App\/Controller\/AppController.php<\/strong>\u00c2\u00a0you need a minimal of the following<\/p>\n[php]
\n<?php
\nclass AppController extends Controller {
\n var $components = array(‘Auth’, ‘Session’, ‘RequestHandler’);<\/p>\n
var $user;<\/p>\n
function beforeFilter(){
\n global $menus;
\n $this->Auth->authenticate = array(‘Idbroker.Ldap’=>array(‘userModel’=>’Idbroker.LdapAuth’));
\n \/\/If you want to do your authorization from the isAuthorized Controller use the following
\n $this->Auth->authorize = array(‘Controller’);
\n }<\/p>\n
\/*
\n * This just says aslong as this is a valid user let them in, you can also modify this to restrict to a group
\n *\/
\n public function isAuthorized(){
\n $user = $this->Auth->user();
\n if($user) return true;
\n return false;
\n }
\n}
\n[\/php]<\/p>\n
Notice:<\/strong>That in the components you define the Auth component. This is making all your controllers register the authentication component. In the beforeFilter you are specifically stating you want to use the Idbroker’s Ldap Auth. Then you’re also telling your app to use the prepackaged model for the LDAP component.<\/p>\nThe next step is to configure your Users controller and your views.<\/p>\n
In your \/App\/Controller\/UsersController.php<\/strong><\/p>\n[php]
\n<?php
\nclass UsersController extends AppController {
\n var $name = ‘Users’;<\/p>\n
\/*
\n * Make sure to define which functions don’t require auth to be accessed
\n *\/
\n function beforeFilter(){
\n $this->Auth->allow(‘usernameExists’, ‘forgotPassword’, ‘signup’,’login’,’logout’);
\n parent::beforeFilter();
\n }<\/p>\n
function login(){
\n if ($this->request->is(‘post’)) {
\n if ($this->Auth->login()) {
\n return $this->redirect($this->Auth->redirect());
\n } else {
\n $this->Session->setFlash(__(‘Username or password is incorrect’), ‘default’, array(‘class’=>’error-message’), ‘auth’);
\n }
\n }
\n }<\/p>\n
function logout(){
\n $this->log("Destroying session",’debug’);
\n $this->Session->destroy();
\n $this->redirect($this->Auth->logout());
\n }
\n}
\n[\/php]<\/p>\n
You’ll notice compared to previous version of the authcomponent you used to just have the Auth component automatically do the auth, now you actually call $this->Auth->login()<\/strong> to get it to actually check the username and password and run the login logic.<\/p>\nWe’re not done yet, we also need to create our view \/App\/View\/Users\/login.ctp<\/strong><\/p>\n[php]
\n<div id=’loginForm’>
\n<?php
\n echo $this->Session->flash(‘auth’);
\n echo $this->Form->create(‘Users’, array(‘action’ => ‘login’));
\n echo $this->Form->input(‘username’);
\n echo $this->Form->input(‘password’,array(‘value’=>”));
\n echo $this->Form->input(‘remember’,array(‘type’ => ‘checkbox’, ‘label’ => ‘Remember me’));
\n echo $this->Form->submit(‘Login’);
\n?>
\n<\/div>
\n[\/php]<\/p>\n
Last piece to tie this all together is telling your application how to access your LDAP server. Add something like this to youyr \/App\/Config\/database.php<\/strong><\/p>\n[php]
\n<?php
\nclass DATABASE_CONFIG {
\n public $ldap = array (
\n ‘datasource’ => ‘Idbroker.LdapSource’,
\n ‘host’ => ‘localhost’,
\n ‘port’ => 389,
\n ‘basedn’ => ‘DC=example,DC=com’,
\n ‘login’ => ‘CN=Manager,DC=example,DC=com’, \/\/For Proxy Userdn
\n ‘password’ => ‘LdapPassword’, \/\/For Proxy UserDN password
\n ‘database’ => ”,
\n ‘tls’ => false,
\n ‘type’ => ‘OpenLDAP’, \/\/Available types are ‘OpenLDAP’, ‘ActiveDirectory’, ‘Netscape’
\n ‘version’ => 3
\n );
\n}
\n[\/php]<\/p>\n
And in your \/App\/Config\/bootstrap.php<\/strong> add the following to the very bottom<\/p>\n[php]
\nCakePlugin::load(‘Idbroker’);
\nConfigure::load(‘ldap’);
\n[\/php]<\/p>\n
These two lines tell your app to first load the Idbroker plugin and then load the ldap config file which you will create next.<\/p>\n
Then create an ldap config file \/App\/Config\/ldap.php<\/strong> with the following. This config file will configure how Ldap is used through out your app. <\/p>\n[php]
\n\/**
\n * LDAP Settings
\n *
\n *\/
\n $config[‘LDAP’][‘Db’][‘Config’] = ‘ldap’; \/\/What is the name of the db config that has the LDAP credentials
\n $config[‘LDAP’][‘User’][‘Identifier’] = ‘uid’; \/\/What is the LDAP attribute that identifies the username attribute,
\n \/\/ openldap, iplant, netscapr use uid, AD uses samaccountname
\n $config[‘LDAP’][‘Group’][‘Identifier’] = ‘cn’; \/\/What is the LDAP attribute that identifies the group name, usually cn
\n $config[‘LDAP’][‘Model’] = ‘Idbroker.LdapAuth’; \/\/Default model to use for LDAP components
\n $config[‘LDAP’][‘LdapAuth’][‘Model’] = ‘Idbroker.LdapAuth’;
\n $config[‘LDAP’][‘LdapAuth’][‘MirrorSQL’][‘Users’] = ‘User’; \/\/A SQL table to duplicate ldap records in for user
\n $config[‘LDAP’][‘LdapAuth’][‘MirrorSQL’][‘Groups’] = ‘Group’; \/\/A SQL table to duplicate LDAP records in for groups
\n $config[‘LDAP’][‘LdapACL’][‘Model’] = ‘Idbroker.LdapAcl’;
\n $config[‘LDAP’][‘LdapACL’][‘groupType’] = ‘group’;
\n $config[‘LDAP’][‘groupType’] = ‘groupofuniquenames’; \/\/What object class do you use for your groups?
\n $config[‘LDAP’][‘Group’][‘behavior’][‘tree’][‘parent_id’] = ’49db8df1-5e74-4e91-b15f-4d33e927f14e’; \/\/Are you using a tree behavior? Need to set the default parent_id?
\n[\/php]<\/p>\n
That last part was a lot, not all of that is needed. Really just the first line is $config[‘LDAP’][‘Db’][‘Config’] = ‘ldap’;<\/strong> – this part tells your application which database config to use for LDAP. The other config options are for new extended features that I will explain below.<\/p>\nWhen creating this plugin I made use of the new extended features to allow you to use the HTTP basic authentication. In this method you can actually pass your username and password credentials in the http request header. This is useful for allowing command line tools like wget & curl to access authorized parts of your application. It is also used for rest applications.<\/p>\n
Another new features that has been added to this Auth Component is the ability to have Ldap Auth mirror a SQL table. What this means is that if you really want to have your user information in SQL but just have authentication come from Ldap you can do that. You need to add the following configuration options to the bootstrap.php These tell it which Models to use to mirror the data to and what the LDAP identifiers are for the data.<\/p>\n
[php]
\n $config[‘LDAP’][‘LdapAuth’][‘MirrorSQL’][‘Users’] = ‘User’; \/\/A SQL table to duplicate ldap records in for user
\n $config[‘LDAP’][‘LdapAuth’][‘MirrorSQL’][‘Groups’] = ‘Group’; \/\/A SQL table to duplicate LDAP records in for groups
\n $config[‘LDAP’][‘User’][‘Identifier’] = ‘uid’; \/\/What is the LDAP attribute that identifies the username attribute,
\n \/\/ openldap, iplant, netscapr use uid, AD uses samaccountname
\n $config[‘LDAP’][‘Group’][‘Identifier’] = ‘cn’; \/\/What is the LDAP attribute that identifies the group name, usually cn
\n[\/php]<\/p>\n
Have a question?<\/h2>\n
Discuss it in the CakePHP 2.0 Ldap Plugin<\/a> Forum<\/p>\n","protected":false},"excerpt":{"rendered":"With CakePHP 2.0 the authentication system has been completely redesigned to allow for extending the Auth component to allow other methods of authentication and authorization. \u00c2\u00a0I finally sat down last weekend and updated my LDAPAuth component to work with the new version. \u00c2\u00a0While I was doing it I added a few new features that people […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,3,40],"tags":[],"class_list":["post-1079","post","type-post","status-publish","format-standard","hentry","category-cakephp","category-ldap","category-web-development"],"_links":{"self":[{"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/posts\/1079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/comments?post=1079"}],"version-history":[{"count":13,"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/posts\/1079\/revisions"}],"predecessor-version":[{"id":1151,"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/posts\/1079\/revisions\/1151"}],"wp:attachment":[{"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/media?parent=1079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/categories?post=1079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.analogrithems.com\/rant\/wp-json\/wp\/v2\/tags?post=1079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}