riper/security-active_directory

This is a bundle to allow authentication into symfony >= 2.6 by an Active directory

v2.0.0 2016-04-13 07:59 UTC

Requires

• php: >=5.3.0
• adldap2/adldap2: ~4.0

Conflicts

• symfony/symfony: <2.6

CC-BY-4.0

• Loïc Doubinine

• symfony
• bundle
• ldap
• active directory

README

This package is a bundle for Symfony. It uses the standard form_login security model to authenticate user from an Active Directory domain. It uses LDAP as communication layer, so you need the LDAP extension installed on your server to make it work.

Requirements

php 5.3.0

php_ldap

ssl configuration for LDAP. see http://adldap.sourceforge.net/wiki/doku.php?id=ldap_over_ssl

Compatible with Symfony starting from 2.6

Installation

You need to add a package to your dependency list :

// composer.json
"riper/security-active_directory": "2.*"

You need to enable the bundle into your kernel

// app/AppKernel.php
new Riper\Security\ActiveDirectoryBundle\RiperActiveDirectoryBundle(),

You need to configure your domain specific information

// app/config/config.yml or app/config/parameters.yml
parameters:
    riper.security.active_directory.settings:
        account_suffix : riper.fr # without the @ at the beginning
        base_dn : DC=RIPER,DC=FR #The DN of the domain
        domain_controllers : [ baudrive.kim.riper.fr ] #Servers to use for ldap connection (Random)
        admin_username: #Null to use the userConnection
        admin_password: #Null to use the userConnection
        keep_password_in_token: false #Set to true if you want to re-use the adldap instance to make further queries (This is a security issue because the password is kept in session)
        real_primarygroup : true #For Linux compatibility.
        use_ssl : false #Set it true need configuration of the server to be useful
        use_tls : false #Set it true need configuration of the server to be useful
        recursive_grouproles: false #recursive group roles
        username_validation_pattern: /^[a-z0-9-.]+$/i #Regex that check the final username value (extracted from patterns below). Must be compliant with your Active Directory username policy.
        username_patterns: #username is extracted from the string the user put into the login form
          - /([^@]*)@riper.fr/i  # like [e-mail]
          - /RIPER\\(.*)/i #like RIPER\toto
          - /RIPER.FR\\(.*)/i #like RIEPER.FR\toto
          - /(.*)/i #like toto

You need to add security parameters

// app/config/security.yml
encoders:
    Riper\Security\ActiveDirectoryBundle\Security\User\AdUser : plaintext #Active directory does not support encrypted password yet

providers:
    my_active_directory_provider :
          id: riper.security.active.directory.user.provider

firewalls:
    secured_area:
        active_directory: #Replace the 'form_login' line with this
                check_path: /demo/secured/login_check
                login_path: /demo/secured/login

Useful information

Roles are got from Active directory. The name is transformed to match the ROLE system of Symfony2

Domain User => ROLE_DOMAIN_USER
Administrators => ROLE_ADMINISTRATORS

Nested Groups are not supported yet. Enabling the option wont affect the Role check.

SSL part of the lib isn't used yet and haven't been tested with Symfony