Relay Base Person Connector Ldap Bundle Laravel Package

Getting Started

Minimal Setup

1. Install the Bundle

   composer require dbp/relay-base-person-connector-ldap-bundle
   

   Ensure digital-blueprint/relay-base-person-bundle is also installed (dependency).

2. Configure the Bundle Add to config/packages/dbp_relay_base_person_connector_ldap.yaml:

   dbp_relay_base_person_connector_ldap:
       host: 'ldap://your-ldap-server'
       port: 389
       base_dn: 'dc=example,dc=com'
       username: 'cn=admin,dc=example,dc=com'
       password: '%env(LDAP_PASSWORD)%'
       user_search_filter: '(uid=%s)'
       attributes_mapping:
           first_name: 'givenName'
           last_name: 'sn'
           email: 'mail'
   

   Secure credentials via .env (e.g., LDAP_PASSWORD=yourpassword).

3. Register the Connector In a service file (e.g., config/services.yaml), bind the LDAP connector to the DbpRelayBasePersonBundle's person_connector service:

   services:
       App\Service\LdapPersonConnector:
           tags:
               - { name: 'dbp_relay_base_person.connector', priority: 100 }
   

4. First Use Case: Fetch a User Inject the PersonConnectorInterface into a service and call:

   $person = $this->personConnector->findByEmail('user@example.com');
   

   Verify LDAP logs for connectivity issues.

Implementation Patterns

Workflows

1. User Provisioning

   • Use PersonConnectorInterface to sync LDAP users to your app:

     $ldapUser = $this->personConnector->findByAttribute('uid', 'jdoe');
     $this->userRepository->upsertFromLdap($ldapUser);
     

   • Extend DbpRelayBasePersonBundle's Person entity to include LDAP-specific fields (e.g., ldapDn).

2. Authentication Integration

   • Combine with Symfony’s LdapAuthenticator for SSO:

     use Symfony\Component\Security\Http\Authenticator\LdapAuthenticator;
     // Configure in security.yaml
     firewalls:
         main:
             ldap: ~
     

   • Map LDAP groups to Symfony roles via ROLE_LDAP_GROUP_* in the authenticator.

3. Batch Sync

   • Implement a command to sync all LDAP users:

     use Symfony\Component\Console\Command\Command;
     class SyncLdapUsersCommand extends Command {
         protected function execute(InputInterface $input, OutputInterface $output) {
             $users = $this->personConnector->search('(objectClass=person)');
             foreach ($users as $user) {
                 $this->userRepository->saveFromLdap($user);
             }
         }
     }
     

Integration Tips

• Event Listeners: Subscribe to DbpRelayBasePersonBundle's PersonUpdatedEvent to trigger LDAP updates:

  use Dbp\RelayBasePersonBundle\Event\PersonUpdatedEvent;
  class LdapSyncListener {
      public function onPersonUpdated(PersonUpdatedEvent $event) {
          $this->ldapUpdater->syncToLdap($event->getPerson());
      }
  }
  

• Caching: Cache LDAP responses (e.g., with Symfony Cache) to reduce server load:

  # config/packages/cache.yaml
  cache:
      app:
          provider: 'cache.adapter.redis'
  

• Testing: Mock LDAP calls in tests using LdapRecord (from php-ldap-record):

  $mockLdap = new LdapRecord\Entry(['dn' => 'cn=test', 'uid' => ['test']]);
  $this->personConnector->expects($this->any())->method('search')->willReturn([$mockLdap]);
  

Gotchas and Tips

Pitfalls

1. Connection Issues

   • Symptom: Blank results or timeouts.
   • Debug: Enable LDAP logging in config/packages/monolog.yaml:

     handlers:
         ldap:
             type: stream
             path: '%kernel.logs_dir%/ldap.log'
             level: debug
             channels: ['ldap']
     

   • Fix: Verify host, port, and base_dn in the config. Use ldapsearch to test connectivity:

     ldapsearch -x -H ldap://your-server -b "dc=example,dc=com" -D "cn=admin,dc=example,dc=com" -w password
     

2. Attribute Mapping Errors

   • Symptom: Missing user fields (e.g., email).
   • Debug: Check LDAP schema for correct attribute names:

     ldapsearch -x -H ldap://your-server -b "dc=example,dc=com" "(objectClass=*)" + | grep "mail:"
     

   • Fix: Update attributes_mapping in config or extend the Person entity to handle custom fields.

3. Performance with Large Directories

   • Symptom: Slow searches or timeouts.
   • Fix: Limit search scope with search_scope (e.g., search_scope: 'onelevel').

4. Password Sync Risks

   • Gotcha: Avoid storing plain-text LDAP passwords in your app.
   • Workaround: Use password_encoder to hash passwords locally before syncing to LDAP (if supported by your LDAP server).

Debugging Tips

• Enable Symfony Debug Toolbar: Add DbpRelayBasePersonBundle's profiler data:

  // config/packages/dev/debug.yaml
  framework:
      profiler:
          collectors:
              dbp_relay_person: true
  

• LDAP-Specific Tools: Use ldapsearch or Apache Directory Studio to inspect the LDAP server directly.
• Environment Variables: Validate .env values with:

  php bin/console debug:container --parameter dbp_relay_base_person_connector_ldap
  

Extension Points

1. Custom Connector Logic Extend Dbp\RelayBasePersonConnectorLdapBundle\Connector\LdapPersonConnector to add logic:

   class CustomLdapConnector extends LdapPersonConnector {
       public function findByCustomAttribute($attribute, $value) {
           return $this->search(sprintf('(%s=%s)', $attribute, $value));
       }
   }
   

   Register as a service with the dbp_relay_base_person.connector tag.

2. Dynamic Attribute Mapping Override mapAttributes() to handle dynamic fields:

   protected function mapAttributes(array $ldapAttributes): array {
       $mapping = parent::mapAttributes($ldapAttributes);
       if (isset($ldapAttributes['extensionAttribute1'])) {
           $mapping['custom_field'] = $ldapAttributes['extensionAttribute1'][0];
       }
       return $mapping;
   }
   

3. Multi-LDAP Support Implement a MultiLdapPersonConnector to query multiple LDAP servers:

   class MultiLdapPersonConnector implements PersonConnectorInterface {
       private $connectors;
   
       public function __construct(iterable $connectors) {
           $this->connectors = $connectors;
       }
   
       public function findByEmail($email) {
           foreach ($this->connectors as $connector) {
               if ($person = $connector->findByEmail($email)) {
                   return $person;
               }
           }
           return null;
       }
   }
   

   Configure multiple LDAP connectors in services.yaml and inject them.

4. Webhook Triggers Use Symfony Messenger to dispatch events when LDAP users are updated:

   $this->messageBus->dispatch(
       new LdapUserUpdatedMessage($ldapUser->getDn())
   );
   

   Create a worker to handle syncs asynchronously.