Using Directory Emulator in development environment

[acharseth]

I don't have access to Active Directory on my developer PC making it a pain to create applications using AD for authentication.
I see that you provide a Directory Emulator which can be used for automated testing. What I wonder is if it also can be used as a AD "replacement" on my developer PC?
If so I guess I should first create and run a test to create and populate the database with test data. I think I can find enough inspiration to do this based on DirectoryTree testing documentation (Testing).
What is not so obvious to me is how to configure my app to use the Directory Emulator (which I guess would be an SQLite DB instance). How would I set up this?
I am only using LdapRecord for syncing the user information and authenticating directly towards the AD so I don't know where I should put the code to tell the app to use the Directory Emulator? Could it be in AuthServiceProvider::boot() (where I have the Fortify::authenticateUsing(function ($request) mapping userid to samaccountname and with a fallback)?
How should config/ldap.php be setup to use the Directory Emulator?

[stevebauman]

Hi @acharseth,

I know your pain! I think you should be able to do this with the Directory Emulator, but there's a bit of setup work involved.

I just did this myself and it works -- I'll do my best to help walk you through it.

To start, create a ldap_test_database.sqlite database file inside of your applications database/ directory:

The below command will only work for macOS. You will have to create the file manually on Windows.

touch database/ldap_test_database.sqlite

Then, inside of your AppServiceProvider::boot() (like you mentioned), setup the directory emulator:

// app/Providers/AppServiceProvider

public function boot()
{
    DirectoryEmulator::setup(config: [
        'database' => database_path('ldap_test_database.sqlite')
    ]);
}

Once that's setup, you'll have to create a database seeder to populate the fake LDAP database with a user so you can login:

php artisan make:seeder LdapUserSeeder

Inside the seeder, import the LdapRecord ActiveDirectory\User model and create a user with the login attribute of your choice (usually mail or userprincipalname since they're email addresses):

<?php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use LdapRecord\Models\ActiveDirectory\User;

class LdapUserSeeder extends Seeder
{
    /**
     * Run the database seeds.
     *
     * @return void
     */
    public function run()
    {
        User::create([
            'cn' => 'John Doe',
            'mail' => 'jdoe@local.com', // This will be the login email address.
        ]);
    }
}

Then, run the database seeder:

 php artisan db:seed LdapUserSeeder

Next, update the Fortify::authenticateUsing callback. We'll retrieve the connection fake from the LdapRecord Container that the DirectoryEmulator replaced for us and call the actingAs method to allow authentication attempts for the user we just created:

use LdapRecord\Container;
use LdapRecord\Models\ActiveDirectory\User;

Fortify::authenticateUsing(function ($request) {
    if ($user = User::where('mail', $request->email)->first()) {
        Container::getDefaultConnection()->actingAs($user);
    }

    $validated = Auth::validate([
        'mail' => $request->email,
        'password' => $request->password
    ]);

    return $validated ? Auth::getLastAttempted() : null;
});

Then, try logging into your application as the user you seeded in the previous step!

Let me know if you have further questions or run into issues 👍

[stevebauman]

I'm not sure what you're referring to @acharseth, could you elaborate?

[acharseth]

Sure, @stevebauman . When you said «A password added to the LDAP user shouldn't be needed, as the password field cannot actually be retrieved at all in Active Directory», I am not sure I fully understand this. A password is what is used in authentication against AD, using bind, right, so the password is needed in that sense? What you are saying is that the clear text password cannot be retrieved (since it is being encrypted)?
My issue is that when using the emulator no password authentication against the emulator is taking place. My app is accepting any password. Is this really meant to be like this or do I have some misconfiguration?
I noticed that in you documentation on Active Directory you are using unicodePwd, not password. If so, this confuses me because I am authenticating with password against AD in the production environment. Should I use unicodePwd? (In fact you use password in your example above (in the validation).
Could you explain how to do password authentication against the emulator, if possible?

[stevebauman]

Hi @acharseth, apologies for the late reply.

My issue is that when using the emulator no password authentication against the emulator is taking place. My app is accepting any password. Is this really meant to be like this or do I have some misconfiguration?

This is intended. The actingAs method is basically setting the user who is authenticated in the emulator, so it permits any password to be used to pass authentication.

I noticed that in you documentation on Active Directory you are using unicodePwd, not password. If so, this confuses me because I am authenticating with password against AD in the production environment. Should I use unicodePwd? (In fact you use password in your example above (in the validation).

unicodePwd is an LDAP attribute on Active Directory user objects. You use that only when you want to change a users password, not as the attribute used for authentication. This attribute is write-only in Active Directory. Attempting to access it in LdapRecord will always return null, as it is never returned from Active Directory.

To enforce a specific password to be used, you may use the LdapFake test utility and create a bind expectation with a specific password:

use LdapRecord\Testing\LdapFake;

if ($user = User::where('mail', $request->email)->first()) {
    Container::getDefaultConnection()->getLdapConnection()->expect(
        LdapFake::operation('bind')->with($user->getDn(), 'secret-password')->andReturnResponse()
    );
}

[acharseth]

Thanks, @stevebauman !
So it is not possible to store the password in the Sqlite DB and thereby emulate an ordinary bind?

[stevebauman]

Yes you could do that by using Hash::check(), then adding the expectation if successful:

use Illuminate\Support\Facades\Hash;

// ...

$user = User::where('mail', $request->email)->first();

if (! $user) {
    return null;
}

if (! Hash::check($request->password, $user->password)) {
    return null;
}

Container::getDefaultConnection()->actingAs($user);

$validated = Auth::validate([
    'mail' => $request->email,
    'password' => $request->password
]);

return $validated ? Auth::getLastAttempted() : null;