Ldap Bundle Laravel Package

Getting Started

Minimal Setup

1. Installation

   composer require cdesign/ldap-bundle
   

   Add the bundle to config/bundles.php:

   return [
       // ...
       Cdesign\LdapBundle\CdesignLdapBundle::class => ['all' => true],
   ];
   

2. Configuration Define LDAP settings in config/packages/design_ldap.yaml:

   cdesign_ldap:
       host: 'ldap://your-ldap-server'
       port: 389
       base_dn: 'dc=example,dc=com'
       username: 'cn=admin,dc=example,dc=com'
       password: 'admin_password'
       use_ssl: false
       use_start_tls: false
   

3. First Use Case: Authentication Extend Symfony’s security system to use LDAP:

   # config/packages/security.yaml
   security:
       providers:
           ldap_provider:
               id: cdesign_ldap.user_provider
       firewalls:
           main:
               provider: ldap_provider
               form_login:
                   login_path: login
                   check_path: login_check
   

Implementation Patterns

User Provider Integration

• Fetch Users: Use the built-in UserProvider to validate credentials:

  $user = $this->get('ldap.user_provider')->loadUserByUsername('ldap_username');
  $authenticator = $this->get('ldap.authenticator');
  $authenticator->authenticate($user, 'password');
  

• Custom User Mapping Override Cdesign\LdapBundle\Security\User\LdapUserProvider to map LDAP attributes to Symfony’s UserInterface:

  class CustomLdapUserProvider extends LdapUserProvider
  {
      public function loadUserByUsername($username)
      {
          $user = parent::loadUserByUsername($username);
          $user->setEmail($this->getLdapAttribute($user, 'mail')); // Custom mapping
          return $user;
      }
  }
  

  Register the provider in services.yaml:

  services:
      App\Security\CustomLdapUserProvider:
          tags: ['security.user_provider']
  

Workflows

1. LDAP Sync Periodically sync local users with LDAP (e.g., via a cron job):

   $syncService = $this->get('ldap.sync_service');
   $syncService->syncUsers(); // Customize logic in service
   

2. Group-Based Access Control Fetch user groups from LDAP and assign roles:

   $groups = $this->get('ldap.user_provider')->getGroups($user);
   $roles = array_map(fn($group) => 'ROLE_'.strtoupper($group), $groups);
   $user->setRoles($roles);
   

Integration Tips

• Symfony Forms: Bind LDAP user data to forms using LdapUser properties.
• Doctrine: Extend LdapUser to persist additional fields in a custom user entity.
• Event Listeners: Listen to ldap.login.success or ldap.login.failure events for post-auth logic.

Gotchas and Tips

Pitfalls

1. Connection Issues

   • Debugging: Enable debug mode and check Symfony’s profiler for LDAP connection errors.
   • SSL/TLS: Ensure use_ssl or use_start_tls is correctly configured for secure connections.
   • Firewall: Verify LDAP ports (389/636) are open and accessible from your server.

2. Attribute Mapping

   • Missing Attributes: LDAP directories vary; test with ldap_search() to confirm attribute names (e.g., uid, mail, memberOf).
   • Case Sensitivity: LDAP usernames may be case-insensitive; normalize inputs:

     $username = strtolower($username);
     

3. Performance

   • Caching: Cache LDAP queries for read-heavy operations:

     cdesign_ldap:
         cache:
             enabled: true
             provider: 'app.cache.app'
     

   • Pagination: For large directories, implement pagination in custom queries.

Debugging

• Log LDAP Queries: Enable verbose logging in config/packages/design_ldap.yaml:

  cdesign_ldap:
      debug: true
  

• Test Locally: Use a tool like LDAP Admin to verify LDAP structure before integrating.

Extension Points

1. Custom Authenticator Extend Cdesign\LdapBundle\Security\Authenticator\LdapAuthenticator for custom logic (e.g., multi-factor auth):

   class CustomLdapAuthenticator extends LdapAuthenticator
   {
       public function authenticate(Credentials $credentials)
       {
           // Add pre-auth logic
           $user = parent::authenticate($credentials);
           // Add post-auth logic
           return $user;
       }
   }
   

2. Dynamic Configuration Load LDAP settings from environment variables or a database:

   cdesign_ldap:
       host: '%env(LDAP_HOST)%'
       password: '%env(LDAP_PASSWORD)%'
   

3. Multi-Domain Support Use a custom LdapUserProvider to route users to different LDAP servers based on domain:

   public function loadUserByUsername($username)
   {
       $domain = explode('@', $username)[1];
       $this->setHost("ldap://{$domain}-ldap-server");
       return parent::loadUserByUsername($username);
   }