LDAP and Symfony : Could not complete search with dn - symfony

I try to pass my application to Symfony. I have a problem with authentication.
With PHP, I used this code to check connection to active directory
$ldap_host = "%MY AD HOST%";
$ldap_dn = cn=srv_ldap,ou=Service,ou=Applicatifs,ou=Utilisateurs,ou=DomaineInterne,dc=mydomain,dc=pri";
$ldap_usr_dom = '#mydomain.pri';
$ldap = ldap_connect($ldap_host);
ldap_set_option($ldap,LDAP_OPT_PROTOCOL_VERSION,3);
ldap_set_option($ldap,LDAP_OPT_REFERRALS,1);
// verify user and password
if($bind = #ldap_bind($ldap, $user.$ldap_usr_dom, $password)) {
With Symfony, I used the Symfony Component Ldap :
config\services.yaml
[...]
Symfony\Component\Ldap\Ldap:
arguments: ['#Symfony\Component\Ldap\Adapter\ExtLdap\Adapter']
Symfony\Component\Ldap\Adapter\ExtLdap\Adapter:
arguments:
- host: %MY AD HOST%
port: 389
#encryption: tls
options:
protocol_version: 3
referrals: false
config\packages\security.yaml
...
[...]
providers:
ad_ldap:
ldap:
service: Symfony\Component\Ldap\Ldap
base_dn: cn=srv_ldap,ou=Service,ou=Applicatifs,ou=Utilisateurs,ou=DomaineInterne,dc=mydomain,dc=pri
default_roles: ROLE_USER
uid_key: sAMAccountName
firewalls:
main:
pattern: ^/
anonymous: true
lazy: true
form_login_ldap:
provider: ad_ldap
service: Symfony\Component\Ldap\Ldap
dn_string: 'sAMAccountName={username}#mydomain.pri'
check_path: security_login
login_path: security_login
csrf_token_generator: security.csrf.token_manager
default_target_path: blog_index
I have an error LdapException with the message :
Could not complete search with dn "cn=srv_ldap,ou=Service,ou=Applicatifs,ou=Utilisateurs,ou=DomaineInterne,dc=mydomain,dc=pri", query "(sAMAccountName=jane_admin)" and filters "*". LDAP error was [1] Operations error.
I try to replace "dn_string: 'sAMAccountName={username}#mydomain.pri'" with different things, but I still have this message...

Related

Unrecognized option access_token under security.firewalls.main

I've switched recently to Symfony 6.2 and want to use the newly introduces AccessTokenHandler for Bearer Authentication.
So all the cache is cleared after updating and I'm following the guide at https://symfony.com/doc/current/security/access_token.html.
This is part of my security.yaml:
security:
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
access_token:
token_handler: App\Security\AccessTokenHandler
token_extractors: header
lazy: true
provider: app_user_provider
form_login:
login_path: app_login
check_path: app_login
logout:
path: app_logout
But when I make some requests to my page, it says
Unrecognized option "access_token" under "security.firewalls.main".
Available options are "access_denied_handler", "access_denied_url",
"context", "custom_authenticators", "entry_point", "form_login",
"form_login_ldap", "host", "http_basic", "http_basic_ldap",
"json_login", "json_login_ldap", "lazy", "login_link",
"login_throttling", "logout", "methods", "pattern", "provider",
"remember_me", "remote_user", "request_matcher", "required_badges",
"security", "stateless", "switch_user", "user_checker", "x509".
So this looks like the changes to symfony 6.2 are not working. Or am I missing something?

Symfony- Authenticating against LDAPserver

I am trying to authenticate my users against an LDAP servr.
security:
providers:
my_ldap:
ldap:
service: Symfony\Component\Ldap\Ldap
base_dn: 'DC=maxcrc,DC=com'
search_dn: 'CN=manager,DC=maxcrc,DC=com'
search_password: 'secret'
default_roles: ROLE_USER
...
firewalls:
# disables authentication for assets and the profiler, adapt it according to your needs
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
anonymous: ~
form_login_ldap:
#http_basic_ldap:
login_path: login
check_path: login
service: Symfony\Component\Ldap\Ldap
dn_string: 'maxcrc\{username}'
my services.yml:
...
Symfony\Component\Ldap\Ldap:
arguments: ['#Symfony\Component\Ldap\Adapter\ExtLdap\Adapter']
Symfony\Component\Ldap\Adapter\ExtLdap\Adapter:
arguments:
- host: localhost
port: 389
#encryption: tls
options:
protocol_version: 3
referrals: false`
It seems to perfectly follow symfony intructions.. I can bind to my server,, however I get invalid credentials error whenever I submit my form!!
Please assist accordingly!!
You are missing the uid_key in your ldap definition:
security:
providers:
my_ldap:
ldap:
service: Symfony\Component\Ldap\Ldap
base_dn: 'DC=maxcrc,DC=com'
search_dn: 'CN=manager,DC=maxcrc,DC=com'
search_password: 'secret'
default_roles: ROLE_USER
uid_key: 'samaccountname'
Apart from that, I have these settings:
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
anonymous: ~
form_login_ldap:
service: Symfony\Component\Ldap\Ldap
login_path: login
check_path: login
dn_string: '%env(ADLDAP_BASEDN)%'
query_string: '(samaccountname={username})'
logout:
path: /logout
target: login
Relevant would be the dn_string and the query_string. Not sure if all that is nessecary, this is my first time using symfony.
ADLDAP_BASEDN is defined in my .env file as:
ADLDAP_BASEDN=DC=blah,DC=example,DC=com
edit
Sorry, I misread your question, somehow I thought you authenticate against an Active Directory. With openldap the uid key should be uid, which is most probably the default. But your dn_string looks wrong to me, and maybe query_string is needed as well. I'll edit the answer accordingly tomorrow when I'm not on my phone.

Symfony 4 + API Plantform +LexikJWTAuthenticationBundle Bad Credential

Good afternoon. Please i'm using LexikJWTAuthenticationBundle in a symfony 4 api project. I'm using UserProvider for Doctrine.
After Configure Doctrine User Provider, I've install and configure LexikJWTAuthenticationBundle. But when i tried to athentificate using Postman on the url http://localhost:8000/api/login_check whith this JSON {"username":"ak",
"password":"ak"} I've this error: {
"code": 401,
"message": "Bad credentials"
}.
See below my Security.yaml config file. I've read forums to tried to solve this issue but i've not yet found the solution. Can you please help me?
security:
encoders:
App\Entity\Utilisateur:
algorithm: bcrypt
providers:
#in_memory: { memory: ~ }
our_db_provider:
entity:
class: App\Entity\Utilisateur
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
login:
pattern: ^/api/login
stateless: true
anonymous: true
json_login:
check_path: /api/login_check
success_handler: lexik_jwt_authentication.handler.authentication_success
failure_handler: lexik_jwt_authentication.handler.authentication_failure
api:
pattern: ^/api
stateless: true
guard:
authenticators:
- lexik_jwt_authentication.jwt_token_authenticator
main:
pattern: ^/
user_checker: App\Security\UtilisateurChecker
anonymous: true
provider: our_db_provider
access_control:
- { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/api, roles: IS_AUTHENTICATED_FULLY }
Have you missed a piece of configuration during installation? I dont see the lexik one:
lexik_jwt_authentication:
secret_key: '%kernel.project_dir%/config/jwt/private.pem' # required for token creation
public_key: '%kernel.project_dir%/config/jwt/public.pem' # required for token verification
pass_phrase: 'your_secret_passphrase' # required for token creation, usage of an environment variable is recommended
token_ttl: 3600
Good morning All. I've found the solution of my problem. In fact, i was typing a bad User Password.
To solve this article, i've used this article https://numa-bord.com/miniblog/symfony-4-les-base-dune-gestion-des-utilisateurs-inscription-connexion-droits-dacces/
I've created au database user by using create user command implemented in the article.
After i have been connected with this previous created user sucessfully. ApiPlatform generate a web tocken for me.
Thank you very much

Symfony access_control not applied 'per-host' rule

Morning folks,
mainly i want to secure all call against a url that starts with /api/internal.
All endpoints that start with this path are only for internal calls, e.g. in a ajax-search box. So right me when i am wrong but i thought it would be a good idea to secure this via host definition in access_roles
I tried it with the following security.yml
security:
role_hierarchy:
ROLE_myproject_USER: ROLE_USER
ROLE_TEAMMANAGER: ROLE_USER
ROLE_ADMIN: [ROLE_TEAMMANAGER]
providers:
dashboard_users:
ldap:
service: myproject.ldap
# my ldap config
custom_user_provider:
id: myproject.factory.scale_user
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
api_internal:
pattern: ^/api/internal
security: true
host: myproject.dev
api_doc:
pattern: ^/api/doc
security: false
api_login:
pattern: ^/api/login
stateless: true
anonymous: true
api:
pattern: ^/api
stateless: true
provider: custom_user_provider
guard:
authenticators:
- myproject.api_login_authenticator
main:
anonymous: ~
form_login_ldap:
login_path: myproject_login
check_path: myproject_login
service: myproject.ldap
dn_string: 'Verbund\{username}'
logout:
path: myproject_logout
target: /
access_control:
- { path: ^/api/internal, host: myproject.dev }
But i get this error:
InvalidConfigurationException in SecurityExtension.php line 481:
No authentication listener registered for firewall "api_internal".
Side information: In this project there a 3 different sections:
/api/internal/**** - should only be accessible from the website itself
/api/ - should be accessible via REST, is secured via JWTToken
the Website itself - is secured via form login and LDAP
Thankful for any help you can provide.
Max
In order to have hosts secured, use access_control
access_control:
# require ROLE_ADMIN for /admin*
- { path: ^/admin, roles: ROLE_ADMIN }
where the path is your desired host.
In order to have everything for a subhost secured use
- { path: ^/admin/*, roles: ROLE_ADMIN }
remove other firewalls than main and dev!
Please refer to http://symfony.com/doc/2.8/security.html for more information

The security context contains no authentication token ESI and Symfony2

I'm using ESI (Edge Side Includes) to speed up my page but every time that I want to check if the user is loged in or not I get this error:
AuthenticationCredentialsNotFoundException: The security context contains no authentication token. One possible reason may be that
there is no firewall configured for this URL.
In my config.yml file I have this:
**esi: true<br>
fragments: { path: /_proxy }<br>
trusted_proxies: [127.0.0.1]**
Does someone knows how to solve it? I already tried to set a firewall for the /_proxy urls but I think that this is not the solution.
These are my firewalls:
main:
pattern: ^/
form_login:
check_path: /user/login_check
login_path: /user/login
provider: chain_provider
failure_path: null
logout:
path: /user/logout
target: /
success_handler: logout_success_handler
invalidate_session: true
anonymous: ~
security: true
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
Thanks

Resources