Closed yaplej closed 2 years ago
Hi @yaplej!
Please bear with me I am new to Laravel. I am trying to setup basic/plain LDAP authentication without a username and password in the LDAP connection. This appears like it was supported at some point but maybe its not working now?
This is only possible if your ActiveDirectory server has anonymous binding enabled. When binding anonymously, your permissions must be open enough so that users who need to sign into your Laravel application can be read from your ActiveDirectory server, along with the attribute you are using for authentication.
If anonymous binding is disabled, you must configure a username and password to connect to your Active Directory server.
Think of it like a database. LdapRecord needs credentials to discover the user who is attempting to sign into your Laravel application by the attribute of your choosing. Without this access, we cannot locate users by any attribute. You would have to have users enter in their full distinguished name to be able to sign in.
Let me know if you have any further questions 👍
Hmm I see you mentioned you're able to connect successfully via a null username and password. If you intent to use anonymous binding, can you ensure that you can view users inside of your directory? You can do this by placing this inside your web.php
routes file and visiting your application:
use LdapRecord\Models\ActiveDirectory\User;
dd(User::all());
If results are indeed returned, we can look into this further and see if it's a bug 👍
We don't allow anonymous binding so that makes sense. It might change the functionality but would it be possible to use the user provided credentials to perform the binding and lookup?
It might change the functionality but would it be possible to use the user provided credentials to perform the binding and lookup?
You'd somehow have to pre-bind (before you call Auth::attempt()
) and accept user input with the users full Distinguished Name (i.e. cn=John Doe,ou=users,dc=local,dc=com
) or their userPrincipalName
(i.e. jdoe@local.com
, when using ActiveDirectory) and their password. Keep in mind that PHP is stateless, so connectivity to your LDAP server would only last the duration of that single request.
LdapRecord aims to be compatible with all LDAP servers. Pre-binding in this way is would only work with ActiveDirectory, since you'd obviously aim to have users insert their userPrinicpalName
(an ActiveDirectory only attribute).
I'd recommend setting up a read-only user on the domain with computer login rights stripped, and access to read a limited set of attributes on users whom you expect to sign into your application.
This is a very common practice -- as even network connected printers require a username and password for searching LDAP directories and performing operations.
Everything is working as it should then.
I was just a little confused why I could not get it to work anonymously as the documentation hinted around. Was just missing that our LDAP/ActiveDirectory would have to allow anonymous bindings for that to work. I assumed it was trying to bind with the provided users credentials to verify them.
Yes, I agree is not unreasonable to require a read-only user for LDAP authentication. Especially to maintain interoperability.
Thank you.
Ok, thanks for the quick replies @yaplej. Please don't hesitate to create further issues if you have any other questions 👍
Environment:
Please bear with me I am new to Laravel. I am trying to setup basic/plain LDAP authentication without a username and password in the LDAP connection. This appears like it was supported at some point but maybe its not working now?
Testing LDAP appears to work just fine.
I am trying to use a very minimal amount of configuration for the LDAP connection in the .env file.
However when authenticating it looks as if I am getting a connection to the LDAP server but then it throws an exception.
If I enter a username & password into the .env LDAP connection configuration it does work.