LDAP adaption to retrieve DN instead of current method #10996
Description
Snipe-IT Version
5.4.3
Operating System
Debian
Web Server
Apache
PHP Version
7.4.29
Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
Ldap does not work if you have multiple ou's instead of only one, for example, two different departments.
Describe the solution you'd like A clear and concise description of what you want to happen.
Something akin to this where the username is resolved to a DN by binding to the admin account and pulling the account that way.
public function ldapLogin(string $username, string $password): User
{
if ($this->ldapSettings['ad_append_domain']) { //if you're using 'userprincipalname', don't check the ad_append_domain checkbox
$connection = Ldap::connectToLdap();
Ldap::bindAdminToLdap($connection);
$search = ldap_search($connection, $this->ldapConfig['base_dn'], "(". Setting::getSettings()->ldap_username_field. "=$username)");
$user = ldap_get_entries($connection, $search);
if($user["count"] == 1){
$login_username = $user[0]["dn"];
}
if(ldap_bind($connection, $login_username, $password)){
throw new Exception('other shit is broken!');
}
//$login_username = $username . '@' . $this->ldapSettings['ad_domain']; // I feel like could can be solved with the 'suffix' feature? Then this would be easier.
} else {
$login_username = $username;
}
if ($this->ldapConfig['username'] && $this->ldapConfig['password']) {
$bind_as_user = false;
} else {
$bind_as_user = true;
}
if (($this->ldap) && ($this->ldap->auth()->attempt($login_username, $password, $bind_as_user) === false)) {
throw new Exception('Unable to validate user credentials!');
}
Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.
No response
Additional context Add any other context or screenshots about the feature request here.
No response