Symfony authenticate with local sql or ldap - symfony

Question

I am trying to configure my authentication with the new security system.
I would like the password verification to be done on a local sql or ldap.
With my current config, the check is done on the local sql, then on the ldap
how to make it one or the other ?
I have been going around in circles for several days...
My security.php
$containerConfigurator->extension('security', [
'providers' => [
'mercredi_user_provider' => [
'entity' => [
'class' => User::class,
'property' => 'username',
],
],
'ville_ldap' => [
'ldap' => [
'service' => 'Symfony\Component\Ldap\Ldap',
'base_dn' => '%env(ACLDAP_DN)%',
'search_dn' => '%env(ACLDAP_USER)%',
'search_password' => '%env(ACLDAP_PASSWORD)%',
'default_roles' => 'ROLE_BOTTIN_ADMIN',
'uid_key' => 'sAMAccountName',
'extra_fields' => ['mail'],
],
],
'all_users' => [
'chain' => [
'providers' => ['ville_ldap', 'mercredi_user_provider'],
],
],
],
]
);
$containerConfigurator->extension(
'security',
[
'firewalls' => [
'main' => [
'provider' => 'all_users',
'custom_authenticator' => MercrediAuthenticator::class,
'form_login_ldap' => [
'service' => 'Symfony\Component\Ldap\Ldap',
'search_dn' => '%env(ACLDAP_USER)%',
'search_password' => '%env(ACLDAP_PASSWORD)%',
'query_string' => '(&(|(sAMAccountName={username}))(objectClass=person))',
'dn_string' => '%env(ACLDAP_DN)%',
'check_path' => 'app_login',
'username_parameter' => 'username',
'password_parameter' => 'password',
],
'logout' => ['path' => 'app_logout'],
],
],
]
);
My Authenticator
public function authenticate(Request $request): PassportInterface
{
$email = $request->request->get('username', '');
$password = $request->request->get('password', '');
$token = $request->request->get('_csrf_token', '');
$request->getSession()->set(Security::LAST_USERNAME, $email);
$badges =
[
new CsrfTokenBadge('authenticate', $token),
new PasswordUpgradeBadge($password, $this->userRepository),
new LdapBadge(LdapMercredi::class, $email),
];
return new Passport(
new UserBadge($email),
new PasswordCredentials($password), $badges
);
}
My class ldap
class LdapMercredi implements LdapInterface
{
private Ldap $ldap;
private string $dn;
private string $user;
private string $password;
public function __construct(string $host, string $dn, string $user, string $password)
{
$this->ldap = Ldap::create(
'ext_ldap',
[
'host' => $host,
'encryption' => 'ssl',
]
);
$this->user = $user;
$this->password = $password;
$this->dn = $dn;
}
public function getEntry(string $uid): ?Entry
{
$this->ldap->bind($this->user, $this->password);
$filter = "(&(|(sAMAccountName=*$uid*))(objectClass=person))";
$query = $this->ldap->query($this->dn, $filter, ['maxItems' => 1]);
$results = $query->execute();
if ($results->count() > 0) {
return $results[0];
}
return null;
}
public function getEntryManager(): EntryManagerInterface
{
return $this->ldap->getEntryManager();
}
public function bind(string $dn = null, string $password = null)
{
dd($dn);
// TODO: Implement bind() method.
}
public function query(string $dn, string $query, array $options = [])
{
dd($query);
// TODO: Implement query() method.
}
public function escape(string $subject, string $ignore = '', int $flags = 0)
{
// TODO: Implement escape() method.
}
}

Answer 1

UPDATE 23/08/21
Here is a configuration that works, there are some points that could improve.
For example, for the LdapBadge badge ('ldapServiceId') you have to give an ldap service, there is indeed the Symfony\Component\Ldap\Ldap which could be suitable but even if I add a tag 'ldap' in services.php
//services.php
$services->set(Ldap::class)->args(['#Symfony\Component\Ldap\Adapter\ExtLdap\Adapter'])->tag('ldap');
I have the error message: "Cannot check credentials using the "Symfony\Component\Ldap\Ldap" ldap service, as such service is not found."
So I copied and pasted the code from Ldap.php to LdapMercredi and declare as service ldap:
In my services.php,
if (interface_exists(LdapInterface::class)) {
$services
->set(Symfony\Component\Ldap\Ldap::class)
->args(['#Symfony\Component\Ldap\Adapter\ExtLdap\Adapter'])
->tag('ldap');
$services->set(Adapter::class)->args([
'$arguments' => [
'$host' => '%env(ACLDAP_URL)%',
'$port' => 636,
'$encryption' => 'ssl',
'$options' => [
'$protocole_version' => 3,
'$referrals' => false,
],
],
]);
$services->set(LdapMercredi::class)
->arg('$adapter', service('Symfony\Component\Ldap\Adapter\ExtLdap\Adapter'))
->tag('ldap');
/**
* Copy/Paste
* #see Ldap
*/
class LdapMercredi implements LdapInterface
{
private $adapter;
public function __construct(AdapterInterface $adapter)
{
$this->adapter = $adapter;
}
/**
* {#inheritdoc}
*/
public function bind(string $dn = null, string $password = null)
{
$this->adapter->getConnection()->bind($dn, $password);
}
/**
* {#inheritdoc}
*/
public function query(string $dn, string $query, array $options = []): QueryInterface
{
return $this->adapter->createQuery($dn, $query, $options);
}
/**
* {#inheritdoc}
*/
public function getEntryManager(): EntryManagerInterface
{
return $this->adapter->getEntryManager();
}
/**
* {#inheritdoc}
*/
public function escape(string $subject, string $ignore = '', int $flags = 0): string
{
return $this->adapter->escape($subject, $ignore, $flags);
}
/**
* Creates a new Ldap instance.
*
* #param string $adapter The adapter name
* #param array $config The adapter's configuration
*
* #return static
*/
public static function create(string $adapter, array $config = []): self
{
if ('ext_ldap' !== $adapter) {
throw new DriverNotFoundException(
sprintf('Adapter "%s" not found. Only "ext_ldap" is supported at the moment.', $adapter)
);
}
return new self(new Adapter($config));
}
}
In security.php:
$containerConfigurator->extension('security', [
'encoders' => [
User::class => ['algorithm' => 'auto'],
],
]);
$containerConfigurator->extension('security', [
'providers' => [
'mercredi_user_provider' => [
'entity' => [
'class' => User::class,
'property' => 'username',
],
],
],
]
);
$authenticators = [MercrediAuthenticator::class];
$main = [
'provider' => 'mercredi_user_provider',
'logout' => ['path' => 'app_logout'],
'form_login' => [],
'entry_point' => MercrediAuthenticator::class,
];
if (interface_exists(LdapInterface::class)) {
$authenticators[] = MercrediLdapAuthenticator::class;
$main['form_login_ldap'] = [
'service' => 'Symfony\Component\Ldap\Ldap',
'check_path' => 'app_login',
];
}
$main['custom_authenticator'] = $authenticators;
$containerConfigurator->extension(
'security',
[
'firewalls' => [
'main' => $main,
],
]
);
MercrediAuthenticator.php
class MercrediAuthenticator extends AbstractAuthenticator implements AuthenticationEntryPointInterface, InteractiveAuthenticatorInterface
{
use TargetPathTrait;
public const LOGIN_ROUTE = 'app_login';
private UrlGeneratorInterface $urlGenerator;
private UserRepository $userRepository;
private ParameterBagInterface $parameterBag;
public function __construct(
UrlGeneratorInterface $urlGenerator,
UserRepository $userRepository,
ParameterBagInterface $parameterBag
) {
$this->urlGenerator = $urlGenerator;
$this->userRepository = $userRepository;
$this->parameterBag = $parameterBag;
}
public function supports(Request $request): bool
{
return $request->isMethod('POST') && $this->getLoginUrl($request) === $request->getPathInfo();
}
public function authenticate(Request $request): PassportInterface
{
$email = $request->request->get('username', '');
$password = $request->request->get('password', '');
$token = $request->request->get('_csrf_token', '');
$request->getSession()->set(Security::LAST_USERNAME, $email);
$badges =
[
new CsrfTokenBadge('authenticate', $token),
new PasswordUpgradeBadge($password, $this->userRepository),
];
return new Passport(
new UserBadge($email),
new PasswordCredentials($password), $badges
);
}
public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
{
if ($targetPath = $this->getTargetPath($request->getSession(), $firewallName)) {
return new RedirectResponse($targetPath);
}
return new RedirectResponse($this->urlGenerator->generate('mercredi_front_profile_redirect'));
}
protected function getLoginUrl(Request $request): string
{
return $this->urlGenerator->generate(self::LOGIN_ROUTE);
}
/**
* Override to change what happens after a bad username/password is submitted.
*/
public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
{
if ($request->hasSession()) {
$request->getSession()->set(Security::AUTHENTICATION_ERROR, $exception);
}
if (interface_exists(LdapInterface::class)) {
return null;
}
$url = $this->getLoginUrl($request);
return new RedirectResponse($url);
}
/**
* Override to control what happens when the user hits a secure page
* but isn't logged in yet.
*/
public function start(Request $request, AuthenticationException $authException = null): Response
{
$url = $this->getLoginUrl($request);
return new RedirectResponse($url);
}
public function isInteractive(): bool
{
return true;
}
The trick of authenticating with ldap and local sql is that the credentials verification priority is higher
Symfony\Component\Ldap\Security\CheckLdapCredentialsListener
class MercrediLdapAuthenticator extends AbstractLoginFormAuthenticator
{
use TargetPathTrait;
public const LOGIN_ROUTE = 'app_login';
private UrlGeneratorInterface $urlGenerator;
private UserRepository $userRepository;
private ParameterBagInterface $parameterBag;
public function __construct(
UrlGeneratorInterface $urlGenerator,
UserRepository $userRepository,
ParameterBagInterface $parameterBag
) {
$this->urlGenerator = $urlGenerator;
$this->userRepository = $userRepository;
$this->parameterBag = $parameterBag;
}
public function authenticate(Request $request): PassportInterface
{
$email = $request->request->get('username', '');
$password = $request->request->get('password', '');
$token = $request->request->get('_csrf_token', '');
$request->getSession()->set(Security::LAST_USERNAME, $email);
$badges =
[
new CsrfTokenBadge('authenticate', $token),
new PasswordUpgradeBadge($password, $this->userRepository),//SelfValidatingPassport?
];
$query = "(&(|(sAMAccountName=*$email*))(objectClass=person))";
$badges[] = new LdapBadge(
LdapMercredi::class,
$this->parameterBag->get(Option::LDAP_DN),
$this->parameterBag->get(Option::LDAP_USER),
$this->parameterBag->get(Option::LDAP_PASSWORD),
$query
);
return new Passport(
new UserBadge($email),
new PasswordCredentials($password), $badges
);
}
public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
{
if ($targetPath = $this->getTargetPath($request->getSession(), $firewallName)) {
return new RedirectResponse($targetPath);
}
return new RedirectResponse($this->urlGenerator->generate('mercredi_front_profile_redirect'));
}
protected function getLoginUrl(Request $request): string
{
return $this->urlGenerator->generate(self::LOGIN_ROUTE);
}