accountexpires']) or ($entry[0]['accountexpires'][0] == 0) or ($entry[0]['accountexpires'][0] == 9223372036854775807)) {
+            return null;
         }
 
         $enddate = \Ltb\Date::adDate2phpDate($entry[0]['accountexpires'][0]);
-
-        if ( time() < $enddate->getTimestamp() ) {
-            return true;
-        }
-
-        return false;
+        return $enddate ? $enddate : null;
     }
-
 }
diff --git a/src/Ltb/Directory/OpenLDAP.php b/src/Ltb/Directory/OpenLDAP.php
@@ -333,33 +333,63 @@ public function getDnAttribute() : string {
 
     public function isAccountValid($ldap, $dn) : bool {
 
-        # Get entry
-        $search = \Ltb\PhpLDAP::ldap_read($ldap, $dn, "(objectClass=*)", array('pwdStartTime', 'pwdEndTime'));
+        $time = time();
+        $startdate = $this->getStartDate($ldap, $dn);
+        $enddate = $this->getEndDate($ldap, $dn);
+
+        if ( isset($startdate) ) {
+            if ( $time <= $startdate->getTimestamp() ) {
+                return false;
+            }
+        }
+
+        if ( isset($enddate) ) {
+            if ( $time >= $enddate->getTimestamp() ) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    public function getStartDate($ldap, $dn) : ?DateTime {
+
+        $startdate = null;
+        $search = \Ltb\PhpLDAP::ldap_read($ldap, $dn, "(objectClass=*)", array('pwdStartTime'));
         $errno = \Ltb\PhpLDAP::ldap_errno($ldap);
 
         if ( $errno ) {
             error_log("LDAP - Search error $errno  (".ldap_error($ldap).")");
-            return false;
+            return null;
         } else {
             $entry = \Ltb\PhpLDAP::ldap_get_entries($ldap, $search);
         }
 
-        $time = time();
-
         if ( isset($entry[0]['pwdstarttime']) ) {
             $startdate = \Ltb\Date::ldapDate2phpDate($entry[0]['pwdstarttime'][0]);
-            if ( $time <= $startdate->getTimestamp() ) {
-                return false;
-            }
+        }
+
+        return $startdate ? $startdate : null;
+    }
+
+    public function getEndDate($ldap, $dn) : ?DateTime {
+
+        $enddate = null;
+        $search = \Ltb\PhpLDAP::ldap_read($ldap, $dn, "(objectClass=*)", array('pwdEndTime'));
+        $errno = \Ltb\PhpLDAP::ldap_errno($ldap);
+
+        if ( $errno ) {
+            error_log("LDAP - Search error $errno  (".ldap_error($ldap).")");
+            return null;
+        } else {
+            $entry = \Ltb\PhpLDAP::ldap_get_entries($ldap, $search);
         }
 
         if ( isset($entry[0]['pwdendtime']) ) {
             $enddate = \Ltb\Date::ldapDate2phpDate($entry[0]['pwdendtime'][0]);
-            if ( $time >= $enddate->getTimestamp() ) {
-                return false;
-            }
         }
 
-        return true;
+        return $enddate ? $enddate : null;
     }
+
 }
diff --git a/tests/Ltb/DirectoryTest.php b/tests/Ltb/DirectoryTest.php
@@ -1120,4 +1120,45 @@ public function test_activedirectory_isvalid_enddate_after(): void
         $this->assertTrue($isAccountValid, "Account should be valid");
     }
 
+    public function test_activedirectory_isvalid_enddate_zero(): void
+    {
+        $phpLDAPMock = Mockery::mock('overload:Ltb\PhpLDAP');
+        $phpLDAPMock->shouldreceive([
+            'ldap_read' => null,
+            'ldap_errno' => 0,
+            'ldap_get_entries' => [
+                'count' => 1,
+                0 => [
+                    'accountexpires' => [
+                        'count' => 1,
+                        0 => 0,
+                    ]
+                ]
+            ]
+        ]);
+
+        $isAccountValid = (new Ltb\Directory\ActiveDirectory)->isAccountValid(null, null);
+        $this->assertTrue($isAccountValid, "Account should be valid");
+    }
+
+    public function test_activedirectory_isvalid_enddate_full(): void
+    {
+        $phpLDAPMock = Mockery::mock('overload:Ltb\PhpLDAP');
+        $phpLDAPMock->shouldreceive([
+            'ldap_read' => null,
+            'ldap_errno' => 0,
+            'ldap_get_entries' => [
+                'count' => 1,
+                0 => [
+                    'accountexpires' => [
+                        'count' => 1,
+                        0 => 9223372036854775807,
+                    ]
+                ]
+            ]
+        ]);
+
+        $isAccountValid = (new Ltb\Directory\ActiveDirectory)->isAccountValid(null, null);
+        $this->assertTrue($isAccountValid, "Account should be valid");
+    }
 }