Fix LDAP with internal users (#4453)

* added logging, in case Laminas libs are not available
* make sure that internal users can still login if LDAP is activated

src/Constants.php

@@ -17,11 +17,11 @@ class Constants
     /**
      * The current release version
      */
-    public const VERSION = '2.4.0';
+    public const VERSION = '2.4.1';
     /**
      * The current release: major * 10000 + minor * 100 + patch
      */
-    public const VERSION_ID = 20400;
+    public const VERSION_ID = 20401;
     /**
      * The software name
      */

src/Ldap/FormLoginLdapFactory.php

@@ -10,6 +10,7 @@
 namespace App\Ldap;
 
 use App\Configuration\LdapConfiguration;
+use Psr\Log\LoggerInterface;
 use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AbstractFactory;
 use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AuthenticatorFactoryInterface;
 use Symfony\Component\DependencyInjection\ChildDefinition;
@@ -67,6 +68,7 @@ final class FormLoginLdapFactory extends AbstractFactory implements Authenticato
             ->setArguments([
                 new Reference($authenticatorId),
                 new Reference(LdapConfiguration::class),
+                new Reference(LoggerInterface::class),
             ]);
 
         return $ldapAuthenticatorId;

src/Ldap/LdapAuthenticator.php

@@ -10,6 +10,7 @@
 namespace App\Ldap;
 
 use App\Configuration\LdapConfiguration;
+use Psr\Log\LoggerInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
@@ -22,17 +23,19 @@ use Symfony\Component\Security\Http\EntryPoint\Exception\NotAnEntryPointExceptio
 
 final class LdapAuthenticator implements AuthenticationEntryPointInterface, InteractiveAuthenticatorInterface
 {
-    public function __construct(private AuthenticatorInterface $authenticator, private LdapConfiguration $configuration)
+    public function __construct(private AuthenticatorInterface $authenticator, private LdapConfiguration $configuration, private LoggerInterface $logger)
     {
     }
 
     public function supports(Request $request): bool
     {
-        if (!class_exists('Laminas\Ldap\Ldap')) {
+        if (!$this->configuration->isActivated()) {
             return false;
         }
 
-        if (!$this->configuration->isActivated()) {
+        if (!class_exists('Laminas\Ldap\Ldap')) {
+            $this->logger->debug('Failed loading LDAP authenticator, missing Laminas dependency');
+
             return false;
         }
 

src/Ldap/LdapCredentialsSubscriber.php

@@ -62,12 +62,12 @@ final class LdapCredentialsSubscriber implements EventSubscriberInterface
             throw new BadCredentialsException('The presented user needs to be a Kimai user.');
         }
 
-        // removing this code allows to upgrade from local to LDAP users
-        // if (!$user->isLdapUser()) {
-        //    return;
-        // }
-
         if (!$this->ldapManager->bind($user->getUserIdentifier(), $presentedPassword)) {
+            // if the login failed and the user is registered with "kimai" auth, simply return:
+            // the FormLogin authenticator will take over and the user can log in via internal database
+            if (!$user->isLdapUser()) {
+                return;
+            }
             throw new BadCredentialsException('The presented password is invalid.');
         }