Only Import users defined in some rule.

[luis-gmonkey]

Hello again =)

I've created a rule to limit the number of users who can login to my app, works pretty well. But now I would like to only import users inside that rule while using php artisan ldap:import users

My rule is something like:

CN=AmazingUserGroup,OU=My-Users,DC=mydomain,DC=COM

Is it possible to achieve that?

[stevebauman]

Hi @luis-gmonkey,

You will have to create a scope that you apply to your LDAP user model to limit the users whom are retrieved by the import.

If you're using one of the built-in models, simply generate a new LdapRecord model, and extend the built-in one you were previously using.

[luis-gmonkey]

Hi @stevebauman

I was trying to avoid using a global scope, I might need to mess with the others users aswell later on.
But I remember, I can just create another model for them too.
Huge thx for you support!

[stevebauman]

No problem @luis-gmonkey -- I understand.

In that case, you will have to swap out the LdapUserRepository binding for your own, inside of one of your service provider's register method (such as AuthServiceProvider or AppServiceProvider):

// app/Providers/AppServiceProvider.php

use LdapRecord\Laravel\LdapUserRepository;
use App\Repositories\MyLdapUserRepository;

public function register()
{
    $this->app->bind(LdapUserRepository::class, MyLdapUserRepository::class);
}

// app/Repositories/LdapUserRepository.php

namespace App\Repositories;

use LdapRecord\Laravel\LdapUserRepository;

class MyLdapUserRepository extends LdapUserRepository
{
    /**
     * Get a new model query.
     *
     * @return \LdapRecord\Query\Model\Builder
     */
    public function query()
    {
        return $this->newModelQuery()->where('field', '=', 'value');
    }
}

With this, you can override the query() method and apply your own filter statements to the query that is used for all user based imports (via command, or via login).

[luis-gmonkey]

Awesome, thanks again @stevebauman

[PrimeGhostDE]

Hi together,

i am currently searching the same but i want to limit the repository by the same rule for login. So my database is not exploding from not used users by AD. Is there a way i can implement this?

Probably this is just not visible to me how to do that by scopes.

The behaviour should be to limit the import to the users which are in a group. Currently i am doing this by the rule:

public function passes(User|LdapRecord $user, Eloquent $model = null): bool
    {
        $workflowUsers = Group::where('name', '=', 'gg_workflow')->first();

        return $user->groups()->recursive()->exists($workflowUsers);
    }

Thank you in advance

[stevebauman]

Hi @PrimeGhostDE,

You should be able to use the same approach mentioned above, but instead using the whereMemberOf method to scope the query to users whom are members of your gg_workflow group:

https://github.com/DirectoryTree/LdapRecord/blob/d66344ab2db16049d1611ebd66916c7a314753fc/src/Query/Model/ActiveDirectoryBuilder.php#L81-L91

// app/Repositories/LdapUserRepository.php

namespace App\Repositories;

use LdapRecord\Models\Group;
use LdapRecord\Query\Model\Builder;
use LdapRecord\Laravel\LdapUserRepository as BaseRepository;

class LdapUserRepository extends BaseRepository
{
    /**
     * Get a new model query.
     */
    public function query(): Builder
    {
         $workflowUsers = Group::where('name', '= 'gg_workflow')->firstOrFail();

        return $this->newModelQuery()->whereMemberOf($workflowUsers->getDn());
    }
}

Let me know if you encounter issues 👍