jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Fix LDAP with internal users (#4453)

Browse Source 
* added logging, in case Laminas libs are not available
* make sure that internal users can still login if LDAP is activated
This commit is contained in:
Kevin Papst
2023-11-20 21:33:36 +01:00
committed by GitHub
parent 20164295f8
commit 16d4a691f8
4 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/Constants.php
View File

@@ -17,11 +17,11 @@ class Constants
/** /**
* The current release version * The current release version
*/ */
public const VERSION = '2.4.0'; public const VERSION = '2.4.1';
/** /**
* The current release: major * 10000 + minor * 100 + patch * The current release: major * 10000 + minor * 100 + patch
*/ */
public const VERSION_ID = 20400; public const VERSION_ID = 20401;
/** /**
* The software name * The software name
*/ */

2
src/Ldap/FormLoginLdapFactory.php
View File

@@ -10,6 +10,7 @@
namespace App\Ldap; namespace App\Ldap;
use App\Configuration\LdapConfiguration; use App\Configuration\LdapConfiguration;
use Psr\Log\LoggerInterface;
use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AbstractFactory; use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AbstractFactory;
use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AuthenticatorFactoryInterface; use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AuthenticatorFactoryInterface;
use Symfony\Component\DependencyInjection\ChildDefinition; use Symfony\Component\DependencyInjection\ChildDefinition;
@@ -67,6 +68,7 @@ final class FormLoginLdapFactory extends AbstractFactory implements Authenticato
->setArguments([ ->setArguments([
new Reference($authenticatorId), new Reference($authenticatorId),
new Reference(LdapConfiguration::class), new Reference(LdapConfiguration::class),
new Reference(LoggerInterface::class),
]); ]);
return $ldapAuthenticatorId; return $ldapAuthenticatorId;

9
src/Ldap/LdapAuthenticator.php
View File

@@ -10,6 +10,7 @@
namespace App\Ldap; namespace App\Ldap;
use App\Configuration\LdapConfiguration; use App\Configuration\LdapConfiguration;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response; use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
@@ -22,17 +23,19 @@ use Symfony\Component\Security\Http\EntryPoint\Exception\NotAnEntryPointExceptio
final class LdapAuthenticator implements AuthenticationEntryPointInterface, InteractiveAuthenticatorInterface final class LdapAuthenticator implements AuthenticationEntryPointInterface, InteractiveAuthenticatorInterface
{ {
public function __construct(private AuthenticatorInterface $authenticator, private LdapConfiguration $configuration) public function __construct(private AuthenticatorInterface $authenticator, private LdapConfiguration $configuration, private LoggerInterface $logger)
{ {
} }
public function supports(Request $request): bool public function supports(Request $request): bool
{ {
if (!class_exists('Laminas\Ldap\Ldap')) { if (!$this->configuration->isActivated()) {
return false; return false;
} }
if (!$this->configuration->isActivated()) { if (!class_exists('Laminas\Ldap\Ldap')) {
$this->logger->debug('Failed loading LDAP authenticator, missing Laminas dependency');
return false; return false;
} }

10
src/Ldap/LdapCredentialsSubscriber.php
View File

@@ -62,12 +62,12 @@ final class LdapCredentialsSubscriber implements EventSubscriberInterface
throw new BadCredentialsException('The presented user needs to be a Kimai user.'); throw new BadCredentialsException('The presented user needs to be a Kimai user.');
} }
// removing this code allows to upgrade from local to LDAP users
// if (!$user->isLdapUser()) {
// return;
// }
if (!$this->ldapManager->bind($user->getUserIdentifier(), $presentedPassword)) { if (!$this->ldapManager->bind($user->getUserIdentifier(), $presentedPassword)) {
// if the login failed and the user is registered with "kimai" auth, simply return:
// the FormLogin authenticator will take over and the user can log in via internal database
if (!$user->isLdapUser()) {
return;
}
throw new BadCredentialsException('The presented password is invalid.'); throw new BadCredentialsException('The presented password is invalid.');
} }