@wouterj FWIW, I have the following docker-compose setup for a local LDAP:

services:openldap:image:osixia/openldap:1.5.0restart:unless-stoppedenvironment:LDAP_LOG_LEVEL:"256"LDAP_ORGANISATION:${LDAP_ORGANISATION:-Example Inc.}LDAP_DOMAIN:${LDAP_DOMAIN:-example.org}LDAP_BASE_DN:${LDAP_BASE_DN:-"dc=example,dc=org"}LDAP_ADMIN_PASSWORD:${LDAP_ADMIN_PASSWORD:-admin}LDAP_CONFIG_PASSWORD:${LDAP_CONFIG_PASSWORD:-config}LDAP_RFC2307BIS_SCHEMA:"false"LDAP_BACKEND:"mdb"LDAP_TLS:"true"LDAP_TLS_CRT_FILENAME:"ldap.crt"LDAP_TLS_KEY_FILENAME:"ldap.key"LDAP_TLS_DH_PARAM_FILENAME:"dhparam.pem"LDAP_TLS_CA_CRT_FILENAME:"ca.crt"LDAP_TLS_ENFORCE:"false"LDAP_TLS_CIPHER_SUITE:"SECURE256:-VERS-SSL3.0"LDAP_TLS_VERIFY_CLIENT:"demand"LDAP_REPLICATION:"false"KEEP_EXISTING_CONFIG:"false"LDAP_REMOVE_CONFIG_AFTER_SETUP:"true"LDAP_SSL_HELPER_PREFIX:"ldap"tty:truestdin_open:truevolumes:      -ldap_data:/var/lib/ldap      -ldap_config:/etc/ldap/slapd.d      -ldap_certs:/container/service/slapd/assets/certs/ports:      -"389:389"      -"636:636"phpldapadmin:image:osixia/phpldapadmin:latestenvironment:PHPLDAPADMIN_LDAP_HOSTS:"openldap"PHPLDAPADMIN_HTTPS:"false"ports:      -"8080:80"depends_on:      -openldapvolumes:ldap_data:ldap_config:ldap_certs:

And the following configuration in Symfony:

Symfony\Component\Ldap\Ldap:arguments:['@Symfony\Component\Ldap\Adapter\ExtLdap\Adapter']tags:['ldap']Symfony\Component\Ldap\Adapter\ExtLdap\Adapter:arguments:            -host:'%env(resolve:LDAP_HOST)%'port:'%env(resolve:LDAP_PORT)%'encryption:'%env(resolve:LDAP_ENCRYPTION)%'options:protocol_version:3referrals:false

providers:app_ldap:ldap:service:Symfony\Component\Ldap\Ldapbase_dn:'%env(resolve:LDAP_BASE_DN)%'search_dn:'%env(resolve:LDAP_SEARCH_DN)%'search_password:'%env(resolve:LDAP_SEARCH_PASSWORD)%'default_roles:ROLE_USERuid_key:uidfirewalls:main:provider:app_ldap

LDAP_HOST="openldap"LDAP_PORT="389"LDAP_ENCRYPTION="none"LDAP_SEARCH_DN="cn=admin,dc=example,dc=org"LDAP_SEARCH_PASSWORD="admin"LDAP_BASE_DN="ou=Users,dc=example,dc=org"

You'd have to create the rest of the schema by hand, if needed I can try to provide an LDIF.

Hey!

I think@karlshea has recently worked with this code. Maybe they can help review this?

Cheers!

Carsonbot

@wouterj if there's anything I can do to make reviewing easier, let me know

CheckLdapCredentialsListener has 2 modes. Your PR description lets me think that you tested only one of them.

CheckLdapCredentialsListener has 2 modes. Your PR description lets me think that you tested only one of them.

@stof Thanks. It is very possible I might have missed something, as I'm not familiar with the two modes you mention. Could you expand on this or send some documentation my way?

I'm not familiar with the ldap part either. But for those 2 modes, see the if/else inside the try/catch you changed

@stof Thanks. If I understand correctly the difference is whenquery_string is set, which, according to the documentation:

makes the user provider search for a user and then use the found DN for the bind process

Basically allowing the LDAP component to search for a given user in multiple OUs instead of simply interpolating the username into thedn_string.

Having said all that, my changes should not impact either scenario apart from what I've already described. However, when I have some more time I will set up a configuration usingquery_string and test with that as well.

I made anexample application to make it easier to test and verify behavior. The repository includes a docker-compose configuration that spins up an OpenLDAP container, seeds it with some users, and exposes the ports such that the local application can communicate with it.

There are a couple of branches to test all permutations (with/withoutquery_string as well as with/without this PR applied)

• Themaster branch uses the normal configuration, without this PR applied
• Thequery_string branch uses thequery_string configuration without this PR applied
• The44898 branch uses the normal configuration, with this PR applied
• The44898_query_string branch uses thequery_string configuration, with this PR applied

Branches with this PR applied requireJayfrown/ldap dev-ldap-server-unavailable which is a clone of thesymfony/ldap repository which includes the work in this PR.

Note that after switching to/from branches with this PR applied it is necessary to runcomposer install.

@stof I've tested the same scenarios as mentioned in the OP with thequery_string configuration and the behavior remains the same.

Thank you@Jayfrown.