问题描述
我正在使用Symfony 4.4，并且正在做自己的身份验证器。一切正常，我只是想不通如何比较用户输入的密码和Ldap中输入的密码。我想在我的LoginFormAuthenticator中的“ checkCredentials”方法中执行此操作。这是我的LdapUserProvider：
class LdapUserProvider implements UserProviderInterface,PasswordUpgraderInterface
{
private $ldap;
private $basedn;
private $searchDn;
private $searchPassword;
private $defaultRoles;
private $uidKey;
private $defaultSearch;
private $passwordAttribute;
private $extraFields;
//New
private $em;
public function __construct(Ldap $ldap,string $basedn,EntityManagerInterface $em,string $searchDn = null,string $searchPassword = null,array $defaultRoles = [],string $uidKey = null,string $filter = null,string $passwordAttribute = null,array $extraFields = [])
{
if (null === $uidKey) {
$uidKey = 'sAMAccountName';
}
if (null === $filter) {
$filter = '({uid_key}={username})';
}
$this->ldap = $ldap;
$this->basedn = $basedn;
$this->searchDn = $searchDn;
$this->searchPassword = $searchPassword;
$this->defaultRoles = $defaultRoles;
$this->uidKey = $uidKey;
$this->defaultSearch = str_replace('{uid_key}',$uidKey,$filter);
$this->passwordAttribute = $passwordAttribute;
$this->extraFields = $extraFields;
$this->em = $em;
}
/**
* {@inheritdoc}
*/
public function loadUserByUsername($username)
{
try {
$this->ldap->bind($this->searchDn,$this->searchPassword);
$username = $this->ldap->escape($username,'',LdapInterface::ESCAPE_FILTER);
$query = str_replace('{username}',$username,$this->defaultSearch);
$search = $this->ldap->query($this->basedn,$query);
} catch (ConnectionException $e) {
throw new UsernameNotFoundException(sprintf('User "%s" not found.',$username),$e);
}
$entries = $search->execute();
$count = \count($entries);
if (!$count) {
throw new UsernameNotFoundException(sprintf('User "%s" not found.',$username));
}
if ($count > 1) {
throw new UsernameNotFoundException('More than one user found.');
}
return $this->loadUser($username,$entries[0]);
}
/**
* {@inheritdoc}
*/
public function refreshUser(UserInterface $user)
{
if (!$user instanceof LdapUser || !$user instanceof User) {
throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.',\get_class($user)));
}
//New
$userRepository = $this->em->getRepository("AppBundle:User");
$user = $userRepository->findOneBy(array("username" => $user->getUsername()));
if($user === null){
throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.',get_class($user)));
}
return new LdapUser($user->getEntry(),$user->getUsername(),$user->getpassword(),$user->getRoles(),$user->getExtraFields());
}
/**
* {@inheritdoc}
*/
public function upgradePassword(UserInterface $user,string $newEncodedPassword): void
{
if (!$user instanceof LdapUser) {
throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.',\get_class($user)));
}
if (null === $this->passwordAttribute) {
return;
}
try {
$user->getEntry()->setAttribute($this->passwordAttribute,[$newEncodedPassword]);
$this->ldap->getEntryManager()->update($user->getEntry());
$user->setPassword($newEncodedPassword);
} catch (ExceptionInterface $e) {
// ignore Failed password upgrades
}
}
/**
* {@inheritdoc}
*/
public function supportsClass($class)
{
return LdapUser::class === $class;
}
/**
* Loads a user from an LDAP entry.
*
* @param $username
* @param Entry $entry
* @return UserInterface
*/
protected function loadUser($username,Entry $entry)
{
/*
$password = null;
$extraFields = [];
var_dump($this->passwordAttribute);
if (null !== $this->passwordAttribute) {
var_dump($this->passwordAttribute);
$password = $this->getAttributeValue($entry,$this->passwordAttribute);
var_dump($password);
}
foreach ($this->extraFields as $field) {
$extraFields[$field] = $this->getAttributeValue($entry,$field);
}
exit();
return new LdapUser($entry,$password,$this->defaultRoles,$extraFields);*/
$userRepository = $this->em->getRepository("App:User");
//On récupère les infos de l'utilisateur qui se connecte
$user = $userRepository->findOneBy(array("username" => $username));
//Si l'utilisateur est null,donc pas présent en BDD mais OK niveau LDAP
if ($user === null) {
//Créé un User pour l'ajouter à la BDD une fois qu'on s'est assuré que c'était bien un utilisateur LDAP
//Cas première connexion de l'utilisateur
$user = new User();
$user->setFirstname($entry->getAttribute("givenname")[0]);
$user->setLastname($entry->getAttribute("sn")[0]);
$user->setEmail($entry->getAttribute("mail")[0]);
$user->setUsername($entry->getAttribute("uid")[0]);
$user->setRoles($this->defaultRoles);
$this->em->persist($user);
$this->em->flush();
} else {
$this->em->flush();
}
return $user;
}
public function checkPassword($password){
}
/**
* Fetches the password from an LDAP entry.
*
* @param null|Entry $entry
*/
private function getpassword(Entry $entry)
{
if (null === $this->passwordAttribute) {
return;
}
if (!$entry->hasAttribute($this->passwordAttribute)) {
throw new invalidargumentexception(sprintf('Missing attribute "%s" for user "%s".',$this->passwordAttribute,$entry->getDn()));
}
$values = $entry->getAttribute($this->passwordAttribute);
if (1 !== count($values)) {
throw new invalidargumentexception(sprintf('Attribute "%s" has multiple values.',$this->passwordAttribute));
}
return $values[0];
}
private function getAttributeValue(Entry $entry,string $attribute)
{
var_dump("getAttributeValue ".$attribute);
if (!$entry->hasAttribute($attribute)) {
throw new invalidargumentexception(sprintf('Missing attribute "%s" for user "%s".',$attribute,$entry->getDn()));
}
$values = $entry->getAttribute($attribute);
if (1 !== \count($values)) {
throw new invalidargumentexception(sprintf('Attribute "%s" has multiple values.',$attribute));
}
return $values[0];
}
}
我首先考虑过使用getpassword方法，但是它需要和Entry，而且我不知道如何获取此Entry。谢谢
解决方法
对于那些可能想要相同的人，我实际上使用过
$this->ldap->bind($dnUser,$password);
$ dnUser对应于用户条目的dn，您可以通过以下方式获取它
$user->getEntry()->getDn();
密码是用户输入的密码。它检查用户输入的密码是否与LDAP中的密码相同。如果情况良好，则什么也不会发生，但如果结果为false，则抛出InvalidCredentialsException。所以我就这样使用它：
public function checkCredentials($password){
try{
$this->ldap->bind($dnUser,$password);
} catch (InvalidCredentialsException $e){
return false;
}
return true;
}