Security Active Directory Laravel Package

Getting Started

• Recognize what this is: ztec/security-active_directory is a Symfony 2.1+ bundle, not a Laravel package. There is no service provider, no config/*.php, and no Laravel guard. If you're on Laravel, treat the repo as a reference implementation of an LDAP/AD authenticate flow you will re-implement (or replace with adldap2/adldap2-laravel). If you're maintaining a legacy Symfony 2.x/3.x app, you can still install it, but pin your PHP version accordingly.
• Where to look first: the bundle's Security/ (authentication provider + user provider) and DependencyInjection/ (config tree). The README and Resources/config/ show the intended security.yml wiring — read those before touching anything.
• First use case: form login where credentials are validated by an LDAP bind against a domain controller, then a local User object is hydrated from AD attributes (sAMAccountName, mail, displayName, memberOf). Get a single hard-coded test credential binding over ldap:// before you wire it into the firewall.

Minimal Symfony setup (legacy):

composer require ztec/security-active_directory

// app/AppKernel.php
new Ztec\Security\ActiveDirectoryBundle\ZtecSecurityActiveDirectoryBundle(),

# app/config/config.yml
ztec_security_active_directory:
    domain: example.local
    hosts: [dc01.example.local, dc02.example.local]
    base_dn: "DC=example,DC=local"

Implementation Patterns

• Firewall wiring is the whole game. The bundle is an authentication provider, so it plugs into security.yml alongside a form_login listener. Configure it as a custom provider/authentication_provider, not as a standalone middleware — there is no automatic request interception.
• Two-stage user resolution: (1) LDAP bind validates the password, (2) the user provider looks up / creates a local user. Keep the local user table as the source of truth for roles; don't try to map memberOf DNs to Symfony roles on every request without caching.
• Config-driven hosts: pass an array of domain controllers and let the bundle fail over. In practice, pre-resolve SRV records yourself rather than trusting a single host.
• Attribute mapping: hydrate only the fields you need (username, email, display name, groups). Persist them on first login and refresh on a schedule, not on every request — AD round-trips are the slowest part of your login path.
• Laravel equivalent (if porting): wrap the bind logic in a custom UserProvider + Guard, drive it from config/services.php, and mirror the bundle's config keys (hosts, base_dn, domain) so the mental model transfers. Use ldap_bind/ldap_search directly or adldap2-laravel; do not try to shoehorn the Symfony bundle into a Laravel service container.
• Testing: unit-test the provider against a fake LDAP connection interface; never hit a real DC in CI. Keep an integration test behind an env flag for the staging domain.

Gotchas and Tips

• Age and maintenance: last release 2016, 16 stars, 0 dependents. It predates Symfony 3.3's Guard component and PHP 7 typing. Expect deprecation warnings and manual patching on modern PHP; assume no upstream fixes.
• Bundle ≠ package: the Composer name (ztec/security-active_directory) and the repo (RiperFr/Security-ActiveDirectoryBundle) differ from the class namespace (Ztec\...). Verify the registered bundle class name against vendor/ — a mismatch is the most common "bundle not found" error.
• LDAP escaping: always ldap_escape() values interpolated into filters. A malicious username like *)(uid=* can bypass the bind if the filter is hand-built.
• Transport security: ldap:// sends credentials in cleartext. Force ldaps:// on port 636 or StartTLS; verify the DC certificate or you'll silently accept MITM.
• Firewall ordering: the AD provider must be reached before any catch-all anonymous rule. A misordered security.yml yields "credentials rejected" with no LDAP traffic at all — check access_control order first when debugging.
• Debugging: enable Symfony's ldap logging, then reproduce with raw ldapsearch -x -H ldaps://dc01 -D user@domain -W. If ldapsearch fails, the bundle will too — isolate the DC before blaming the bundle.
• Extension points: the config tree and the auth provider are the only seams. Fork the provider class if you need MFA, group-to-role mapping, or connection pooling; subclassing the bundle's provider is cleaner than patching vendor/.
• Bottom line for a Laravel team: don't adopt this package. Use it as a spec for your own guard, or evaluate adldap2/adldap2-laravel, which is actively maintained and container-native.