Any way for implement JWT with LdapRecord-Laravel ?

[hdkcreative]

Hi @stevebauman exist Any way for implement JWT with LdapRecord-Laravel ?

We have been reading the documentation, but we haven't found anything that shows us how to implement JWT with

Until now we only need the user to be active in the active directory and that would be the only condition to generate a VALID TOKEN.

example code:

$credentials = [
            'samAccountName' => $request->samAccountName,
            'password' => $request->password, 
        ];
        
        try {
            $ldapAuthService = new  LdapAuthService($request);
            if ($ldapAuthService->authenticate($request)) {

 			$conn = CustomHelpers::connectToHana(); // we are using sap hana

                    if ($conn) {
                        $sql = "SELECT * FROM \"DBGENERIC\".\"USERS\" WHERE \"samAccountName\" = ?";  
                        $stmt = odbc_prepare($conn, $sql);
                        if ($stmt) {
                            if (odbc_execute($stmt, [$request->samAccountName])) {
                                $userData = odbc_fetch_array($stmt);
                                odbc_close($conn);
                                $infoUser = new User($userData);
                            }
                        }
                       odbc_close($conn);
                    }
	    }
	}

$token = JWTAuth::fromUser($infoUser);

Our UserModel.php

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Tymon\JWTAuth\Contracts\JWTSubject;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;
class User extends Authenticatable implements JWTSubject
{
    use Notifiable;
    use HasFactory;
    use HasApiTokens;

    protected $primaryKey = 'ID';

    protected $table = 'USERS';  //our table in SAP HANA

    public $incrementing = false; 

    protected $fillable = ['samAccountName'];


    public function getJWTIdentifier()
    {
        return $this->getKey();
    }

    public function getJWTCustomClaims()
    {
        return [];
    }
}

[gaidap]

Hi @hdkcreative, is there any chance you figured somehow out how you could implement JWT + LDAP? I have the same problem. Thank you :)

[hdkcreative]

Hi @gaidap

we have this implementation:

Front :

<form [formGroup]="form" >
                <div class="row">
                    <div class="col-md-12 mb-3 text-center mb-4 text-uppercase">
                        <h2 class="title"  >Bienvenido</h2>
                    </div>
                    <!-- samAccountName input -->
                    <div class="col-md-12 mb-3">
                        <mdb-form-control>
                            <input mdbInput type="samAccountName" class="form-control" formControlName="samAccountName" />
                            <label mdbLabel class="form-label">Usuario</label>
                        </mdb-form-control>
                    </div>
                    <!-- Password input -->
                    <div class="col-md-12 mb-4">
                        <mdb-form-control>
                            <input mdbInput type="{{ showPassword ? 'text' : 'password' }}" id="form2Example2" class="form-control" formControlName="password" (keypress)="onEnter($event)"/>
                            <label mdbLabel class="form-label" for="form2Example2">Clave</label>
                            <div class="input-group-append">
                            <span class="input-group-text btn-toggle-password" (click)="togglePasswordVisibility()">
                                <i [ngClass]="showPassword ? 'fa fa-eye' : 'fa fa-eye-slash'"></i>
                            </span>
                            </div>
                        </mdb-form-control> 
                    </div>
                    <!-- Submit button -->
                    <div class="col-md-12 mb-3 text-center">
                        <button (click)="login()" mdbRipple type="button" class="btn btn-primary mb-4" [disabled]="form.invalid  || loading">
                            <span *ngIf="loading" class="spinner-border spinner-border-sm" role="status" aria-hidden="true"></span> 
                        ENTER TO SITE</button>
                    </div>
                </div>    
            </form>

ANGULAR CODE:

login(credentials: any): Observable<{ success: boolean, errorMessage?: string }> {


    return new Observable((observer: Observer<{ success: boolean, errorMessage?: string }>) => {

      this.http.post(`${this.apiUrl}/doLogininActiveDirectory`, credentials).subscribe(

        (response: any) => {
          if (!response.errorMessage) {
            this.setToken(response.token);
            localStorage.setItem('OptionMenu', JSON.stringify(response));
            localStorage.setItem('CompanyApp', JSON.stringify(response.CompanyApp));

            let defaultAppKey = null;
            for (const key in response.UserMenu) {
              if (response.UserMenu.hasOwnProperty(key) && response.UserMenu[key].IS_DEFAULT === 1) {
                localStorage.setItem('IdCompany', JSON.stringify(response.UserMenu[key].IdCompany));
                localStorage.setItem('appId', JSON.stringify(response.UserMenu[key].IdApp));
                localStorage.setItem('IdUser', JSON.stringify(response.UserMenu[key].IdUser));
                defaultAppKey = key;
                break;
              }
            }
            if (defaultAppKey !== null) {
              localStorage.setItem('Menu', JSON.stringify(response.UserMenu[defaultAppKey]));
            }

            this.UserApps = Object.values<any>(response.UserMenu).map((item: { IdApp: any; AppName: any; Dashboard: any }) => ({
              value: item.IdApp,
              label: item.AppName,
              dashboard: item.Dashboard,
            }));
            localStorage.setItem('UserApps', JSON.stringify(this.UserApps));


            const routes: any[] = [];

            for (const key in response.UserMenu) {
              if (response.UserMenu.hasOwnProperty(key)) {
                const app = response.UserMenu[key];
                const routeConfig = app.detail.map((detail: any) => {
                  const childrenRoutes: any[] = [];

                  if (detail.Menu.submenu) {
                    detail.Menu.submenu.forEach((submenu: any) => {
                      if (submenu.link != '') {
                        childrenRoutes.push({
                          path: CryptoJS.AES.encrypt(submenu.link, environment.CryptoKey).toString(),
                          component: DocumentsComponent
                        });
                      }
                    });
                  }

                  // Only return if menu.Menu.link has a value and childrenRoutes is not null
                  if (detail.Menu) {
                    return {
                      path: CryptoJS.AES.encrypt(detail.Menu.link, environment.CryptoKey).toString(), 
                      children: childrenRoutes
                    };
                  } else {
                    return null; // Returns null if the conditions are not met
                  }
                }).filter((route: null) => route !== null); // Filter out null routes

                routes.push(...routeConfig);
              }
            }


            localStorage.setItem('dynamicRoutes', JSON.stringify(routes));

            observer.next({ success: true });
            observer.complete();
          }
          else {
            observer.next({ success: false, errorMessage: response.errorMessage });
            observer.complete();
          }
        },
        (error: any) => {
          if (error.error) {
            observer.next({ success: false, errorMessage: error.error.msg });
          } else {
            observer.next({ success: false, errorMessage: 'Authentication failed' });
          }
          observer.complete();
        }
      );
    });
  }

backend Code:

public function doLogininActiveDirectory(Request $request)
    {
        try {
            header('Content-Type: application/json');
            if ($request['is_login']) {
                $auth = self::AuthenticateInActiveDirectory($request); // MORE IMPORTANT CODE 
                $user_and_apps = self::GetUserAndApp(null, $auth['mail']);
                if (count($user_and_apps) == 0) {
                    throw new \Exception("The user exists, but has no apps or companies assigned");
                }
                $ResUserAndApp = self::CompanyApps($auth['mail'], $user_and_apps);
            }
            $UserAndApp = self::GetUserAndAppByRequest($request, $user_and_apps ?? null);
            if (count($UserAndApp) >= 1) {
                $AllMenuAndIdUser = self::ConstructAllMenuByUserAndApp($UserAndApp);
                $IdUser = $AllMenuAndIdUser['IdUser'];
            } else {
                throw new \Exception("The user exists, but has no apps or companies assigned");
            }
            $response = $request['is_login'] == 1 ?
                [
                    'token' => self::GetTokenByUserId($IdUser),
                    'UserMenu' => $AllMenuAndIdUser['AllMenu'],
                    'CompanyApp' => $ResUserAndApp,
                ] :
                [
                    'UserMenu' => $AllMenuAndIdUser['AllMenu'],
                ];
            return response()->json($response, 200);
        } catch (JWTException $e) {
            throw new \Exception("Error: " . $e->getMessage(), 500);
        } catch (\Exception $e) {
            return response()->json([
                'errorMessage' => $e->getMessage()
            ]);
        }
    }

important***

**public function AuthenticateInActiveDirectory($request)
    {
        try{
            $credentials = [
                'samAccountName' => $request->samAccountName,
                'password' => $request->password,
            ];
            $ldapAuthService = new LdapAuthService($credentials);
            $authenticated = $ldapAuthService->authenticate($credentials);
            if(isset($authenticated['mail'])) {
                $authenticated['mail'] = trim($authenticated['mail']);
            }
            return $authenticated;
        } catch (\Exception $e) {
            throw new \Exception($e->getMessage());
        }
    }**

We have Shared More code than necessary XD , because we have additional logic to build the user menu based on companies and app.

It is our business logic, we have multiple companies and each company can have an app.

But the most important code you can test is the public function AuthenticateInActiveDirectory($request) method.

I hope you have success, if you have any questions you can write to us again and sorry for the long response, I was out of town.

[gaidap]

Hi,

Thank you for your detailed response. After all, I took a different approach, to authenticate and generate the token.

For unknown reasons, I wasn't able to authenticate with the samaccountname key. So I fired a query and searched by cn or samaccountname key and made an authentication attempt using the distinguished name which I got from my query response.

I'm using PHP-Open-Source-Saver/jwt-auth for the JWT generation part.

Here is my Backend-Code from my prototype:

// My Service
    /**
     * @throws ObjectNotFoundException
     * @throws PasswordRequiredException
     * @throws ConfigurationException
     * @throws UsernameRequiredException
     */
    public function authenticate(string $username, string $password): bool
    {
        $connection = new Connection([
            'hosts' => [env('LDAP_HOSTS', 'localhost')],
            'base_dn' => env('LDAP_BASE_DN', 'OU=users, DC=example, DC=org'),
            'username' => env('LDAP_USERNAME', 'cn=ldapreader,ou=users,dc=example,dc=org'),
            'password' => env('LDAP_PASSWORD', 'ldapreaderpw'),
            'port' => env('LDAP_PORT', 1390),
        ]);
        $uidKey = env('LDAP_UID_KEY', 'cn');
        $user = $connection->query()->where($uidKey, '=', $username)->firstOrFail();

        return $connection->auth()->attempt($user['dn'], $password, true);
    }

// My controller
    public function login(Request $request): JsonResponse
    {
        $params = $request->validate([
            'username' => 'required|string',
            'password' => 'required|string',
        ]);
        $isAuthenticated = $this->ldapAuthenticationService->authenticate($params['username'], $params['password']);
        if ($isAuthenticated) {
            $user = User::where('username', $params['username'])->first() ?? $this->register($request);
            auth()->login($user);

            return response()->json([
                'meta' => [
                    'code' => 200,
                    'status' => 'success',
                    'message' => 'Quote fetched successfully.',
                ],
                'data' => [
                    'user' => $user,
                    'authorisation' => $user->getUserToken(),
                ],
            ]);
        }

        return response()->json([
            'meta' => [
                'code' => 401,
                'status' => 'unauthenticated',
                'message' => 'Username or password is incorrect.',
            ],
        ]);
    }

Thanks again and have a nice week.

Best regards,
Paul