User roles are now synced with LDAP at each login

4 files changed, 62 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 35643b3b..f9d20cf5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,7 @@ New features:
 
 Improvements:
 
+* User roles are synced with LDAP at each login
 * Added support for Mysql SSL connection
 * Improve web page title on the task view
 * Unify task drop-down menu between different views
diff --git a/app/Core/User/UserProperty.php b/app/Core/User/UserProperty.php
index f8b08a3d..348bd7f3 100644
--- a/app/Core/User/UserProperty.php
+++ b/app/Core/User/UserProperty.php
@@ -44,10 +44,14 @@ class UserProperty
      */
     public static function filterProperties(array $profile, array $properties)
     {
+        $excludedProperties = array('username');
         $values = array();
 
         foreach ($properties as $property => $value) {
-            if (array_key_exists($property, $profile) && ! self::isNotEmptyValue($profile[$property])) {
+            if (self::isNotEmptyValue($value) &&
+                ! in_array($property, $excludedProperties) &&
+                array_key_exists($property, $profile) &&
+                $value !== $profile[$property]) {
                 $values[$property] = $value;
             }
         }
diff --git a/tests/units/Core/User/UserProfileTest.php b/tests/units/Core/User/UserProfileTest.php
index 4886a945..6dc627b7 100644
--- a/tests/units/Core/User/UserProfileTest.php
+++ b/tests/units/Core/User/UserProfileTest.php
@@ -58,6 +58,6 @@ class UserProfileTest extends Base
         $this->assertEquals('admin', $this->container['sessionStorage']->user['username']);
         $this->assertEquals('Bob', $this->container['sessionStorage']->user['name']);
         $this->assertEquals('', $this->container['sessionStorage']->user['email']);
-        $this->assertEquals(Role::APP_ADMIN, $this->container['sessionStorage']->user['role']);
+        $this->assertEquals(Role::APP_MANAGER, $this->container['sessionStorage']->user['role']);
     }
 }
diff --git a/tests/units/Core/User/UserPropertyTest.php b/tests/units/Core/User/UserPropertyTest.php
index 170eab4c..a2f052f4 100644
--- a/tests/units/Core/User/UserPropertyTest.php
+++ b/tests/units/Core/User/UserPropertyTest.php
@@ -31,7 +31,7 @@ class UserPropertyTest extends Base
         $this->assertEquals($expected, UserProperty::getProperties($user));
     }
 
-    public function testFilterProperties()
+    public function testFilterPropertiesDoNotOverrideExistingValue()
     {
         $profile = array(
             'id' => 123,
@@ -57,4 +57,58 @@ class UserPropertyTest extends Base
 
         $this->assertEquals($expected, UserProperty::filterProperties($profile, $properties));
     }
+
+    public function testFilterPropertiesOverrideExistingValueWhenNecessary()
+    {
+        $profile = array(
+            'id' => 123,
+            'username' => 'bob',
+            'name' => null,
+            'email' => '',
+            'other_column' => 'myvalue',
+            'role' => Role::APP_USER,
+        );
+
+        $properties = array(
+            'external_id' => '456',
+            'username' => 'bobby',
+            'name' => 'Bobby',
+            'email' => 'admin@localhost',
+            'role' => Role::APP_MANAGER,
+        );
+
+        $expected = array(
+            'name' => 'Bobby',
+            'email' => 'admin@localhost',
+            'role' => Role::APP_MANAGER,
+        );
+
+        $this->assertEquals($expected, UserProperty::filterProperties($profile, $properties));
+    }
+
+    public function testFilterPropertiesDoNotOverrideSameValue()
+    {
+        $profile = array(
+            'id' => 123,
+            'username' => 'bob',
+            'name' => 'Bobby',
+            'email' => 'admin@example.org',
+            'other_column' => 'myvalue',
+            'role' => Role::APP_MANAGER,
+        );
+
+        $properties = array(
+            'external_id' => '456',
+            'username' => 'bobby',
+            'name' => 'Bobby',
+            'email' => 'admin@localhost',
+            'role' => Role::APP_MANAGER,
+        );
+
+        $expected = array(
+            'email' => 'admin@localhost',
+        );
+
+        $this->assertEquals($expected, UserProperty::filterProperties($profile, $properties));
+    }
 }