Download the PHP package kaliop/identitymanagementbundle without Composer
On this page you can find all versions of the php package kaliop/identitymanagementbundle. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download kaliop/identitymanagementbundle
More information about kaliop/identitymanagementbundle
Files in kaliop/identitymanagementbundle
Package identitymanagementbundle
Short Description Kaliop Identity Management Bundle
License GPL-2.0
Informations about the package identitymanagementbundle
Kaliop Identity Management Bundle
An eZ5 bundle designed to cater all your needs for custom user authentication scenarios:
- log in user by his IP
- log in user using his email instead of login
- get user accounts from an LDAP server (including MS Active Directory)
- get user accounts from an external service (needs custom code)
- allow logging in to the eZ backoffice using the customized symfony login handlers
The base idea is that it should be easy to swap/add remote user services without having to learn the intricate details of the Symfony auth component (firewall/authenticator/userprovider/factory).
As such, the logic of the 'ldap login handler' from eZP4 is replicated:
- when the user tries to log in the 1st time, retrieve his/her profile on the remote system, and create a corresponding eZ user on the fly
- when the user tries to log in after the 1st time, retrieve his/her profile on the remote system, and update the corresponding eZ user if needed
Some nice bits are still missing, but the bundle should be sufficient to get started with simple LDAP integrations.
Contributions are welcome :-)
Allow Log In By Email
-
This happens without the need to save the user email in the 'login field'
-
To activate it: enable the following parameters in parameters.yml:
parameters: # take over the default user provider - to log him in other ways than login field ezpublish.security.user_provider.class: Kaliop\IdentityManagementBundle\Security\User\Provider\EmailUser # take over the auth provider as well, in accord security.authentication.provider.dao.class: Kaliop\IdentityManagementBundle\Security\Authentication\Provider\RepositoryAuthenticationProvider
Allow Log In By IP
-
This is implemented via a custom firewall named ip_login in the firewalls section of security.yml. The firewall depends on a separate service for the mapping IP => user account name
- To activate it: ...
Log In By Remote Services (LDAP/Active Directory or other)
-
Support for LDAP is built-in, and needs some config and minimal php code
-
For other custom external services you wll need to write more php code
-
This is implemented via a custom firewall named remoteuser_login in the firewalls section of security.yml
- The firewall depends on two additional services for:
- communicating to the remote webservice
- creating an instance of (a subclass of) Kaliop\IdentityManagementBundle\Security\User\RemoteUser when user logs in
- mapping that instance into eZPubish users (creating/updating them on the fly at login time)
Getting started: integrating an LDAP directory
-
configure the connection to the ldap server, eg:
services: # The ldap client config my.ldap: class: Symfony\Component\Ldap\LdapClient arguments: - ldap.server.com - 636 - 3 - true
-
configure the retrieval of user account information from the ldap server, eg:
# The service used to communicate with the LDAP server my.ldap_auth.client: class: Kaliop\IdentityManagementBundle\Adapter\LDAP\Client arguments: # NB: here you can pass in either one ldap client, or an array of clients, to achieve high-availability - "@my.ldap" - # the credentials used to serach the ldap search_dn: [email protected] search_password: abcdefg # the filter used to look up the user account base_dn: dc=domain,dc=com, filter: "(sAMAccountName={username})" # The ldap attributes to retrieve to build the user profile. # NB: by default, when the value of any of these changes, the ez user account is updated attributes: - displayname - mail - telephonenumber - memberof - thumbnailphoto - title # The name of the ldap attribute used to hold the user email email_attribute: mail # The name of attribute used to log-in to ldap and validate the password ldap_login_attribute: mail calls: - [ setLogger, [ @?logger ] ]
-
create a handler class, which converts the RemoteUser into eZ users. Subclass Kaliop\IdentityManagementBundle\Security\User\RemoteUserHandler, implement
setFieldValuesFromProfile
andgetGroupsFromProfile
-
declare it as a service, eg:
# The service which creates repo users out of ldap users my.ldap_auth.remoteuser_handler: class: My\LdapAuthBundle\Adapter\LDAP\RemoteUserHandler arguments: - "@my.ldap_auth.client" - "@ezpublish.api.repository" - user_contenttype: user default_content_language: eng-GB group_mapping: "CN=LTD_Intranet_Administrator": 12 "CN=LTD_Intranet_CorpContentManager": 13
-
tie your new service to the RemoteUser class returned by the ldap client:
parameters: kaliop_identity.remoteuser_service_map: Kaliop\IdentityManagementBundle\Adapter\LDAP\RemoteUser: my.ldap_auth.remoteuser_handler
-
set up a firewall definition which activates the whole thing: in security.yml:
ezpublish_front: pattern: ^/ anonymous: ~ # Allow users to log in via LDAP. # The name HAS TO BE 'remoteuser_login' remoteuser_login: # the service used to connect to the LDAP server client: my.ldap_auth.client form_login: require_previous_session: false logout: ~
Allowing remote-service login to the Legacy Admin interface
-
enable the identitymangementextension extension (bundled in this bundle)
-
if you have renamed the firewall in security.yml to anything but ezpublish_front, set up identitymanagement.ini.append.php
- clear caches, test, done!
Advanced usage
Creating a remote-user-provider service for non-ldap services
-
create a subclass of Kaliop\IdentityManagementBundle\Security\User\RemoteUser
-
create a client class, implementing ClientInterface (take a look at Kaliop\IdentityManagementBundle\Adapter\LDAP\Client as an example)
-
declare the new class as a service
-
put the service id in a remoteuser_login in the firewall section of security.yml
-
create a handler class, which converts the RemoteUser into eZ users, implementing RemoteUserHandlerInterface (probably subclassing Kaliop\IdentityManagementBundle\Security\User\RemoteUserHandler is a good idea)
-
declare it as a service
- add it the the handler map in the parameter
kaliop_identity.remoteuser_service_map
The logical flow is the following:
- when a site visitor tries to log in, the client will query the remote system, and, if login is ok, build and return a remoteUser object from the data it gets
- immediately afterwards, the handler takes care of matching the remoteUser with an eZuser account, updating/creating it if needed
All versions of identitymanagementbundle with dependencies
ezsystems/ezpublish-kernel Version *
paragonie/random_compat Version ^1.1 || ^2.0