Ldaprecord-laravel: [Question] Why is LdapRecord connecting to Active Directory on every Request?

[HepplerDotNet]

Why does LdapRecord connect to Active Directory on every request, even if there are no ldap actions performed?

[stevebauman]

Hi @HepplerDotNet!

I'll have to know much more about your environment to answer that question.

This depends on how you've integrated LdapRecord-Laravel authentication, if you're using LdapRecord model binding, and if you're accessing it in a way that could be unintentional.

When exactly are you seeing connections on every request? Are you using the plain authentication driver?

[HepplerDotNet]

@stevebauman forget it. My fault. One of my Policies checks if the user is in a specific group, which causes a connect.

[stevebauman]

No problem! Thanks for the quick update and for posting what you found!

[CmdrSharp]

@stevebauman Sorry to piggyback on this - but out of curiosity - is it a good idea to find a way to maybe cache group memberships upon authentication?

I am imagining a lot of use cases where authentication is part 1 - and checking group memberships to control access via middlewares is the next step. Having to constantly run new calls to the AD for this seems wasteful.

[stevebauman]

Hi @CmdrSharp! No worries at all. There's a couple ways I've accomplished this in the past. Each have trade-offs:

1. Synchronize local web application roles and permissions:

Create roles and permissions in your application, and then synchronize these roles/permissions onto the users local database record depending on group memberships in your LDAP server.

You could do this upon user login, or when you import users via the ldap:import command.

The trade-off here being -- users who have a permissible group removed from their Active Directory account won't take effect in your web application until they log out and log back in (or, whenever the last ldap:import is run).

You could combo both of these options as well, which may be a good strategy (i.e. run the ldap:import command on a scheduled basis to synchronize the roles/permissions, as well as during login so your web application can react to the potential role/permission changes). This could limit potential security issues for the application.

2. Cache the group memberships result:

You can utilize LdapRecord's built in query caching to to cache a result of an expensive LDAP search. For example:

$user = User::find('cn=John Doe,dc=local,dc=com');

$until = new \DateTime('tomorrow');

$groups = $user->groups()->recursive()->cache($until)->get();

Or; you can utilize Laravel's cache system and then bust the cache your own way:

$user = User::find('cn=John Doe,dc=local,dc=com');

$cacheKey = $user->getObjectGuid();

$groups = Cache::rememberForever($cacheKey, function () use ($user) {
    return $user->groups()->recursive()->get();
});

The trade-off here being -- you have to flush these caches in one way or another, and be always be aware of flushing them in your application.

---

These two options are the ones I reach for, depending on the application.

I really hope this helps -- please let me know if you have any additional questions!

[CmdrSharp]

Sorry for being so slow to respond @stevebauman - thanks for a very detailed reply! Solved my issue! :)

[stevebauman]

No problem @CmdrSharp! That’s great! Glad you’re up and running 😄