Ldap Bundle Laravel Package

Getting Started

Minimal Setup

1. Installation Add the bundle via Composer:

   composer require daps/ldap-bundle
   

   Enable it in config/bundles.php:

   return [
       // ...
       Daps\LdapBundle\DapsLdapBundle::class => ['all' => true],
   ];
   

2. Configuration Define LDAP settings in config/packages/daps_ldap.yaml:

   daps_ldap:
       servers:
           main:
               host: 'ldap.example.com'
               port: 389
               encryption: 'none' # or 'ssl', 'tls'
               options:
                   protocol_version: 3
       users:
           base_dn: 'dc=example,dc=com'
           search_dn: 'cn=admin,dc=example,dc=com'
           search_password: 'admin_password'
           username_attribute: 'sAMAccountName' # or 'uid'
           group_attribute: 'memberOf'
   

3. First Use Case: LDAP Authentication Extend Symfony’s security system to use LDAP:

   # config/packages/security.yaml
   security:
       providers:
           ldap_provider:
               id: daps_ldap.security.user_provider
       firewalls:
           main:
               provider: ldap_provider
               form_login:
                   login_path: login
                   check_path: login_check
   

Implementation Patterns

Core Workflows

1. User Authentication

   • Use the built-in LdapUserProvider to validate credentials against LDAP.
   • Customize user loading with loadUserByUsername():

     // src/Security/LdapUserProvider.php
     public function loadUserByUsername($username)
     {
         $user = $this->ldap->findUser($username);
         return new User($user['dn'], $user['attributes']);
     }
     

2. Group-Based Authorization

   • Fetch user groups via memberOf attribute:

     $groups = $this->ldap->getGroups($userDn);
     $this->denyAccessUnlessGranted('ROLE_GROUP_ADMIN', $groups);
     

3. Dynamic User Provisioning

   • Sync LDAP users to Symfony’s users table on login:

     // Event subscriber
     public function onAuthenticationSuccess(AuthenticateEvent $event)
     {
         $user = $event->getUser();
         if (!$this->userManager->findUserBy(['ldap_dn' => $user->getDn()])) {
             $this->userManager->createUserFromLdap($user);
         }
     }
     

Integration Tips

• Hybrid Auth: Combine with Symfony’s chain_provider for fallback to DB auth.
• Caching: Cache LDAP responses to reduce server load:

  daps_ldap:
      cache:
          enabled: true
          lifetime: 3600 # 1 hour
  

• Async Operations: Use Symfony’s Messenger component to offload LDAP-heavy tasks (e.g., bulk user imports).

Gotchas and Tips

Common Pitfalls

1. Connection Issues

   • Symptom: Connection refused or timeouts.
   • Fix: Verify host, port, and encryption in config. Test connectivity with:

     ldapsearch -x -H ldap://ldap.example.com -b "dc=example,dc=com"
     

   • Debug: Enable logging:

     daps_ldap:
         debug: true
     

2. Attribute Mismatches

   • Symptom: Users fail to authenticate despite correct credentials.
   • Fix: Ensure username_attribute matches LDAP schema (e.g., sAMAccountName for Active Directory, uid for OpenLDAP).
   • Tip: Use ldapsearch to inspect user attributes:

     ldapsearch -x -H ldap://ldap.example.com -b "dc=example,dc=com" "(sAMAccountName=testuser)"
     

3. Group Resolution

   • Symptom: memberOf returns empty or malformed data.
   • Fix: Normalize group DNs (e.g., strip CN= prefixes):

     $groups = array_map(function($dn) {
         return str_replace('CN=', '', $dn);
     }, $user['memberOf']);
     

Debugging Tips

• Enable Verbose Logging:

  monolog:
      handlers:
          main:
              level: debug
  

• Test LDAP Queries: Use the LdapManager directly in a controller for ad-hoc queries:

  $users = $this->ldap->findUsers(['department' => 'IT']);
  

Extension Points

1. Custom User Classes Override Daps\LdapBundle\Security\User\LdapUser to add custom properties:

   class CustomLdapUser extends LdapUser
   {
       public function getFullName()
       {
           return $this->getAttribute('givenName') . ' ' . $this->getAttribute('sn');
       }
   }
   

2. Pre/Post-Login Logic Subscribe to events:

   // src/EventSubscriber/LdapAuthSubscriber.php
   class LdapAuthSubscriber implements EventSubscriberInterface
   {
       public static function getSubscribedEvents()
       {
           return [
               AuthenticationEvents::AUTHENTICATION_SUCCESS => 'onAuthSuccess',
           ];
       }
   
       public function onAuthSuccess(AuthenticateEvent $event)
       {
           // Extend user data, log events, etc.
       }
   }
   

3. Multi-Server Support Configure multiple LDAP servers and route queries dynamically:

   daps_ldap:
       servers:
           ad:
               host: 'ad.example.com'
               port: 636
               encryption: 'ssl'
           openldap:
               host: 'ldap.example.com'
               port: 389
   

   $this->ldap->setServer('ad'); // Switch context