Login with Laravel vs stand alone version uses search instead of another method (User, not server binding)

[chrispian]

Ok, I have a strange issue and some theories but I'm new to LDAP/AD in general. I installed the LdapRecord stand alone version and was able to connect to our AD server and authenticate the user following the example in the docs. Took about 3 minutes and worked as expected.

When trying to do the same with Laravel (via tinker) I get an ldap_search error. The Laravel version appears to be doing a search on an attribute first and then trying to login. Is there any way to skip this and login exactly like it does with the non Laravel version?

Here is the example in NON-Laravel:

<?php

require __DIR__ . '/vendor/autoload.php';

use LdapRecord\Connection;

$connection = new Connection([
    // Mandatory Configuration Options
    'hosts'            => ['HOST_HERE'],
    'base_dn'          => 'DN_HERE',
    'username'         => 'USER_NAME_HERE',
    'password'         => '', // LEFT BLANK ON PURPOSE!

    // Optional Configuration Options
    'port'             => 389,
    'use_ssl'          => false,
    'use_tls'          => false,
    'version'          => 3,
    'timeout'          => 5,
    'follow_referrals' => false,

    // Custom LDAP Options
    'options' => [
        // See: http://php.net/ldap_set_option
        LDAP_OPT_X_TLS_REQUIRE_CERT => LDAP_OPT_X_TLS_HARD
    ]
]);


try {
    $connection->connect();

    echo "Successfully connected!";
} catch (\LdapRecord\Auth\BindException $e) {
    $error = $e->getDetailedError();

    echo $error->getErrorCode();
    echo $error->getErrorMessage();
    echo $error->getDiagnosticMessage();
}


$user = 'my_username_here'; // Not server/binding, user logging in
$password = 'my_user_password_here';

if ($connection->auth()->attempt($user, $password)) {
    echo "Username and password are correct!";
} else {
	echo "Sorry, could not login with provided credentials!"
}

The above works just fine.

In Laravel LoginRequest.php I have the following:

    public function authenticate()
    {
        $this->ensureIsNotRateLimited();

        $credentials = [
            'samaccountname' => $this->username,
            'password' => $this->password,
        ];


        if (! Auth::attempt($credentials, $this->filled('remember'))) {
            RateLimiter::hit($this->throttleKey());

            throw ValidationException::withMessages([
                'username' => __('auth.failed'),
            ]);
        }

        RateLimiter::clear($this->throttleKey());
    }

And I get the ldap_search error here. I believe we have search disabled - I'm trying to find out that detail. But ideally, I would like to skip searching as I'll know the samaccountname every time. It seems like what the Laravel version does is search an attribute then tries to login vs just logging in like the stand alone version.

I've tried this in tinker as well. I'm using a brand new laravel install with no extra libraries installed, just ldaprecord. I'm using Breeze just to keep things simple to get this working and just attempting a Plain Login right now vs Database Sync.

The instructions are great but I'm stuck on this problem and can't seem to get past it. Any suggestions of things to try would be greatly appreciated!

[stevebauman]

Hi @chrispian, I'll help you get up and running 👍

And I get the ldap_search error here. I believe we have search disabled - I'm trying to find out that detail. But ideally, I would like to skip searching as I'll know the samaccountname every time.

This is not possible. LdapRecord must search for the user in your directory to authenticate them, just as Laravel does with Eloquent authentication. LdapRecord will take the login attribute you provide (in your case, samaccountname), and then fetch their full distinguished name to be able to properly attempt a bind against your LDAP server to authenticate.

Can you post your config/auth.php file, as well as your config/ldap.php file with any sensitive details omitted?

[chrispian]

@stevebauman Thank you again! This one is weird and I admit I'm new to ldap/ad so this help is very much appreciated.

Here is the config/ldap.php :

<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Default LDAP Connection Name
    |--------------------------------------------------------------------------
    |
    | Here you may specify which of the LDAP connections below you wish
    | to use as your default connection for all LDAP operations. Of
    | course you may add as many connections you'd like below.
    |
    */

    'default' => env('LDAP_CONNECTION', 'default'),

    /*
    |--------------------------------------------------------------------------
    | LDAP Connections
    |--------------------------------------------------------------------------
    |
    | Below you may configure each LDAP connection your application requires
    | access to. Be sure to include a valid base DN - otherwise you may
    | not receive any results when performing LDAP search operations.
    |
    */

    'connections' => [
        'default' => [
            'hosts'    => [env('LDAP_HOST', 'HOST_HERE')],
            'username' => env('LDAP_USERNAME', 'USER_NAME_HERE'),
            'password' => env('LDAP_PASSWORD', null),
            'port'     => env('LDAP_PORT', 389),
            'base_dn'  => env('LDAP_BASE_DN', 'DC=corp, DC=adtran,DC=com'),
            'timeout'  => env('LDAP_TIMEOUT', 5),
            'use_ssl'  => env('LDAP_SSL', false),
            'use_tls'  => env('LDAP_TLS', false),
        ],
    ],

    /*
    |--------------------------------------------------------------------------
    | LDAP Logging
    |--------------------------------------------------------------------------
    |
    | When LDAP logging is enabled, all LDAP search and authentication
    | operations are logged using the default application logging
    | driver. This can assist in debugging issues and more.
    |
    */

    'logging' => env('LDAP_LOGGING', true),

    /*
    |--------------------------------------------------------------------------
    | LDAP Cache
    |--------------------------------------------------------------------------
    |
    | LDAP caching enables the ability of caching search results using the
    | query builder. This is great for running expensive operations that
    | may take many seconds to complete, such as a pagination request.
    |
    */

    'cache' => [
        'enabled' => env('LDAP_CACHE', false),
        'driver' => env('CACHE_DRIVER', 'file'),
    ],

];

And here is the config/auth.php :

<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Authentication Defaults
    |--------------------------------------------------------------------------
    |
    | This option controls the default authentication "guard" and password
    | reset options for your application. You may change these defaults
    | as required, but they're a perfect start for most applications.
    |
    */

    'defaults' => [
        'guard' => 'web',
        'passwords' => 'users',
    ],

    /*
    |--------------------------------------------------------------------------
    | Authentication Guards
    |--------------------------------------------------------------------------
    |
    | Next, you may define every authentication guard for your application.
    | Of course, a great default configuration has been defined for you
    | here which uses session storage and the Eloquent user provider.
    |
    | All authentication drivers have a user provider. This defines how the
    | users are actually retrieved out of your database or other storage
    | mechanisms used by this application to persist your user's data.
    |
    | Supported: "session"
    |
    */

    'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],
    ],

    /*
    |--------------------------------------------------------------------------
    | User Providers
    |--------------------------------------------------------------------------
    |
    | All authentication drivers have a user provider. This defines how the
    | users are actually retrieved out of your database or other storage
    | mechanisms used by this application to persist your user's data.
    |
    | If you have multiple user tables or models you may configure multiple
    | sources which represent each model / table. These sources may then
    | be assigned to any extra authentication guards you have defined.
    |
    | Supported: "database", "eloquent"
    |
    */

    'providers' => [
        'users' => [
            'driver' => 'ldap',
            'model' => LdapRecord\Models\ActiveDirectory\User::class,
            'rules' => [],
        ],

        // 'users' => [
        //     'driver' => 'database',
        //     'table' => 'users',
        // ],
    ],

    /*
    |--------------------------------------------------------------------------
    | Resetting Passwords
    |--------------------------------------------------------------------------
    |
    | You may specify multiple password reset configurations if you have more
    | than one user table or model in the application and you want to have
    | separate password reset settings based on the specific user types.
    |
    | The expire time is the number of minutes that each reset token will be
    | considered valid. This security feature keeps tokens short-lived so
    | they have less time to be guessed. You may change this as needed.
    |
    */

    'passwords' => [
        'users' => [
            'provider' => 'users',
            'table' => 'password_resets',
            'expire' => 60,
            'throttle' => 60,
        ],
    ],

    /*
    |--------------------------------------------------------------------------
    | Password Confirmation Timeout
    |--------------------------------------------------------------------------
    |
    | Here you may define the amount of seconds before a password confirmation
    | times out and the user is prompted to re-enter their password via the
    | confirmation screen. By default, the timeout lasts for three hours.
    |
    */

    'password_timeout' => 10800,

];

Let me know if you need anything else.

[chrispian]

@stevebauman Yeah, we are on php 8.1, I should have mentioned that detail. We are in the middle of upgrading our boxes at work.

I ran the update and have a new error, it's telling me the password is required again. I'm passing in null though, like you suggested previously. Same code as above, here is the actual error:

PHP Fatal error:  Uncaught LdapRecord\Auth\PasswordRequiredException: A password must be specified. in /Users/cburks/Projects/ldap-test/vendor/directorytree/ldaprecord/src/Auth/Guard.php:68
Stack trace:
#0 /Users/cburks/Projects/ldap-test/test.php(34): LdapRecord\Auth\Guard->attempt('cn=admin,dc=loc...', NULL)
#1 {main}
  thrown in /Users/cburks/Projects/ldap-test/vendor/directorytree/ldaprecord/src/Auth/Guard.php on line 68

Fatal error: Uncaught LdapRecord\Auth\PasswordRequiredException: A password must be specified. in /Users/cburks/Projects/ldap-test/vendor/directorytree/ldaprecord/src/Auth/Guard.php:68
Stack trace:
#0 /Users/cburks/Projects/ldap-test/test.php(34): LdapRecord\Auth\Guard->attempt('cn=admin,dc=loc...', NULL)
#1 {main}
  thrown in /Users/cburks/Projects/ldap-test/vendor/directorytree/ldaprecord/src/Auth/Guard.php on line 68

[stevebauman]

No worries @chrispian.

You're calling attempt() instead of bind() in your above code example:

$user = 'cn=admin,dc=local,dc=com';
$password = null;

if ($connection->auth()->attempt($user, $password)) // <-- Should be "bind()"
{
    echo "Username and password are correct!";
}

[stevebauman]

Also, you don't need to call auth()->attempt() or auth()->bind() at all if you're simply looking to connect. Call $connection->connect() if your username and password is defined in the configuration array:

$connection->connect();

https://ldaprecord.com/docs/core/v2/connections/#connecting

[chrispian]

@stevebauman

Thank you! This helped clear up a few things. I thought the config was just for the app to talk to the server and then users would login separately. But now I see that's not the case and that was confusing me being new to the auth part of laravel and ldap. This cleared that up. I'm able to connect and validate a users creds with the code below now. So instead of the config we want to authenticate every user. I don't need anything fancy here, we just want them to use the LDAP/AD login so I'll just log them in with this and I can do a firstOrCreate with laravel to add them locally by hand if needed. I'm going to look at how syncing works here. Not every user will need to be synced, just a small subset of total users and only if they ever login.

Thanks again for all the help, this code below seems to do the trick. But based on your feedback, the connection logs the user in and if that fails they aren't, so that's perfect too. Now I know I don't need to do both.

Also of note, for our AD logins with LDAP I found out we have to prepend corp\\ to it for that to work - that was another bit of info I didn't have.

Last thing, when I tried the code below using bind doesn't work at all but attempt does. Bind always fails. I'm happy to test other things if it'll help sort that out. I don't need it as this does what I'm looking for (I just need to know the user is valid and then query for email and username - we don't need any other info for this project) so it's working great. I'll be getting it all sorted in Laravel over the next couple days!

require __DIR__ . '/vendor/autoload.php';

use LdapRecord\Connection;

$user = 'corp' . '\\' . 'cburks';
$password = 'PASSWORD_HERE';

$connection = new Connection([
    'hosts'    => ['HOST_HERE'],
    'port'     => 389,
    'base_dn'  => 'DC=corp,DC=adtran,DC=com',
    'username' => $user,
    'password' => $password,
]);

if ($connection->auth()->attempt($user, $password))
{
    echo "Username and password are correct!";
} else {
    echo "Failed";
}

[stevebauman]

Thanks so much for the sponsorship @chrispian, ❤️

I'm glad you were able to get up and running.

Also of note, for our AD logins with LDAP I found out we have to prepend corp\ to it for that to work - that was another bit of info I didn't have.

Gotcha -- this is documented (although you'd have to dig for it) in the configuration docs. This username format (down-level logon name) is only compatible with AD: https://ldaprecord.com/docs/core/v2/configuration/#username--password

I'm working on implementing Algolia Search on the docs site, as Fuse.js doesn't go deep enough to find fine details in the documentation.

Last thing, when I tried the code below using bind doesn't work at all but attempt does.

Sorry, this is my mistake, the bind() method does not return a boolean -- it will actually return no value at all (void). bind() will instead throw an exception if the provided credentials are incorrect:

Using auth():

if ($connection->auth()->attempt($user, $password))
{
    echo "Username and password are correct!";
} else {
    echo "Failed";
}

Using bind():

try {
    $connection->auth()->bind($user, $password);

    echo "Username and password are correct!";
} catch (\LdapRecord\ConnectionException $e) {
    echo "A connection exception occurred: {$e->getMessage()}";
} catch (\LdapRecord\Auth\BindException $e) {
    echo "A bind exception occurred: {$e->getMessage()}";
}

These methods differ as bind() will allow you to retrieve more information from the authentication error via their exceptions, while auth() is meant for user based input as it will not allow an empty password which could allow an anonymous bind to the LDAP server, which may mistakenly confuse developers that the credentials are "valid".

Let me know if you have any other questions, I'm on GitHub every day 👍