Developed with love by KnpLabs Hire us for your project!
26

Security-ActiveDirectoryBundle

by RiperFr

This is a bundle to allow authentication into symfony >=2.1 by an Active directory

Riper/Security/ActiveDirectory

This package is a bundle for Symfony. It uses the standard form_login security model to authenticate user from an Active Directory domain.
It uses LDAP as communication layer, so you need the LDAP extension installed on your server to make it work.

Scrutinizer Code Quality
License CC-BY-4
php version
symfony version

SensioLabsInsight

Requirements

php 5.3.0

php_ldap

ssl configuration for LDAP. see http://adldap.sourceforge.net/wiki/doku.php?id=ldap_over_ssl

Compatible with Symfony starting from 2.6

Installation

You need to add a package to your dependency list :

// composer.json
"riper/security-active_directory": "2.*"

You need to enable the bundle into your kernel

// app/AppKernel.php
new Riper\Security\ActiveDirectoryBundle\RiperActiveDirectoryBundle(),

You need to configure your domain specific information

// app/config/config.yml or app/config/parameters.yml
parameters:
    riper.security.active_directory.settings:
        account_suffix : riper.fr # without the @ at the beginning
        base_dn : DC=RIPER,DC=FR #The DN of the domain
        domain_controllers : [ baudrive.kim.riper.fr ] #Servers to use for ldap connection (Random)
        admin_username: #Null to use the userConnection
        admin_password: #Null to use the userConnection
        keep_password_in_token: false #Set to true if you want to re-use the adldap instance to make further queries (This is a security issue because the password is kept in session)
        real_primarygroup : true #For Linux compatibility.
        use_ssl : false #Set it true need configuration of the server to be useful
        use_tls : false #Set it true need configuration of the server to be useful
        recursive_grouproles: false #recursive group roles
        username_validation_pattern: /^[a-z0-9-.]+$/i #Regex that check the final username value (extracted from patterns below). Must be compliant with your Active Directory username policy.
        username_patterns: #username is extracted from the string the user put into the login form
          - /([^@]*)@riper.fr/i  # like toto@riper.fr
          - /RIPER\\(.*)/i #like RIPER\toto
          - /RIPER.FR\\(.*)/i #like RIEPER.FR\toto
          - /(.*)/i #like toto

You need to add security parameters

// app/config/security.yml
encoders:
    Riper\Security\ActiveDirectoryBundle\Security\User\AdUser : plaintext #Active directory does not support encrypted password yet

providers:
    my_active_directory_provider :
          id: riper.security.active.directory.user.provider

firewalls:
    secured_area:
        active_directory: #Replace the 'form_login' line with this
                check_path: /demo/secured/login_check
                login_path: /demo/secured/login

Useful information

Roles are got from Active directory. The name is transformed to match the ROLE system of Symfony2

Domain User => ROLE_DOMAIN_USER
Administrators => ROLE_ADMINISTRATORS

Nested Groups are not supported yet. Enabling the option wont affect the Role check.

SSL part of the lib isn't used yet and haven't been tested with Symfony

  • Merge pull request #24 from RiperFr/Finalize2.0.0
    By ztec, 4 years ago
  • Finalise requirement of Symfony 2.6
    By ztec, 4 years ago
  • Merge pull request #22 from Deamon/feat-change-security-service
    By ztec, 4 years ago
  • update README to the new minimal version 2.6
    By Deamon, 4 years ago
  • change refs to security.context to security.token_storage
    By Deamon, 4 years ago
  • Cleanup for medals, because it does mater :-)
    By ztec, 4 years ago
  • Use a valid SPDX license identifier to make composer happy
    By ztec, 4 years ago
  • Force usage of Symfony >=2.6
    By ztec, 4 years ago
  • Make the documentation sync with the version to use
    By ztec, 4 years ago
  • Merge pull request #20 from Deamon/v1.x
    By ztec, 4 years ago
  • Add quotes forgotten in previous commit
    By Deamon, 4 years ago
  • add quotes surrounding services and parameters string in yaml config
    By Deamon, 4 years ago
  • Merge pull request #18 from xelan/patch-1
    By ztec, 4 years ago
  • Fix package name in readme
    By xelan, 4 years ago
  • remove IDE folder
    By ztec, 5 years ago
  • Add new expetion for ADConnexion issue
    By ztec, 5 years ago
  • feat: Add faultyToken in order to be able to re-use token credential because AD cannot keep authentication token
    By ztec, 5 years ago
  • Change vendor and package name
    By ztec, 5 years ago
  • improve code style and add documentation
    By xelan, 5 years ago
  • remove redundant documentation
    By xelan, 5 years ago
  • german translations
    By xelan, 5 years ago
  • rename adUser to AdUser and adUserProvider to AdUserProvider
    By xelan, 5 years ago
  • remove class parameters as this practice is not recommended any more
    By xelan, 5 years ago
  • use the Adldap2 4.x branch instead of adldap/adldap
    By xelan, 5 years ago
  • feat: Add possibility to override the token class
    By ztec, 5 years ago
  • Merge pull request #13 from pborreli/patch-1
    By ztec, 6 years ago
  • Fixed typo
    By pborreli, 6 years ago
  • Merge pull request #10 from akcoder/master
    By ztec, 6 years ago
  • Retrieve the displayName and mail LDAP attributes and store them on the adUser object.
    By akcoder, 6 years ago
  • Merge pull request #9 from akcoder/master
    By ztec, 6 years ago