public function LdapAuthorizationConsumerConfAdmin::drupalForm in Lightweight Directory Access Protocol (LDAP) 8.2

Same name and namespace in other branches

1. 7.2 ldap_authorization/LdapAuthorizationConsumerConfAdmin.class.php \LdapAuthorizationConsumerConfAdmin::drupalForm()
2. 7 ldap_authorization/LdapAuthorizationConsumerConfAdmin.class.php \LdapAuthorizationConsumerConfAdmin::drupalForm()

File

ldap_authorization/LdapAuthorizationConsumerConfAdmin.class.php, line 98

Class

LdapAuthorizationConsumerConfAdmin

LDAP Authorization Consumer Configration Admin Class

Code

public function drupalForm($server_options, $op) {
  $consumer_tokens = ldap_authorization_tokens($this->consumer);
  $form['intro'] = array(
    '#type' => 'item',
    '#markup' => t('<h1>LDAP to !consumer_name Configuration</h1>', $consumer_tokens),
  );
  $form['status'] = array(
    '#type' => 'fieldset',
    '#title' => t('I.  Basics', $consumer_tokens),
    '#collapsible' => TRUE,
    '#collapsed' => FALSE,
  );
  $form['status']['sid'] = array(
    '#type' => 'radios',
    '#title' => t('LDAP Server used in !consumer_name configuration.', $consumer_tokens),
    '#required' => 1,
    '#default_value' => $this->sid,
    '#options' => $server_options,
  );
  $form['status']['consumer_type'] = array(
    '#type' => 'hidden',
    '#value' => $this->consumerType,
    '#required' => 1,
  );
  $form['status']['status'] = array(
    '#type' => 'checkbox',
    '#title' => t('Enable this configuration', $consumer_tokens),
    '#default_value' => $this->status,
  );
  $form['status']['only_ldap_authenticated'] = array(
    '#type' => 'checkbox',
    '#title' => t('Only apply the following LDAP to !consumer_name configuration to users authenticated via LDAP.  On uncommon reason for disabling this is when you are using Drupal authentication, but want to leverage LDAP for authorization; for this to work the Drupal username still has to map to an LDAP entry.', $consumer_tokens),
    '#default_value' => $this->onlyApplyToLdapAuthenticated,
  );
  if (method_exists($this->consumer, 'mappingExamples')) {
    $consumer_tokens['!examples'] = '<fieldset class="collapsible collapsed form-wrapper" id="authorization-mappings">
<legend><span class="fieldset-legend">' . t('Examples based on current !consumer_namePlural', $consumer_tokens) . '</span></legend>
<div class="fieldset-wrapper">' . $this->consumer
      ->mappingExamples($consumer_tokens) . '<div class="fieldset-wrapper">
</fieldset>';
  }
  else {
    $consumer_tokens['!examples'] = '';
  }
  $form['filter_and_mappings'] = array(
    '#type' => 'fieldset',
    '#title' => t('II. LDAP to !consumer_name mapping and filtering', $consumer_tokens),
    '#description' => t('
Representations of groups derived from LDAP might initially look like:
<ul>
<li><code>cn=students,ou=groups,dc=hogwarts,dc=edu</code></li>
<li><code>cn=gryffindor,ou=groups,dc=hogwarts,dc=edu</code></li>
<li><code>cn=faculty,ou=groups,dc=hogwarts,dc=edu</code></li>
<li><code>cn=probation students,ou=groups,dc=hogwarts,dc=edu</code></li>
</ul>

<p><strong>Mappings are used to convert and filter these group representations to !consumer_namePlural.</strong></p>

!consumer_mappingDirections

!examples

', $consumer_tokens),
    '#collapsible' => TRUE,
    '#collapsed' => !($this->mappings || $this->useMappingsAsFilter || $this->useFirstAttrAsGroupId),
  );
  $form['filter_and_mappings']['use_first_attr_as_groupid'] = array(
    '#type' => 'checkbox',
    '#title' => t('Convert full dn to value of first attribute before mapping.  e.g.  <code>cn=students,ou=groups,dc=hogwarts,dc=edu</code> would be converted to <code>students</code>', $consumer_tokens),
    '#default_value' => $this->useFirstAttrAsGroupId,
  );
  $form['filter_and_mappings']['mappings'] = array(
    '#type' => 'textarea',
    '#title' => t('Mapping of LDAP to !consumer_name (one per line)', $consumer_tokens),
    '#default_value' => $this
      ->mappingsToPipeList($this->mappings),
    '#cols' => 50,
    '#rows' => 5,
  );
  $form['filter_and_mappings']['use_filter'] = array(
    '#type' => 'checkbox',
    '#title' => t('Only grant !consumer_namePlural that match a filter above.', $consumer_tokens),
    '#default_value' => $this->useMappingsAsFilter,
    '#description' => t('If enabled, only above mapped !consumer_namePlural will be assigned (e.g. students and administrator).
        <strong>If not checked, !consumer_namePlural not mapped above also may be created and granted (e.g. gryffindor and probation students).  In some LDAPs this can lead to hundreds of !consumer_namePlural being created if "Create !consumer_namePlural if they do not exist" is enabled below.
        </strong>', $consumer_tokens),
  );
  $form['more'] = array(
    '#type' => 'fieldset',
    '#title' => t('Part III.  Even More Settings.'),
    '#collapsible' => TRUE,
    '#collapsed' => FALSE,
  );
  $synchronization_modes = array();
  if ($this->synchOnLogon) {
    $synchronization_modes[] = 'user_logon';
  }
  $form['more']['synchronization_modes'] = array(
    '#type' => 'checkboxes',
    '#title' => t('When should !consumer_namePlural be granted/revoked from user?', $consumer_tokens),
    '#options' => array(
      'user_logon' => t('When a user logs on.'),
    ),
    '#default_value' => $synchronization_modes,
    '#description' => '',
  );
  $synchronization_actions = array();
  if ($this->revokeLdapProvisioned) {
    $synchronization_actions[] = 'revoke_ldap_provisioned';
  }
  if ($this->createConsumers) {
    $synchronization_actions[] = 'create_consumers';
  }
  if ($this->regrantLdapProvisioned) {
    $synchronization_actions[] = 'regrant_ldap_provisioned';
  }
  $options = array(
    'revoke_ldap_provisioned' => t('Revoke !consumer_namePlural previously granted by LDAP Authorization but no longer valid.', $consumer_tokens),
    'regrant_ldap_provisioned' => t('Re grant !consumer_namePlural previously granted by LDAP Authorization but removed manually.', $consumer_tokens),
  );
  if ($this->consumer->allowConsumerObjectCreation) {
    $options['create_consumers'] = t('Create !consumer_namePlural if they do not exist.', $consumer_tokens);
  }
  $form['more']['synchronization_actions'] = array(
    '#type' => 'checkboxes',
    '#title' => t('What actions would you like performed when !consumer_namePlural are granted/revoked from user?', $consumer_tokens),
    '#options' => $options,
    '#default_value' => $synchronization_actions,
  );

  /**
   * @todo  some general options for an individual mapping (perhaps in an advance tab).
   *
   * - on synchronization allow: revoking authorizations made by this module, authorizations made outside of this module
   * - on synchronization create authorization contexts not in existance when needed (drupal roles etc)
   * - synchronize actual authorizations (not cached) when granting authorizations
   */
  switch ($op) {
    case 'add':
      $action = 'Add';
      break;
    case 'edit':
      $action = 'Save';
      break;
    case 'delete':
      $action = 'Delete';
      break;
  }
  $form['submit'] = array(
    '#type' => 'submit',
    '#value' => $action,
  );
  return $form;
}