LdapBundle

LdapBundle provides LDAP authentication without using Apache's mod_ldap. The bundle instead relies on PHP's LDAP extension along with a form to authenticate users. LdapBundle can also be used for authorization by retrieving the user's roles defined in LDAP.

Contact

Nick: aways IRC: irc.freenode.net - #symfony-fr

Install

1. Download with composer
2. Enable the Bundle
3. Configure LdapBundle in security.yml
4. Import LdapBundle routing
5. Implement Logout
6. Use chain provider
7. Subscribe to PRE_BIND event
8. Subscribe to POST_BIND event

Get the Bundle

Composer

Add LdapBundle in your project's composer.json

{
"require": {
"imag/ldap-bundle": "dev-master"
}
}

Enable the Bundle

<?php// app/AppKernel.phppublicfunctionregisterBundles()
{
$bundles = array(
// ...newIMAG\LdapBundle\IMAGLdapBundle(),
);
}

Configure security.yml

Note:

An example security.yml file is located within the bundle at ./Resources/Docs/security.yml

# ./IMAG/LdapBundle/Resources/config/security.ymlsecurity:
firewalls:
restricted_area:
pattern: ^/anonymous: ~provider: ldapimag_ldap: ~# alternative configuration# imag_ldap:# login_path: /ninja/loginlogout:
path: /logouttarget: /providers:
ldap:
id: imag_ldap.security.user.providerencoders:
IMAG\LdapBundle\User\LdapUser: plaintextaccess_control:
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: IS_AUTHENTICATED_FULLY }imag_ldap:
client:
host: your.host.fooport: 389# version: 3 # Optional# username: foo # Optional# password: bar # Optional# network_timeout: 10 # Optional# referrals_enabled: true # Optional# bind_username_before: true # Optional# skip_roles: false # Optionaluser:
base_dn: ou=people,dc=host,dc=foo# filter: (&(foo=bar)(ObjectClass=Person)) #Optionalname_attribute: uidrole:
base_dn: ou=group, dc=host, dc=foo# filter: (ou=group) #Optionalname_attribute: cnuser_attribute: memberuser_id: [ dn or username ]# user_class: IMAG\LdapBundle\User\LdapUser # Optional

You should configure the parameters under the imag_ldap section to match your environment.

Note:

The optional parameters have default values if not set. You can disable default values by setting a parameter to NULL.

# app/config/security.ymlimag_ldap:
# ...role:
# ...filter: NULL

Import routing

# app/config/routing.ymlimag_ldap:
resource: "@IMAGLdapBundle/Resources/config/routing.yml"

Implement Logout

Just create a link with a logout target.

<ahref="{{ path('logout') }}">Logout</a>

Note:

You can refer to the official Symfony documentation : http://symfony.com/doc/current/book/security.html#logging-out

Chain provider

You can also chain the login form with other providers, such as database_provider, in_memory provider, etc.

# app/config/security.ymlsecurity:
firewalls:
secured_area:
pattern: ^/anonymous: ~imag_ldap:
provider: multipleslogout:
path: logoutproviders:
multiples:
chain:
providers: [ldap, db] ldap:
id: imag_ldap.security.user.providerdb:
entity: { class: FQDN\User }

Note:

If you have set the config option bind_username_before: true you must chain the providers with the ldap provider in the last position.

# app/config/security.ymlproviders: [db, ldap] 

Subscribe to PRE_BIND event

The PRE_BIND is fired before the user is authenticated via LDAP. Here you can write a listener to perform your own logic before the user is bound/authenticated to LDAP. For example, to add your own roles or do other authentication/authorization checks with your application.

If you want to break the authentication process within your listener, throw an Exception.

Example listener:

<serviceid="ldap.listener"class="Acme\HelloBundle\EventListener\LdapSecuritySubscriber">
<tagname="kernel.event_subscriber" />
</service>

Example:

<?phpnamespaceAcme\HelloBundle\EventListener;
useSymfony\Component\EventDispatcher\EventSubscriberInterface;
useIMAG\LdapBundle\Event\LdapUserEvent;
/** * Performs logic before the user is found to LDAP */class LdapSecuritySubscriber implements EventSubscriberInterface
{
publicstaticfunctiongetSubscribedEvents()
{
returnarray(
\IMAG\LdapBundle\Event\LdapEvents::PRE_BIND => 'onPreBind',
);
}
/** * Modifies the User before binding data from LDAP * * @param \IMAG\LdapBundle\Event\LdapUserEvent $event */publicfunctiononPreBind(LdapUserEvent$event)
{
$user = $event->getUser();
$config = $this->appContext->getConfig();
$ldapConf = $config['ldap'];
if (!in_array($user->getUsername(), $ldapConf['allowed'])) {
thrownew \Exception(sprintf('LDAP user %s not allowed', $user->getUsername()));
}
$user->addRole('ROLE_LDAP');
$event->setUser($user);
}
}

Subscribe to POST_BIND event

The POST_BIND is fired after the user is authenticated via LDAP. You can use it in exactly the same manner as PRE_BIND.

Note:

However each time a page is refreshed, Symfony call the refreshUser method in the provider that is used and doesn't trigger these events (PRE_BIND and POST_BIND). If you want to override user (for example like credentials, roles ...), you must create a new provider and override this method.