Ldaprecord-laravel: permission management based on AD Groups

[jagDanJu]

• Laravel Version: #.#
• PHP Version: #.#
• LDAP Type: ActiveDirectory

Description:

Hey @stevebauman,
it would be cool if there is a simple way to manage group-based permissions

I'm mainly thinking about blade and routes

Steps To Reproduce:

[stevebauman]

Hi @jagDanJu, that's a great idea, but would definitely be difficult to implement.

If someone is using database synchronization, then they would have to synchronize their users group's with their local database.

If someone is using plain LDAP authentication, then we would have to assume they have some sort of groups() relationship method on their LdapRecord model to check if they are indeed a member.

What are your thoughts on implementation? Maybe I'm thinking too in-depth about its complications...

[stevebauman]

To elaborate on this, what I have done in the past is listen for the event:

LdapRecord\Laravel\Events\Authenticated

Then check for group existence and add / sync the database groups / permissions:

public function handle(Authenticated $event)
{
    $group = Group::find('cn=Help Desk Admins,ou=Groups,dc=local,dc=com');

    // Check if the LDAP user is a member of the group.
    if ($group && $event->user->groups()->exists($group)) {
        // Add role using spatie's permission package.
        $event->model->assignRole('administrator');
    }
}

[stevebauman]

Closing this - I'll be adding a tutorial on the documentation site for instructions on synchronizing groups when database synchronization is in use.

Anyone using plain LDAP authentication can utilize Laravel's gate's and call groups()->exists() on their LdapRecord user model during the authorization call to see if they are able to perform an action.

[Pixy123]

Hi, I have same issue...You have added tutorial documentation? I can't find. Thank you

[stevebauman]

Hi @Pixy123, no I haven't added the tutorial yet - but the above example will definitely get you started if you're using spatie laravel-permission package.

The issue with a tutorial is that it will have to be specific to a single package - as there's so many authorization packages out for Laravel.

Listening for the LdapRecord\Laravel\Events\Authenticated event is a great place to sync permissions and groups, because you have both your LDAP user model and your Eloquent user model available to you.

However be sure to save() your Eloquent user model if it doesn't exist yet in the listener first before attaching roles / permissions, as users logging into your application for the first time will not yet exist in your database.

I'll be working on a tutorial over the next couple days though and will comment here once complete.

[szabocsabakmet]

Hey @stevebauman !
I'm facing the same problem, that I am not able to implement Spatie's permissions package. In the first place I'm trying to make it work without database sync but it seems like it's impossible. If I cant find the solution today, then I will start to implement database sync functionality tomorrow.

By the way, I just want to have user credentials from LDAP, the Roles and Permissions will be based on the laravel app. The main problem is, that unfortunately I couldn't make any relationships work with the LDAP User model. It would be nice to find a solution. Sure, database sync is one, because after it, you have eloquent. I'm just always scared of redundant data.

But if in the future you would make this tutorial, then I would be pleased if you tag me here, so I get a notification.

Thanks in advice, Csaba

[stevebauman]

Hey @szabocsabakmet,

By the way, I just want to have user credentials from LDAP, the Roles and Permissions will be based on the laravel app. The main problem is, that unfortunately I couldn't make any relationships work with the LDAP User model. It would be nice to find a solution. Sure, database sync is one, because after it, you have eloquent. I'm just always scared of redundant data.

This would definitely be difficult to do without using Database Synchronization - but I believe it's possible.

If I had some sponsorships (😉) I'd create a Spatie permissions integration package, along with documentation. But seeing as I don't personally use this package in any of my projects, I honestly can't justify the time working on it.

[szabocsabakmet]

@stevebauman

I'm sorry, but this project doesen't have the resources for something like that. So now i will go on with the database synchronization. Maybe in the future with an other project where I need the same functionality.

Thanks for the response, Csaba