search

trilbymedia / grav-plugin-login-ldap

Grav LDAP login plugin
https://trilby.media
MIT License
10 stars 13 forks source link

How do I get this to work with AD LDAP? #7

Open GryphonWorx opened 6 years ago

GryphonWorx commented 6 years ago

I have spent a few hours fiddling with this to get it to work with my AD LDAP and I have gotten to a certain point. With these settings:

UserDN: [username]@ad.domain.com Search DN: CN=Users,DC=ad,DC=domain,DC=com

I can get it to authenticate but it still says "Login failed...". However, with some fiddling in the plugin code to add extra log messages it actually gets as far as setting:

        $event->setStatus($event::AUTHENTICATION_SUCCESS);

But I think that since it fails to get group information the underlying system doesn't consider it authenticated or something to that extent? I'm not sure what to put in Group Query or Identifier. With a Group Query it can't find anything on sAMAccountName=[username] which should be possible. I know you made this for a client, but you would get a ton of users if it worked with AD :o!

dandantheflyingman commented 6 years ago

Hi,

Did you get any luck in making your AD LDAP auth work?

I've been struggling with it for the last few days as well...

dandantheflyingman commented 6 years ago

Answering my own question.. Following from first post:

User DN:  [username]@ad.domain.com
Group Query:  (&(cn=*)(member=[dn]))
Username Mapping: sAMAccountName

I looked at line 174/175 of login-ldap.php where it is forming the group_dn query:

$group_query = str_replace('[username]', $credentials['username'], $group_query);
$group_query = str_replace('[dn]', $userdata['dn'], $group_query);

There is an earlier function (getLDAPMappedItem) that should get the user DN from search user query.

So rather than using the '[username]' portion, you can format the Group Query to use the user distinguished name mapping to search for what groups the user is in.

I am an AD pleb, so there is probably a "right" way to do this that I am unaware of...