/*
 *  Copyright 2017 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.plugins.core.impl.group.directory.ldap;

import java.text.Normalizer;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Comparator;
import java.util.HashMap;
import java.util.HashSet;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Map;
import java.util.NoSuchElementException;
import java.util.Objects;
import java.util.Set;
import java.util.TreeSet;
import java.util.function.Function;
import java.util.stream.Collectors;

import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;

import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;

import org.ametys.core.group.Group;
import org.ametys.core.group.GroupIdentity;
import org.ametys.core.group.directory.GroupDirectory;
import org.ametys.core.group.directory.GroupDirectoryModel;
import org.ametys.core.user.UserIdentity;
import org.ametys.core.user.UserManager;
import org.ametys.core.user.directory.UserDirectory;
import org.ametys.core.user.population.UserPopulationDAO;
import org.ametys.core.util.ldap.AbstractLDAPConnector;
import org.ametys.core.util.ldap.ScopeEnumerator;
import org.ametys.plugins.core.impl.user.LdapUserIdentity;
import org.ametys.plugins.core.impl.user.directory.LdapUserDirectory;
import org.ametys.runtime.i18n.I18nizableText;

/**
 * Use a LDAP server for getting the groups of users
 */
public class LdapGroupDirectory extends AbstractLDAPConnector<Object, Object> implements GroupDirectory
{
    /** Name of the parameter holding the datasource id */
    protected static final String __PARAM_DATASOURCE_ID = "runtime.groups.ldap.datasource";
    /** Name of the parameter holding the id of the associated user directory */
    protected static final String __PARAM_ASSOCIATED_USERDIRECTORY_ID = "runtime.groups.ldap.userdirectory";
    /** Relative DN for groups. */
    protected static final String __PARAM_GROUPS_RELATIVE_DN = "runtime.groups.ldap.groupDN";
    /** Filter for limiting the search. */
    protected static final String __PARAM_GROUPS_OBJECT_FILTER = "runtime.groups.ldap.filter";
    /** The scope used for search. */
    protected static final String __PARAM_GROUPS_SEARCH_SCOPE = "runtime.groups.ldap.scope";
    /** Name of the id attribute. */
    protected static final String __PARAM_GROUPS_ID_ATTRIBUTE = "runtime.groups.ldap.id";
    /** Name of the decription attribute. */
    protected static final String __PARAM_GROUPS_DESCRIPTION_ATTRIBUTE = "runtime.groups.ldap.description";
    
    /** Name of the user uid attribute. */
    protected static final String __PARAM_USERS_UID_ATTRIBUTE = "runtime.users.ldap.uidAttr";
    /** Name of the member DN attribute. */
    protected static final String __PARAM_GROUPS_MEMBER_ATTRIBUTE = "runtime.groups.ldap.member";
    /** Name of the member DN attribute. */
    protected static final String __PARAM_GROUPS_MEMBEROF_ATTRIBUTE = "runtime.groups.ldap.memberof";
    
    private static final GroupComparator __GROUP_COMPARATOR = new GroupComparator();
    
    /** The user manager */
    protected UserManager _userManager;
    /** The DAO for user populations */
    protected UserPopulationDAO _userPopulationDAO;
    
    /** The group DN relative to baseDN */
    protected String _groupsRelativeDN;
    /** The filter to find groups */
    protected String _groupsObjectFilter;
    /** The scope used for search. */
    protected int _groupsSearchScope;
    /** The group id attribute */
    protected String _groupsIdAttribute;
    /** The group description attribute */
    protected String _groupsDescriptionAttribute;
    /** The LDAP search page size. */
    protected int _pageSize;
    
    /** The attribute which contains the member DN */
    protected String _groupsMemberAttribute;
    /** The id of the associated user directory where the LDAP group will retrieve the users */
    protected String _associatedUserDirectoryId;
    /** The id of the associated user population where the LDAP group will retrieve the users */
    protected String _associatedPopulationId;
    /** The user id in 'memberUid' attribute (on groups for retrieving the users of a group). */
    protected String _userUidAttribute;
    
    /** The attribute which contains the groups of a user */
    protected String _usersMemberOfAttribute;
    
    /** The id */
    protected String _id;
    /** The label */
    protected I18nizableText _label;
    /** The id of the {@link GroupDirectoryModel} */
    private String _groupDirectoryModelId;
    /** The map of the values of the parameters */
    private Map<String, Object> _paramValues;
    
    @Override
    public String getId()
    {
        return _id;
    }

    @Override
    public I18nizableText getLabel()
    {
        return _label;
    }

    @Override
    public void setId(String id)
    {
        _id = id;
    }

    @Override
    public void setLabel(I18nizableText label)
    {
        _label = label;
    }

    @Override
    public String getGroupDirectoryModelId()
    {
        return _groupDirectoryModelId;
    }

    @Override
    public Map<String, Object> getParameterValues()
    {
        return _paramValues;
    }
    
    @Override
    public void service(ServiceManager serviceManager) throws ServiceException
    {
        super.service(serviceManager);
        _userManager = (UserManager) serviceManager.lookup(UserManager.ROLE);
        _userPopulationDAO = (UserPopulationDAO) serviceManager.lookup(UserPopulationDAO.ROLE);
    }

    @Override
    public void init(String groupDirectoryModelId, Map<String, Object> paramValues) throws Exception
    {
        _groupDirectoryModelId = groupDirectoryModelId;
        _paramValues = paramValues;
        
        String populationAndUserDirectory = (String) paramValues.get(__PARAM_ASSOCIATED_USERDIRECTORY_ID);
        String[] split = populationAndUserDirectory.split("#");
        _associatedPopulationId = split[0];
        _associatedUserDirectoryId = split[1];
        
        // FIXME https://issues.ametys.org/browse/RUNTIME-2392 (avoid this check to prevent circular dependency)
//        UserDirectory associatedUserDirectory = _userPopulationDAO.getUserPopulation(_associatedPopulationId).getUserDirectory(_associatedUserDirectoryId);
//        if (!(associatedUserDirectory instanceof LdapUserDirectory))
//        {
//            throw new IllegalArgumentException("The parameter '" + __PARAM_ASSOCIATED_USERDIRECTORY_ID + "' must reference a LDAP user directory");
//        }
        
        _groupsRelativeDN = (String) paramValues.get(__PARAM_GROUPS_RELATIVE_DN);
        _groupsObjectFilter = (String) paramValues.get(__PARAM_GROUPS_OBJECT_FILTER);
        _groupsSearchScope = ScopeEnumerator.parseScope((String) paramValues.get(__PARAM_GROUPS_SEARCH_SCOPE));
        _groupsIdAttribute = (String) paramValues.get(__PARAM_GROUPS_ID_ATTRIBUTE);
        _groupsDescriptionAttribute = (String) paramValues.get(__PARAM_GROUPS_DESCRIPTION_ATTRIBUTE);
        
        _userUidAttribute = (String) paramValues.get(__PARAM_USERS_UID_ATTRIBUTE);
        
        _groupsMemberAttribute = (String) paramValues.get(__PARAM_GROUPS_MEMBER_ATTRIBUTE);
        
        _usersMemberOfAttribute = (String) paramValues.get(__PARAM_GROUPS_MEMBEROF_ATTRIBUTE);
        
        String dataSourceId = (String) paramValues.get(__PARAM_DATASOURCE_ID);
        try
        {
            _delayedInitialize(dataSourceId);
        }
        catch (Exception e)
        {
            getLogger().error("An error occured during the initialization of LDAPUserDirectory", e);
        }
        
        _pageSize = __DEFAULT_PAGE_SIZE;
    }
    
    @Override
    public Group getGroup(String groupID)
    {
        Group group = null;

        DirContext context = null;
        NamingEnumeration results = null;
        
        try
        {
            // Connect to ldap server
            context = new InitialDirContext(_getContextEnv());
            
            // Create search filter
            StringBuffer filter = new StringBuffer("(&");
            filter.append(_groupsObjectFilter);
            filter.append("(");
            filter.append(_groupsIdAttribute);
            filter.append("={0}))");
            
            // Run search
            results = context.search(_groupsRelativeDN, filter.toString(),
                    new Object[] {groupID}, _getSearchConstraint());
            
            // Check if a group matches
            if (results.hasMoreElements())
            {
                // Retrieve the found group
                group = _getUserGroup((SearchResult) results.nextElement());
            }
        }
        catch (IllegalArgumentException e)
        {
            getLogger().error("Error missing at least one attribute or attribute value", e);
        }
        catch (NamingException e)
        {
            getLogger().error("Error communication with ldap server", e);
        }
        finally
        {
            // Close connection resources
            _cleanup(context, results);
        }

        // Return group or null
        return group;
    }

    @Override
    public Set<Group> getGroups()
    {
        Set<Group> groups = new TreeSet<>(__GROUP_COMPARATOR);

        groups.addAll(getGroups(-1, 0, Collections.emptyMap()));

        // Return the list of users as a collection of UserGroup, possibly empty
        return groups;
    }

    @Override
    public Set<String> getUserGroups(UserIdentity userIdentity)
    {
        String populationId = userIdentity.getPopulationId();
        
        if (!populationId.equals(_associatedPopulationId))
        {
            return Collections.emptySet();
        }
        
        // Cache hit, return the results. 
        if (isCacheEnabled())
        {
            @SuppressWarnings("unchecked")
            Set<String> userGroups = (Set<String>) getObjectFromCache(userIdentity);
            if (userGroups != null)
            {
                return userGroups;
            }
        }
        
        Set<String> groups;
        
        UserDirectory associatedUserDirectory = _userPopulationDAO.getUserPopulation(_associatedPopulationId).getUserDirectory(_associatedUserDirectoryId);

        if (!(associatedUserDirectory instanceof LdapUserDirectory))
        {
            throw new IllegalArgumentException("A Ldap group directory must be associated with a Ldap user directory.");
        }
        
        LdapUserDirectory associatedLdapUserDirectory = (LdapUserDirectory) associatedUserDirectory;
        
        String usersRelativeDN = (String) associatedLdapUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_RELATIVE_DN);
        
        // If param 'runtime.groups.ldap.memberof' is present, try to read the property from the user entries
        if (StringUtils.isNotEmpty(_usersMemberOfAttribute))
        {
            groups = _getUserGroupsFromMemberofAttr(userIdentity, usersRelativeDN, associatedLdapUserDirectory);
        }
        // If param 'runtime.groups.ldap.memberof' is not present, 'runtime.groups.ldap.member' must be present, try to read the property from the group entries
        else
        {
            groups = _getUserGroupsFromMemberAttr(userIdentity, associatedLdapUserDirectory);
        }
        
        // Cache the results.
        if (isCacheEnabled())
        {
            addObjectInCache(userIdentity, groups);
        }

        // Return the groups, posssibly empty
        return groups;
    }
    
    private Set<String> _getUserGroupsFromMemberofAttr(UserIdentity userIdentity, String usersRelativeDN, LdapUserDirectory associatedUserDirectory)
    {
        Set<String> groups = new HashSet<>();
        
        String login = userIdentity.getLogin();
        DirContext context = null;
        NamingEnumeration userResults = null;
        
        try
        {
            // Connect to ldap server
            context = new InitialDirContext(_getContextEnv());
            Attributes userAttrs = null;
            
            if (userIdentity instanceof LdapUserIdentity)
            {
                // Lookup the user and get the attribute of the groups
                String dn = ((LdapUserIdentity) userIdentity).getDn();
                String relativeDn = _getRelativeDn(dn);
                
                userAttrs = context.getAttributes(relativeDn, new String[] {_usersMemberOfAttribute});
            }
            else
            {
                // Search user with given login attribute
                String userLoginAttribute = (String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_LOGIN_ATTRIBUTE);
                String usersObjectFilter = (String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_OBJECT_FILTER);
                
                // Create search filter
                StringBuffer userFilter = new StringBuffer("(&");
                userFilter.append(usersObjectFilter);
                userFilter.append("(");
                userFilter.append(userLoginAttribute);
                userFilter.append("={0}))");
    
                getLogger().debug("Searching groups of user '{}' on user itself: '{}'.", login, userFilter);
                
                // Run search
                userResults = context.search(usersRelativeDN, userFilter.toString(), new Object[] {login}, _getUserSearchConstraint(new String[] {userLoginAttribute, _usersMemberOfAttribute}));
                
                // Fill the set of groups
                if (userResults.hasMoreElements())
                {
                    // The search result should not send more than one result as it is an id
                    SearchResult userResult = (SearchResult) userResults.nextElement();
                    userAttrs = userResult.getAttributes();
                }
                userResults.close();
            }
            
            // The user may come from the good population (the associated population), but from a user diretory which is not the LDAP one
            if (userAttrs != null)
            {
                groups.addAll(_getGroupIdsOfUser(userAttrs, context));
            }
        }
        catch (NamingException e)
        {
            getLogger().error("Error communication with ldap server", e);
        }
        finally
        {
            // Close connection resources
            _cleanup(context, userResults);
        }
        
        getLogger().debug("{} groups found for user '{}' from '{}' attribute on users", groups.size(), login, _usersMemberOfAttribute);
        
        return groups;
    }
    
    private Set<String> _getUserGroupsFromMemberAttr(UserIdentity userIdentity, LdapUserDirectory userDirectory)
    {
        Set<String> groups = new HashSet<>();
        String login = userIdentity.getLogin();
        
        DirContext context = null;
        NamingEnumeration userResults = null;
        
        // Create search filter
        StringBuffer groupFilter = new StringBuffer("(&");
        groupFilter.append(_groupsObjectFilter);
        
        groupFilter.append("(|");
        
        String dn = userDirectory.getUserDN(login);
        
        // If 'runtime.groups.ldap.member' references a DN
        groupFilter.append("(");
        groupFilter.append(_groupsMemberAttribute);
        groupFilter.append("={0}");
        groupFilter.append(")");
        
        // If 'runtime.groups.ldap.member' references a UID
        groupFilter.append("(");
        groupFilter.append(_groupsMemberAttribute);
        groupFilter.append("={1})");
        
        groupFilter.append("))");
        
        getLogger().debug("Searching groups of user '{}' with base DN '{}': '{}'.", login, _groupsRelativeDN, groupFilter);
        
        // Run search
        int groupCount = 0;
        try
        {
            // Connect to ldap server
            context = new InitialDirContext(_getContextEnv());
                    
            userResults = context.search(_groupsRelativeDN, groupFilter.toString(),
                                     new Object[] {dn, login}, _getSearchConstraint());
            
            // Fill the set of groups
            while (userResults.hasMoreElements())
            {
                // Retrieve the found group
                String groupId = _getGroupId((SearchResult) userResults.nextElement());
                if (groupId != null)
                {
                    groups.add(groupId);
                    groupCount++;
                }
            }
        }
        catch (NamingException e)
        {
            getLogger().error("Error communication with ldap server", e);
        }
        finally
        {
            // Close connection resources
            _cleanup(context, userResults);
        }
        
        getLogger().debug("{} groups found for user '{}' from '{}' attribute on groups", groupCount, login, _groupsMemberAttribute);
        
        return groups;
    }
    
    /**
     * Get a group id from attributes of a ldap group entry.
     * @param groupEntry The ldap group entry to get attributes from.
     * @return The group id as a String.
     * @throws IllegalArgumentException If a needed attribute is missing.
     */
    protected String _getGroupId(SearchResult groupEntry)
    {
        // Retrieve the attributes of the entry
        Attributes attrs = groupEntry.getAttributes();
        
        try
        {
            // Retrieve the identifier of a group
            Attribute groupIDAttr = attrs.get(_groupsIdAttribute);
            if (groupIDAttr == null)
            {
                getLogger().warn("Missing group id attribute : \"{}\". Group will be ignored.", _groupsIdAttribute);
                return null;
            }
            
            return (String) groupIDAttr.get();
        }
        catch (NamingException e)
        {
            getLogger().warn("Missing at least one value for an attribute in an ldap entry.  Group will be ignored.", e);
            return null;
        }
    }
    
    /**
     * Get group ids from attributes of a ldap user entry.
     * @param userAttrs The attributes of a ldap user entry
     * @param context The context
     * @return The group ids as a Set of String.
     * @throws NamingException If a naming exception was encountered while retrieving the group DNs
     * @throws IllegalArgumentException If a needed attribute is missing.
     */
    @SuppressWarnings("unchecked")
    protected Set<String> _getGroupIdsOfUser(Attributes userAttrs, DirContext context) throws NamingException
    {
        Set<String> groups = new HashSet<>();
        
        // Retrieve the identifier of the groups
        Attribute userGroups = userAttrs.get(_usersMemberOfAttribute);
        if (userGroups != null)
        {
            NamingEnumeration<String> groupDns = null;
            try
            {
                // Retrieve the members of the group
                groupDns = (NamingEnumeration<String>) userGroups.getAll();
                while (groupDns.hasMoreElements())
                {
                    String groupDn = groupDns.nextElement();
                    try
                    {
                        String relativeGroupDn = _getRelativeDn(groupDn);
                        Attributes groupAttrs = context.getAttributes(relativeGroupDn, new String[] {_groupsIdAttribute});
                        Attribute groupIdAttr = groupAttrs.get(_groupsIdAttribute);
                        if (groupIdAttr != null)
                        {
                            groups.add((String) groupIdAttr.get());
                        }
                    }
                    catch (NamingException e)
                    {
                        getLogger().warn(String.format("Unable to get the group from the LDAP DN entry: %s", groupDn), e);
                    }
                }
            }
            finally
            {
                _cleanup(null, groupDns);
            }
        }
        
        return groups;
    }

    @Override
    public List<Group> getGroups(int count, int offset, Map parameters)
    {
        String pattern = (String) parameters.get("pattern");
        
        try
        {
            List<SearchResult> searchResults = _search(_pageSize, _groupsRelativeDN, _groupsObjectFilter, _getSearchConstraint(), count > -1 && _serverSideSorting);
            
            return searchResults.stream()
                    .map(this::_getUserGroup)
                    .filter(Objects::nonNull)
                    .filter(group -> _filterMatchingGroup(group, pattern))
                    .skip(offset)
                    .limit(count < 0 ? Integer.MAX_VALUE : count)
                    .collect(Collectors.toList());
        }
        catch (NamingException e)
        {
            getLogger().error("Error of communication with ldap server", e);
        }
        
        return Collections.emptyList();
    }
    
    private boolean _filterMatchingGroup(Group group, String pattern)
    {
        if (StringUtils.isEmpty(pattern))
        {
            return true;
        }
        Function<String, String> normalize = str -> Normalizer.normalize(str.toLowerCase(), Normalizer.Form.NFD).replaceAll("[\\p{InCombiningDiacriticalMarks}]", "").trim();
        String toMatch = normalize.apply(pattern);
        if (StringUtils.isEmpty(toMatch))
        {
            return true;
        }
        
        String groupLabel = normalize.apply(group.getLabel());
        if (groupLabel.indexOf(toMatch) != -1)
        {
            return true;
        }
        
        String groupIdentity = group.getIdentity() != null ? normalize.apply(group.getIdentity().getId()) : null;
        return groupIdentity != null && groupIdentity.indexOf(toMatch) != -1;
    }

    /**
     * Get an UserGroup from attributes of a ldap entry.
     * @param entry The ldap entry to get attributes from.
     * @return The group as an UserGroup.
     * @throws IllegalArgumentException If a needed attribute is missing.
     */
    protected Group _getUserGroup(SearchResult entry)
    {
        LdapGroup group = null;
        // Retrieve the attributes of the entry
        Attributes attrs = entry.getAttributes();
        
        try
        {
            // Retrieve the identifier of a group
            Attribute groupIDAttr = attrs.get(_groupsIdAttribute);
            if (groupIDAttr == null)
            {
                getLogger().warn("Missing group id attribute : \"" + _groupsIdAttribute + "\". Group will be ignored.");
                return null;
            }
            String groupID = (String) groupIDAttr.get();
            
            // Retrieve the description of a group
            Attribute groupDESCAttr = attrs.get(_groupsDescriptionAttribute);
            if (groupDESCAttr == null)
            {
                getLogger().warn("Missing group description attribute : \"" + _groupsDescriptionAttribute + "\". Group will be ignored.");
                return null;
            }
            String groupDesc = (String) groupDESCAttr.get();

            Attribute membersAttr = null;
            if (StringUtils.isNotEmpty(_groupsMemberAttribute))
            {
                membersAttr = attrs.get(_groupsMemberAttribute);
            }
            group = new LdapGroup(new GroupIdentity(groupID, getId()), groupDesc, this, membersAttr, getLogger());
        }
        catch (NamingException e)
        {
            getLogger().warn("Missing at least one value for an attribute in an ldap entry. Group will be ignored.", e);
            return null;
        }
        catch (IllegalArgumentException e)
        {
            getLogger().error("Error missing at least one attribute or attribute value", e);
        }
        
        return group;
    }
    
    /**
     * If the given DN is absolute, return the relative DN. Otherwise, return the given DN.
     * @param dn The absolute or relative DN
     * @return The relative DN
     */
    protected String _getRelativeDn(String dn)
    {
        String relativeDn = dn;
        String suffix = "," + _ldapBaseDN;
        if (dn.endsWith(suffix))
        {
            relativeDn = StringUtils.substring(dn, 0, -suffix.length());
        }
        
        return relativeDn;
    }
    
    /**
     * Gets a user according to its DN
     * @param ldapDn The DN of the user in the LDAP
     * @return A user
     */
    protected UserIdentity _getUserInLdapFromDn(String ldapDn)
    {
        UserDirectory associatedUserDirectory = _userPopulationDAO.getUserPopulation(_associatedPopulationId).getUserDirectory(_associatedUserDirectoryId);
        String userLoginAttribute = (String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_LOGIN_ATTRIBUTE);
        
        String relativeDn = _getRelativeDn(ldapDn);
        
        LdapContext ldapContext = null;
        try
        {
            ldapContext = new InitialLdapContext(_getContextEnv(), null);
            Attributes userAttrs = ldapContext.getAttributes(relativeDn, new String[] {userLoginAttribute});
            Attribute userLogin = userAttrs.get(userLoginAttribute);
            if (userLogin == null)
            {
                getLogger().warn("User '{}' was found in LDAP but is missing the attribute {}", relativeDn, userLoginAttribute);
                return null;
            }
            UserIdentity identity = new UserIdentity((String) userLogin.get(), _associatedPopulationId);
            if (_userManager.getUser(identity) != null)
            {
                return identity;
            }
            else
            {
                getLogger().warn("User with login '{}' was found in LDAP but is not a user of the population {}", userLogin.get(), _associatedPopulationId);
            }
        }
        catch (NamingException e)
        {
            getLogger().warn(String.format("Unable to get the user from the LDAP DN entry: %s", ldapDn), e);
        }
        finally
        {
            _cleanup(ldapContext, null);
        }
        
        return null;
    }
    
    /**
     * Gets a user according to its UID
     * @param ldapUid The UID of the user in the LDAP
     * @return A user
     */
    protected UserIdentity _getUserInLdapFromUid(String ldapUid)
    {
        UserDirectory associatedUserDirectory = _userPopulationDAO.getUserPopulation(_associatedPopulationId).getUserDirectory(_associatedUserDirectoryId);
        String userLoginAttribute = (String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_LOGIN_ATTRIBUTE);
        String usersRelativeDN = (String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_RELATIVE_DN);
        
        try
        {
            String filter = _userUidAttribute + "=" + ldapUid;
            SearchControls constraints = _getUserSearchConstraint(new String[] {userLoginAttribute});
            
            List<SearchResult> results = _search(_pageSize, usersRelativeDN, filter, constraints, false);
            if (results.size() > 0)
            {
                SearchResult searchResult = results.get(0);
                Attribute userLogin = searchResult.getAttributes().get(userLoginAttribute);
                if (userLogin == null)
                {
                    getLogger().warn("User '{}' was found in LDAP but is missing the attribute {}", searchResult, userLoginAttribute);
                    return null;
                }
                UserIdentity identity = new UserIdentity((String) userLogin.get(), _associatedPopulationId);
                if (_userManager.getUser(identity) != null)
                {
                    return identity;
                }
                else
                {
                    getLogger().warn("User with login '{}' was found in LDAP but is not a user of the population {}", userLogin.get(), _associatedPopulationId);
                }
            }
            getLogger().warn("Unable to get the user from the LDAP UID: {}", ldapUid);
            return null;
        }
        catch (NamingException | NoSuchElementException e)
        {
            getLogger().warn(String.format("Unable to get the user from the LDAP UID: %s", ldapUid), e);
            return null;
        }
    }
    
    /**
     * Gets all users of a group from the 'runtime.groups.ldap.memberof' attribute on the users
     * @param groupId The id of the group
     * @return The users of the given group, only by looking at the 'runtime.groups.ldap.memberof' attribute on the users
     */
    protected Set<UserIdentity> _getUsersFromMembersOfAttr(String groupId)
    {
        Set<UserIdentity> identities = new LinkedHashSet<>();
        if (_usersMemberOfAttribute == null)
        {
            return identities;
        }
        
        UserDirectory associatedUserDirectory = _userPopulationDAO.getUserPopulation(_associatedPopulationId).getUserDirectory(_associatedUserDirectoryId);
        String userLoginAttribute = (String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_LOGIN_ATTRIBUTE);
        String usersRelativeDN = (String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_RELATIVE_DN);
        String usersObjectFilter = (String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_OBJECT_FILTER);
        
        try
        {
            // FIXME work only if the group id attribute in Ametys is the same as the id in the LDAP ? Would be better if a GroupIdentity owned the DN of the group
            String memberOfValue = _groupsIdAttribute + "=" + groupId + "," + _groupsRelativeDN + "," + _ldapBaseDN;
            String filter = "(&" + usersObjectFilter + "(" + _usersMemberOfAttribute + "=" + memberOfValue + "))";
            
            List<SearchResult> searchResults = _search(_pageSize, usersRelativeDN, filter, _getUserSearchConstraint(new String[] {userLoginAttribute}), false);
            for (SearchResult searchResult : searchResults)
            {
                Attributes attrs = searchResult.getAttributes();
                Attribute userLogin = attrs.get(userLoginAttribute);
                if (userLogin == null)
                {
                    getLogger().warn("User '{}' was found in LDAP but is missing the attribute {}", searchResult, userLoginAttribute);
                    break;
                }
                UserIdentity identity = new UserIdentity((String) userLogin.get(), _associatedPopulationId);
                if (_userManager.getUser(identity) != null)
                {
                    identities.add(identity);
                }
                else
                {
                    getLogger().warn("User with login '{}' was found in LDAP but is not a user of the population {}", userLogin.get(), _associatedPopulationId);
                }
            }
        }
        catch (NamingException e)
        {
            getLogger().error("Error of communication with ldap server", e);
        }
        
        return identities;
    }
    
    private SearchControls _getUserSearchConstraint(String[] returningAttributes)
    {
        // Search parameters
        SearchControls constraints = new SearchControls();

        // Position the wanted attributes
        constraints.setReturningAttributes(returningAttributes);

        // Choose depth of search
        UserDirectory associatedUserDirectory = _userPopulationDAO.getUserPopulation(_associatedPopulationId).getUserDirectory(_associatedUserDirectoryId);
        int usersSearchScope = ScopeEnumerator.parseScope((String) associatedUserDirectory.getParameterValues().get(LdapUserDirectory.PARAM_USERS_SEARCH_SCOPE));
        constraints.setSearchScope(usersSearchScope);
        
        return constraints;
    }
    
    /**
     * Get constraints for a search.
     * @return The constraints as a SearchControls.
     */
    protected SearchControls _getSearchConstraint()
    {
        // Search parameters
        SearchControls constraints = new SearchControls();
        
        // Only one attribute to retrieve
        constraints.setReturningAttributes(new String [] {_groupsIdAttribute, _groupsDescriptionAttribute, _groupsMemberAttribute});
        // Choose the depth of search
        constraints.setSearchScope(_groupsSearchScope);
        return constraints;
    }
    
    /**
     * Get group as JSON object
     * @param group the group
     * @param users true to get users' group
     * @return the group as JSON object
     */
    protected Map<String, Object> _group2JSON(Group group, boolean users)
    {
        Map<String, Object> group2json = new HashMap<>();
        group2json.put("id", group.getIdentity().getId());
        group2json.put("groupDirectory", group.getIdentity().getDirectoryId());
        group2json.put("groupDirectoryLabel", group.getGroupDirectory().getLabel());
        group2json.put("label", group.getLabel());
        if (users)
        {
            group2json.put("users", group.getUsers());
        }
        return group2json;
    }
    
    /**
     * Group comparator.
     */
    private static class GroupComparator implements Comparator<Group>
    {
        /**
         * Constructor.
         */
        public GroupComparator()
        {
            // Nothing to do.
        }
        
        @Override
        public int compare(Group g1, Group g2) 
        {
            if (g1.getIdentity().getId().equals(g2.getIdentity().getId()))
            {
                return 0;
            }
            
            // Case insensitive sort
            int compareTo = g1.getLabel().toLowerCase().compareTo(g2.getLabel().toLowerCase());
            if (compareTo == 0)
            {
                return g1.getIdentity().getId().compareTo(g2.getIdentity().getId());
            }
            return compareTo;
        }
    }
    
    /**
     * Implementation of {@link Group} for Ldap group directory
     */
    private static final class LdapGroup implements Group
    {
        private boolean _userInitialized;
        private Set<UserIdentity> _users;
        private GroupIdentity _identity;
        private String _groupLabel;
        private LdapGroupDirectory _groupDirectory;
        private Attribute _membersAttr;
        private Logger _logger;
        
        LdapGroup(GroupIdentity identity, String label, LdapGroupDirectory groupDirectory, Attribute membersAttr, Logger logger)
        {
            _identity = identity;
            _groupLabel = label;
            _groupDirectory = groupDirectory;
            _membersAttr = membersAttr;
            _logger = logger;
            _userInitialized = false;
            _users = new HashSet<>();
        }
        
        @Override
        public GroupIdentity getIdentity()
        {
            return _identity;
        }

        @Override
        public String getLabel()
        {
            return _groupLabel;
        }

        @Override
        public GroupDirectory getGroupDirectory()
        {
            return _groupDirectory;
        }

        @Override
        public Set<UserIdentity> getUsers()
        {
            if (!_userInitialized)
            {
                if (_hasUsersFromCache(_identity))
                {
                    _users.addAll(_getUsersFromCache(_identity));
                }
                else
                {
                    _users.addAll(_membersAttr != null ? _getUsersFromMembersAttr()
                                                       : _groupDirectory._getUsersFromMembersOfAttr(_identity.getId()));
                    _loadUsersInCache(_identity, _users);
                }
                _userInitialized = true;
            }
            return _users;
        }
        
        @SuppressWarnings("synthetic-access")
        private boolean _hasUsersFromCache(GroupIdentity groupIdentity)
        {
            return _groupDirectory.isCacheEnabled() && _groupDirectory.getObjectFromCache(groupIdentity) != null;
        }
        
        @SuppressWarnings({"synthetic-access", "unchecked"})
        private Set<UserIdentity> _getUsersFromCache(GroupIdentity groupIdentity) // only call if _hasUsersFromCache returned true before
        {
            _logger.debug("Users found in cache for group '{}", groupIdentity);
            return (Set<UserIdentity>) _groupDirectory.getObjectFromCache(groupIdentity);
        }
        
        @SuppressWarnings("synthetic-access")
        private void _loadUsersInCache(GroupIdentity groupIdentity, Set<UserIdentity> users)
        {
            if (_groupDirectory.isCacheEnabled())
            {
                _groupDirectory.addObjectInCache(groupIdentity, users);
                _logger.debug("Users loaded in cache for group '{}", groupIdentity);
            }
        }
        
        private Set<UserIdentity> _getUsersFromMembersAttr()
        {
            Set<UserIdentity> users = new HashSet<>();
            
            // First fill an intermediate list of members as strings
            // Do not resolve yet in order to close enumeration ASAP
            NamingEnumeration members = null;
            List<String> userDNs = new ArrayList<>();
            try
            {
                // Retrieve the members of the group
                members = _membersAttr.getAll();
                while (members.hasMore())
                {
                    String userDN = (String) members.next();
                    userDNs.add(userDN);
                }
            }
            catch (NamingException e)
            {
                _logger.warn("Missing at least one value for an attribute in an ldap entry.  Group will be ignored.", e);
            }
            finally
            {
                _cleanup(null, members);
            }
            
            // Then resolve the users
            for (String userDN : userDNs)
            {
                // Retrieve the identity
                UserIdentity identity = _isDn(userDN) ? _groupDirectory._getUserInLdapFromDn(userDN)
                                                      : _groupDirectory._getUserInLdapFromUid(userDN);
                
                if (identity != null)
                {
                    // Add the curent user
                    users.add(identity);
                }
            }
            
            return users;
        }
        
        private boolean _isDn(String userDN)
        {
            // Let's say that if it contains the '=' character, it is a DN, otherwise it is a UID 
            return userDN.contains("=");
        }
        
        @SuppressWarnings("synthetic-access")
        private void _cleanup(Context context, NamingEnumeration members)
        {
            _groupDirectory._cleanup(context, members);
        }
        
        @Override
        public String toString()
        {
            StringBuffer sb = new StringBuffer("UserGroup[");
            sb.append(_identity);
            sb.append(" (");
            sb.append(_groupLabel);
            sb.append(") => ");
            if (_userInitialized)
            {
                sb.append(_users.toString());
            }
            else
            {
                sb.append("\"Users are not loaded yet\"");
            }
            sb.append("]");
            return sb.toString();
        }    
        
        @Override
        public boolean equals(Object another)
        {
            if (another == null || !(another instanceof LdapGroup))
            {
                return false;
            }
            
            LdapGroup otherGroup = (LdapGroup) another;
            
            return _identity != null && _identity.equals(otherGroup.getIdentity());
        }
        
        @Override
        public int hashCode()
        {
            return _identity.hashCode();
        }
    }
    
    @Override
    protected String[] getSortByFields()
    {
        return new String[] {_groupsDescriptionAttribute};
    }
}