Ldaprecord-laravel: userIsApartOfDomain() breaks WindowsAuthenticate

[siegherr]

I'm no AD pro. So sorry for the sloppy explanation.
In our domain, we log on like this: "dnt1username"
Now, if i try and use the WindowsAuthenticate middleware the userIsApartOfDomain() method can never return true, because there is no "dnt1" in the distinguished name.
I have been told the "dnt1" is a leftover from when ActiveDirectory was pretty new and we can not get rid of it.

Expected behavior
I created a workaround by creating a middleware WindowsAuthenticateFix and overrode the userIsApartOfDomain() method as followed:

namespace App\Http\Middleware;

use LdapRecord\Laravel\Middleware\WindowsAuthenticate;

class WindowsAuthenticateFix extends WindowsAuthenticate
{
    protected function userIsApartOfDomain(\LdapRecord\Models\Model $user, $domain)
    {
        return true;
    }
}

Maybe you could add a switch to the config/ldap.php which disables this check.

Environment:

• LDAP Server Type: ActiveDirectory
• PHP Version: 7.2

[stevebauman]

Hi @siegherr,

It seems like you've already resolved this in a way that I was going to suggest - creating your own middleware and overriding the method. I want to avoid adding this into the configuration. I don't think it belongs there.

I also don't want to allow an easy disablement of this check, as anyone using multi-domain authentication may have two users with the same sAMAccountName in both domains, which would be a security issue, as they would be automatically logged into the Laravel application underneath a user they may not actually be. I hope I'm making sense here!

That's very strange that the domain name is not inside your users distinguished name - I've never seen an environment like this. It sounds like there were two domains in your forest at one point (with a two-way trust) and they phased out the the old domain?

I'm closing this as I don't think this is a bug or an issue - it's an environment difference that is unique to your particular circumstances. What I will do is add this into the documentation as a work-around in case someone else encounters this and requires it to be modified.

[siegherr]

Hi @stevebauman,
thanks for your quick reply and sorry if did not report this issue correctly.
I just asked a colleague and he said the domain name was chosen, without really thinking about it. Some time after that, we had to rename our DNS Domain Name because the domain had to be accessible from the internet. At this point we couldn't rename the NetBIOS Domain Name, because the exchange server wouldn't allow us to do so and creating a new forest would have been to much work. Hope I explained it correctly.

I understand, this is not really a bug. Mentioning it in the docs sounds perfect.

[stevebauman]

You're totally fine @siegherr, I really appreciate your input and the report! :smile:

I've added this into the docs with an explanation and work-around. I also appreciate your quick-response and your migration of the original issue to this repo (LdapRecord-Laravel).

While I have you, I was wondering if you had any feedback on the current state of the documentation as well as features? Is there anything missing and / or features you'd like to see in a future release?

[siegherr]

@stevebauman At the moment I'm really pleased by LdapRecord. So thanks for your work ❤️

One feature that would be usefull for me would be some kind of wizard to kickstart a project.
You fire an artisan command like "ldap:quick-setup", then get asked for _ldap hosts, base bn, ..._ and it configures stuff like _config/ldap.php, guards and providers in config/auth.php, maybe adds WindowsAuthentication to the Kernel.php ..._
Since I nearly alwas need Laravel + LdapRecord-Laravel (earlier AdLdap-Laravel) for in-house projects this would really be a nice to have. But I can just speak for myself. Dunno how many would really want such a feature.

Regarding the docs, I think they are really straight forward. I like them 😃
So keep up the work 😄

I'll let you know if I something comes to my head.

[stevebauman]

Thanks for your kind words @siegherr! :heart:

Appreciate your feedback - let me see what I can whip together to make setup more streamlined and easier when starting a fresh project :smile:

[stevebauman]

Hi @siegherr, I remembered that you ran into this issue and it was reported again here in this pull-request:

https://github.com/DirectoryTree/LdapRecord-Laravel/pull/93

I have since added a feature to disable domain verification with a static method call without having to extend the middleware. Here are the new docs:

https://ldaprecord.com/docs/laravel/auth/usage/#sso-domain-verification

I hope it's useful to you! :heart: