stevebauman
commented
4 years ago Hi @gregupton! Thanks so much for the sponsorship! ❤️
I'll absolutely walk you through the process.
First, create your own User LDAP model that extends the built-in LdapRecord Active Directory user.
You can do this by running the below command:
php artisan make:ldap-model UserThen, update the generated model (inside the app\Ldap\User.php file) and make it extend the LdapRecord Active Directory User model:
namespace App\Ldap;
use LdapRecord\Models\ActiveDirectory\User as BaseModel;
class User extends BaseModel
{
//
}Now we will create the scope that will be applied to the model.
Run the below command to create it:
php artisan make:ldap-scope ImportFilterThen, in the generated scope (app/Ldap/Scopes/ImportFilter.php), this is where you will limit the users who can authenticate and be imported into your application.
Here is an example scope:
// ...
use LdapRecord\Models\ActiveDirectory\Group;
class ImportFilter implements Scope
{
public function apply(Builder $query, Model $model)
{
$group = Group::findByAnrOrFail('My group name');
$query->whereMemberOf($group);
}
}Note: I use the
Group::findByAnrOrFail()method to generate an exception if the group cannot be found in the directory. This guarantees that the scope is applied and group membership is properly queried for.
Then, inside of your created app/Ldap/User.php model, override the static boot() method, and add the global scope to the model:
namespace App\Ldap;
use App\Ldap\Scopes\ImportFilter;
use LdapRecord\Models\ActiveDirectory\User as BaseModel;
class User extends BaseModel
{
protected static function boot()
{
parent::boot();
static:addGlobalScope(new ImportFilter);
}
}After that is done, update your authentication provider inside your config/auth.php file with your new LDAP model:
// ...
// config/auth.php
'providers' => [
// ...
'ldap' => [
// ...
'model' => \App\Ldap\User::class,
],
],Now when you run ldap:import command, only members of the AD group you have specified will be imported. In addition, users attempting to sign into your application that have not yet been imported will have the same scope applied, guaranteeing that your application only contains members of the group you have specified.
gregupton
Hello Steve,
How would one go about creating a globalScope or filter to only import users from a specific AD group?