Laravel 5: LDAP.Active Directory (AD ) – PlusMagi's Blog By Pitt Phunsanit

ตัวอย่างการ login โดยใช้ Active Directory หรือ LDAP version ของ Microsoft ทำการ authentication แทนข้อมูลผู้ใช้ในตาราง users

ติดตั้ง Adldap2/Adldap2-Laravel โดยใช้ command

cd D:\xampp\htdocs\laravel_dev
composer require adldap2/adldap2-laravel

ลงทะเบียน Adldap facade โดยเปิดไฟล์ config/app.php
```
 'aliases' => [ 'Adldap' => Adldap\Laravel\Facades\Adldap::class, ],
```

Publish Adldap service providers โดยใช้ command

php artisan vendor:publish --provider="Adldap\Laravel\AdldapServiceProvider"
php artisan vendor:publish --provider="Adldap\Laravel\AdldapAuthServiceProvider"

เปลี่ยน driver ของ user provider ในไฟล์ config/auth.php จาก eloquent เป็น ldap
```
 'providers' => [ 'users' => [ 'driver' => 'ldap', // eloquent 'model' => App\User::class, ],
```
เพิ่ม config .env ถ้าใช้ synology จะได้ LDAP Server ประมาณ

IP

192.168.1.101

Base DN:

dc=phunsanit

Bind DN:

uid=root,cn=users,dc=phunsanit

ก็จะเพิ่มไปประมาณ
```
LDAP_SCHEMA=ActiveDirectory
LDAP_HOSTS=192.168.1.101
LDAP_LOGGING=true
LDAP_BASE_DN=dc=phunsanit
LDAP_USER_ATTRIBUTE=uid
LDAP_USER_FORMAT=uid=%s,cn=users,dc=phunsanit
LDAP_CONNECTION=default
```
โดยหลักการคือ

LDAP_BASE_DN

คือจุดเริ่มต้นข้อมูลที่เราสนใจ

LDAP_USER_FORMAT

จะโดน replace กับ user ที่ผู้ใช้กรอกข้อมูลเข้ามาเช่น user: pitt.p แทนที่ uid=%s,cn=users,dc=phunsanit จะได้ uid=pitt.p,cn=users,dc=phunsanit

โดยมีที่มาจาการทดลอง login ได้โดยใช้โปรแกรม Apache Directory Studio โดยชั้นของข้อมูลจะเป็น dc=phunsanit > cn=users > uid=pitt.p > ข้อมูลของ user นี้

แก้ ตาราง user อาจจะใช้ database/migrations/2014_10_12_000000_create_users_table.php

public function up () { Schema::create ('users', function (Blueprint $table) { $table->bigIncrements ('id') ; $table->string ('name') ; /* remove $table->string ('email') ->unique () ; $table->timestamp ('email_verified_at') ->nullable () ; */ //add $table->string ('phone') ; $table->string ('password') ; $table->rememberToken () ; $table->timestamps () ; }) ; }

และใช้ command

php artisan migrate

(ถ้าไม่ได้เช็คให้ดีว่า connect database ถูกต้อง)

แก้ config/ldap.php ประมาณ

<?php return [ /* |-------------------------------------------------------------------------- | Logging |-------------------------------------------------------------------------- | | This option enables logging all LDAP operations on all configured | connections such as bind requests and CRUD operations. | | Log entries will be created in your default logging stack. | | This option is extremely helpful for debugging connectivity issues. | */ 'logging' => env ('LDAP_LOGGING', false) , /* |-------------------------------------------------------------------------- | Connections |-------------------------------------------------------------------------- | | This array stores the connections that are added to Adldap. You can add | as many connections as you like. | | The key is the name of the connection you wish to use and the value is | an array of configuration settings. | */ 'connections' => [ 'default' => [ /* |-------------------------------------------------------------------------- | Auto Connect |-------------------------------------------------------------------------- | | If auto connect is true, Adldap will try to automatically connect to | your LDAP server in your configuration. This allows you to assume | connectivity rather than having to connect manually | in your application. | | If this is set to false, you **must** connect manually before running | LDAP operations. Otherwise, you will receive exceptions. | */ 'auto_connect' => env ('LDAP_AUTO_CONNECT', true) , /* |-------------------------------------------------------------------------- | Connection |-------------------------------------------------------------------------- | | The connection class to use to run raw LDAP operations on. | | Custom connection classes must implement: | | Adldap\Connections\ConnectionInterface | */ 'connection' => Adldap\Connections\Ldap::class, /* |-------------------------------------------------------------------------- | Connection Settings |-------------------------------------------------------------------------- | | This connection settings array is directly passed into the Adldap constructor. | | Feel free to add or remove settings you don't need. | */ 'settings' => [ /* |-------------------------------------------------------------------------- | Schema |-------------------------------------------------------------------------- | | The schema class to use for retrieving attributes and generating models. | | You can also set this option to `null` to use the default schema class. | | For OpenLDAP, you must use the schema: | | Adldap\Schemas\OpenLDAP::class | | For FreeIPA, you must use the schema: | | Adldap\Schemas\FreeIPA::class | | Custom schema classes must implement Adldap\Schemas\SchemaInterface | */ 'schema' => Adldap\Schemas\ActiveDirectory::class, /* |-------------------------------------------------------------------------- | Account Prefix |-------------------------------------------------------------------------- | | The account prefix option is the prefix of your user accounts in LDAP directory. | | This string is prepended to all authenticating users usernames. | */ 'account_prefix' => env ('LDAP_ACCOUNT_PREFIX', '') , /* |-------------------------------------------------------------------------- | Account Suffix |-------------------------------------------------------------------------- | | The account suffix option is the suffix of your user accounts in your LDAP directory. | | This string is appended to all authenticating users usernames. | */ 'account_suffix' => env ('LDAP_ACCOUNT_SUFFIX', '') , /* |-------------------------------------------------------------------------- | Domain Controllers |-------------------------------------------------------------------------- | | The domain controllers option is an array of servers located on your | network that serve Active Directory. You can insert as many servers or | as little as you'd like depending on your forest (with the | minimum of one of course) . | | These can be IP addresses of your server (s) , or the host name. | */ 'hosts' => explode (' ', env ('LDAP_HOSTS', 'corp-dc1.corp.acme.org corp-dc2.corp.acme.org')) , /* |-------------------------------------------------------------------------- | Port |-------------------------------------------------------------------------- | | The port option is used for authenticating and binding to your LDAP server. | */ 'port' => env ('LDAP_PORT', 389) , /* |-------------------------------------------------------------------------- | Timeout |-------------------------------------------------------------------------- | | The timeout option allows you to configure the amount of time in | seconds that your application waits until a response | is received from your LDAP server. | */ 'timeout' => env ('LDAP_TIMEOUT', 5) , /* |-------------------------------------------------------------------------- | Base Distinguished Name |-------------------------------------------------------------------------- | | The base distinguished name is the base distinguished name you'd | like to perform query operations on. An example base DN would be: | | dc=corp,dc=acme,dc=org | | A correct base DN is required for any query results to be returned. | */ 'base_dn' => env ('LDAP_BASE_DN', 'dc=corp,dc=acme,dc=org') , /* |-------------------------------------------------------------------------- | LDAP Username & Password |-------------------------------------------------------------------------- | | When connecting to your LDAP server, a username and password is required | to be able to query and run operations on your server (s) . You can | use any user account that has these permissions. This account | does not need to be a domain administrator unless you | require changing and resetting user passwords. | */ 'username' => env ('LDAP_USERNAME') , 'password' => env ('LDAP_PASSWORD') , /* |-------------------------------------------------------------------------- | Follow Referrals |-------------------------------------------------------------------------- | | The follow referrals option is a boolean to tell active directory | to follow a referral to another server on your network if the | server queried knows the information your asking for exists, | but does not yet contain a copy of it locally. | | This option is defaulted to false. | */ 'follow_referrals' => false, /* |-------------------------------------------------------------------------- | SSL & TLS |-------------------------------------------------------------------------- | | If you need to be able to change user passwords on your server, then an | SSL or TLS connection is required. All other operations are allowed | on unsecured protocols. | | One of these options are definitely recommended if you | have the ability to connect to your server securely. | */ 'use_ssl' => env ('LDAP_USE_SSL', false) , 'use_tls' => env ('LDAP_USE_TLS', false) , ], ], ], ];

จุดสำคัญคือ

schema: จะบอกว่าใช้ protocal อะไร เช่นถ้าใช้ AD จะต้องเลือก Adldap\Schemas\ActiveDirectory::class, ถ้าใช้ LDAP ชนิดอื่นต้องเปลี่ยนจุดนี้
username: user ที่มีสิทธิแก้ข้อมูลใน LDAP server ถ้าไม่มีหรือไม่ต้องการแก้ข้อมูลเข้าไป (ห้ามใช้เด็ดขาด) เพราะจะทำให้ login ไม่สำเร็จ
password: password ของ user ที่มีสิทธิแก้ข้อมูลใน LDAP server ถ้าไม่มีหรือไม่ต้องการแก้ข้อมูลเข้าไป (ห้ามใช้เด็ดขาด) เพราะจะทำให้ login ไม่สำเร็จ

แก้ config/ldap_auth.php ประมาณ

<?php return [ /* |-------------------------------------------------------------------------- | Connection |-------------------------------------------------------------------------- | | The LDAP connection to use for Laravel authentication. | | You must specify connections in your `config/ldap.php` configuration file. | */ 'connection' => env ('LDAP_CONNECTION', 'default') , /* |-------------------------------------------------------------------------- | Provider |-------------------------------------------------------------------------- | | The LDAP authentication provider to use depending | if you require database synchronization. | | For synchronizing LDAP users to your local applications database, use the provider: | | Adldap\Laravel\Auth\DatabaseUserProvider::class | | Otherwise, if you just require LDAP authentication, use the provider: | | Adldap\Laravel\Auth\NoDatabaseUserProvider::class | */ 'provider' => Adldap\Laravel\Auth\DatabaseUserProvider::class, /* |-------------------------------------------------------------------------- | Model |-------------------------------------------------------------------------- | | The model to utilize for authentication and importing. | | This option is only applicable to the DatabaseUserProvider. | */ 'model' => App\User::class, /* |-------------------------------------------------------------------------- | Rules |-------------------------------------------------------------------------- | | Rules allow you to control user authentication requests depending on scenarios. | | You can create your own rules and insert them here. | | All rules must extend from the following class: | | Adldap\Laravel\Validation\Rules\Rule | */ 'rules' => [ // Denys deleted users from authenticating. Adldap\Laravel\Validation\Rules\DenyTrashed::class, // Allows only manually imported users to authenticate. // Adldap\Laravel\Validation\Rules\OnlyImported::class, ], /* |-------------------------------------------------------------------------- | Scopes |-------------------------------------------------------------------------- | | Scopes allow you to restrict the LDAP query that locates | users upon import and authentication. | | All scopes must implement the following interface: | | Adldap\Laravel\Scopes\ScopeInterface | */ 'scopes' => [ // Only allows users with a user principal name to authenticate. // Suitable when using ActiveDirectory. // Adldap\Laravel\Scopes\UpnScope::class, // Only allows users with a uid to authenticate. // Suitable when using OpenLDAP. // Adldap\Laravel\Scopes\UidScope::class, ], 'identifiers' => [ /* |-------------------------------------------------------------------------- | LDAP |-------------------------------------------------------------------------- | | Locate Users By: | | This value is the users attribute you would like to locate LDAP | users by in your directory. | | For example, using the default configuration below, if you're | authenticating users with an email address, your LDAP server | will be queried for a user with the a `userprincipalname` | equal to the entered email address. | | Bind Users By: | | This value is the users attribute you would | like to use to bind to your LDAP server. | | For example, when a user is located by the above attribute, | the users attribute you specify below will be used as | the 'username' to bind to your LDAP server. | | This is usually their distinguished name. | */ 'ldap' => [ 'locate_users_by' => 'userprincipalname', 'bind_users_by' => 'distinguishedname', ], 'database' => [ /* |-------------------------------------------------------------------------- | GUID Column |-------------------------------------------------------------------------- | | The value of this option is the database column that will contain the | LDAP users global identifier. This column does not need to be added | to the sync attributes below. It is synchronized automatically. | | This option is only applicable to the DatabaseUserProvider. | */ 'guid_column' => 'objectguid', /* |-------------------------------------------------------------------------- | Username Column |-------------------------------------------------------------------------- | | The value of this option is the database column that contains your | users login username. | | This column must be added to your sync attributes below to be | properly synchronized. | | This option is only applicable to the DatabaseUserProvider. | */ 'username_column' => 'email', ], /* |-------------------------------------------------------------------------- | Windows Authentication Middleware (SSO) |-------------------------------------------------------------------------- | | Local Users By: | | This value is the users attribute you would like to locate LDAP | users by in your directory. | | For example, if 'samaccountname' is the value, then your LDAP server is | queried for a user with the 'samaccountname' equal to the value of | $_SERVER['AUTH_USER']. | | If a user is found, they are imported (if using the DatabaseUserProvider) | into your local database, then logged in. | | Server Key: | | This value represents the 'key' of the $_SERVER | array to pull the users account name from. | | For example, $_SERVER['AUTH_USER']. | */ 'windows' => [ 'locate_users_by' => 'samaccountname', 'server_key' => 'AUTH_USER', ], ], 'passwords' => [ /* |-------------------------------------------------------------------------- | Password Sync |-------------------------------------------------------------------------- | | The password sync option allows you to automatically synchronize users | LDAP passwords to your local database. These passwords are hashed | natively by Laravel using the Hash::make () method. | | Enabling this option would also allow users to login to their accounts | using the password last used when an LDAP connection was present. | | If this option is disabled, the local database account is applied a | random 16 character hashed password upon first login, and will | lose access to this account upon loss of LDAP connectivity. | | This option is only applicable to the DatabaseUserProvider. | */ 'sync' => env ('LDAP_PASSWORD_SYNC', false) , /* |-------------------------------------------------------------------------- | Column |-------------------------------------------------------------------------- | | This is the column of your users database table | that is used to store passwords. | | Set this to `null` if you do not have a password column. | | This option is only applicable to the DatabaseUserProvider. | */ 'column' => 'password', ], /* |-------------------------------------------------------------------------- | Login Fallback |-------------------------------------------------------------------------- | | The login fallback option allows you to login as a user located in the | local database if active directory authentication fails. | | Set this to true if you would like to enable it. | | This option is only applicable to the DatabaseUserProvider. | */ 'login_fallback' => env ('LDAP_LOGIN_FALLBACK', false) , /* |-------------------------------------------------------------------------- | Sync Attributes |-------------------------------------------------------------------------- | | Attributes specified here will be added / replaced on the user model | upon login, automatically synchronizing and keeping the attributes | up to date. | | The array key represents the users Laravel model key, and | the value represents the users LDAP attribute. | | You **must** include the users login attribute here. | | This option is only applicable to the DatabaseUserProvider. | */ 'sync_attributes' => [ // 'field_in_local_db' => 'attribute_in_ldap_server', 'username' => 'uid', 'email' => 'userprincipalname', 'name' => 'cn', 'phone' => 'telephonenumber', ], /* |-------------------------------------------------------------------------- | Logging |-------------------------------------------------------------------------- | | User authentication attempts will be logged using Laravel's | default logger if this setting is enabled. | | No credentials are logged, only usernames. | | This is usually stored in the '/storage/logs' directory | in the root of your application. | | This option is useful for debugging as well as auditing. | | You can freely remove any events you would not like to log below, | as well as use your own listeners if you would prefer. | */ 'logging' => [ 'enabled' => env ('LDAP_LOGGING', true) , 'events' => [ \Adldap\Laravel\Events\Importing::class => \Adldap\Laravel\Listeners\LogImport::class, \Adldap\Laravel\Events\Synchronized::class => \Adldap\Laravel\Listeners\LogSynchronized::class, \Adldap\Laravel\Events\Synchronizing::class => \Adldap\Laravel\Listeners\LogSynchronizing::class, \Adldap\Laravel\Events\Authenticated::class => \Adldap\Laravel\Listeners\LogAuthenticated::class, \Adldap\Laravel\Events\Authenticating::class => \Adldap\Laravel\Listeners\LogAuthentication::class, \Adldap\Laravel\Events\AuthenticationFailed::class => \Adldap\Laravel\Listeners\LogAuthenticationFailure::class, \Adldap\Laravel\Events\AuthenticationRejected::class => \Adldap\Laravel\Listeners\LogAuthenticationRejection::class, \Adldap\Laravel\Events\AuthenticationSuccessful::class => \Adldap\Laravel\Listeners\LogAuthenticationSuccess::class, \Adldap\Laravel\Events\DiscoveredWithCredentials::class => \Adldap\Laravel\Listeners\LogDiscovery::class, \Adldap\Laravel\Events\AuthenticatedWithWindows::class => \Adldap\Laravel\Listeners\LogWindowsAuth::class, \Adldap\Laravel\Events\AuthenticatedModelTrashed::class => \Adldap\Laravel\Listeners\LogTrashedModel::class, ], ], 'usernames' => [ 'ldap' => [ // replace this line: // 'discover' => 'userprincipalname', // with this one: 'discover' => env ('LDAP_USER_ATTRIBUTE', 'userprincipalname') , // replace this line: // 'authenticate' => 'distinguishedname', // with this one: 'authenticate' => env ('LDAP_USER_ATTRIBUTE', 'distinguishedname') , ], // replace this line: // 'eloquent' => 'email', // with this one: 'eloquent' => 'username', ], ];

จุดสำคัญคือ

sync_attributes: บอกให้ copy ค่าจาก attribute อะไรไปเก็บในตาราง users
usernames: คือการผูก username ในระบบ login ในตาราง ใน LDAP เข้าไว้ด้วยกัน

สร้างระบบ login โดย command
```
php artisan make:auth
```

แก้ login template ให้ใช้ username แทน email เปิด resources/views/auth/login.blade.php จาก

<div class="form-group row">
<label for="email" class="col-md-4 col-form-label text-md-right">{{ __ ('E-Mail Address') }}</label> <div class="col-md-6"> <input id="email" type="email" class="form-control @error ('email') is-invalid @enderror" name="email" value="{{ old ('email') }}" required autocomplete="email" autofocus> @error ('email') <span class="invalid-feedback" role="alert"> <strong>{{ $message }}</strong> </span> @enderror
</div>
</div>

เป็น

<div class="form-group row">
<label for="username" class="col-md-4 col-form-label text-md-right">{{ __ ('Username') }}</label> <div class="col-md-6"> <input id="username" type="text" class="form-control @error ('username') is-invalid @enderror" name="username" value="{{ old ('username') }}" required autocomplete="username" autofocus> @error ('username') <span class="invalid-feedback" role="alert"> <strong>{{ $message }}</strong> </span> @enderror
</div>
</div>

หลัก ๆ คือ replace email แทนที่โดย username นั่นละ ลบ link เกี่ยวกับการ reset password ใน

<a class="btn btn-link" href=""> </a>

แก้ app/Http/Controllers/Auth/LoginController.php โดยจะเป็นส่วนที่ทำการ login และทำหน้าที่ insert / update ข้อมูลกลับไปให้ตาราง users แก้ประมาณ

<?php namespace App\Http\Controllers\Auth; use Adldap\Laravel\Facades\Adldap;
use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\AuthenticatesUsers;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth; class LoginController extends Controller
{ /* |-------------------------------------------------------------------------- | Login Controller |-------------------------------------------------------------------------- | | This controller handles authenticating users for the application and | redirecting them to your home screen. The controller uses a trait | to conveniently provide its functionality to your applications. | */ use AuthenticatesUsers; /** * Where to redirect users after login. * * @var string */ protected $redirectTo = '/home'; /** * Create a new controller instance. * * @return void */ public function __construct () { $this->middleware ('guest') ->except ('logout') ; } /* cusstom */ /** * Handle a login request to the application. * * @param \Illuminate\Http\Request $request * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\Response|\Illuminate\Http\JsonResponse * * @throws \Illuminate\Validation\ValidationException */ public function login (Request $request) { $this->validateLogin ($request) ; // If the class is using the ThrottlesLogins trait, we can automatically throttle // the login attempts for this application. We'll key this by the username and // the IP address of the client making these requests into this application. if ($this->hasTooManyLoginAttempts ($request)) { $this->fireLockoutEvent ($request) ; return $this->sendLockoutResponse ($request) ; } if ($this->attemptLogin ($request)) { return $this->sendLoginResponse ($request) ; } // If the login attempt was unsuccessful we will increment the number of attempts // to login and redirect the user back to the login form. Of course, when this // user surpasses their maximum number of attempts they will get locked out. $this->incrementLoginAttempts ($request) ; return $this->sendFailedLoginResponse ($request) ; } /** * Attempt to log the user into the application. * * @param \Illuminate\Http\Request $request * @return bool */ protected function attemptLogin (Request $request) { $credentials = $request->only ($this->username () , 'password') ; $username = $credentials[$this->username () ]; $password = $credentials['password']; $user_format = env ('LDAP_USER_FORMAT', 'cn=%s,' . env ('LDAP_BASE_DN', '')) ; $userdn = sprintf ($user_format, $username) ; // you might need this, as reported in // [#14] (https://github.com/jotaelesalinas/laravel-simple-ldap-auth/issues/14) : // Adldap::auth () ->bind ($userdn, $password) ; if (Adldap::auth () ->attempt ($userdn, $password, $bindAsUser = true)) { // the user exists in the LDAP server, with the provided password $user = \App\User::where ($this->username () , $username) ->first () ; if (!$user) { // the user doesn't exist in the local database, so we have to create one $user = new \App\User () ; $user->username = $username; $user->password = ''; // you can skip this if there are no extra attributes to read from the LDAP server // or you can move it below this if (!$user) block if you want to keep the user always // in sync with the LDAP server $sync_attrs = $this->retrieveSyncAttributes ($username) ; foreach ($sync_attrs as $field => $value) { $user->$field = $value !== null ? $value : ''; } } // by logging the user we create the session, so there is no need to login again (in the configured time) . // pass false as second parameter if you want to force the session to expire when the user closes the browser. // have a look at the section 'session lifetime' in `config/session.php` for more options. $this->guard () ->login ($user, true) ; return true; } // the user doesn't exist in the LDAP server or the password is wrong // log error return false; } protected function retrieveSyncAttributes ($username) { $ldapuser = Adldap::search () ->where (env ('LDAP_USER_ATTRIBUTE') , '=', $username) ->first () ; if (!$ldapuser) { // log error return false; } // if you want to see the list of available attributes in your specific LDAP server: // var_dump ($ldapuser->attributes) ; exit; // needed if any attribute is not directly accessible via a method call. // attributes in \Adldap\Models\User are protected, so we will need // to retrieve them using reflection. $ldapuser_attrs = null; $attrs = []; foreach (config ('ldap_auth.sync_attributes') as $local_attr => $ldap_attr) { if ($local_attr == 'username') { continue; } $method = 'get' . $ldap_attr; if (method_exists ($ldapuser, $method)) { $attrs[$local_attr] = $ldapuser->$method () ; continue; } if ($ldapuser_attrs === null) { $ldapuser_attrs = self::accessProtected ($ldapuser, 'attributes') ; } if (!isset ($ldapuser_attrs[$ldap_attr])) { // an exception could be thrown $attrs[$local_attr] = null; continue; } if (!is_array ($ldapuser_attrs[$ldap_attr])) { $attrs[$local_attr] = $ldapuser_attrs[$ldap_attr]; } if (count ($ldapuser_attrs[$ldap_attr]) == 0) { // an exception could be thrown $attrs[$local_attr] = null; continue; } // now it returns the first item, but it could return // a comma-separated string or any other thing that suits you better $attrs[$local_attr] = $ldapuser_attrs[$ldap_attr][0]; //$attrs[$local_attr] = implode (',', $ldapuser_attrs[$ldap_attr]) ; } return $attrs; } protected static function accessProtected ($obj, $prop) { $reflection = new \ReflectionClass ($obj) ; $property = $reflection->getProperty ($prop) ; $property->setAccessible (true) ; return $property->getValue ($obj) ; } /** * Get the login username to be used by the controller. * * @return string */ public function username () { return 'username'; } }

จุดสำคัญคือ

use AuthenticatesUsers: ต้นแบบของระบบ login ที่เอามา overwrite ถ้าทำตามทั้งหมดแล้วใช้ไม่ได้ จะเป็นผู้ต้องสงสัยอันดับหนึ่งว่า แกเปลี่ยนไปใช่มั๋ยสาด
public function login: function ที่เขียนมา overwrite function login ใน AuthenticatesUsers เป็นแกนกลางของระบบ login ที่ข้อมูลของฟอร์ม login จะถูกส่งเข้ามาที่ function นี้เป็นที่แรก
protected function attemptLogin: เป็น function ที่จะใช้ตรวจสอบว่า username และ password ถูกต้องจริงรึเปล่า ถ้าถูกจะ return ค่าจากตาราง users กลับไปโดย code ตัวนี้จะอ่านค่าจาก LDAP จากกนั้นจะ insert / update ไปที่ตาราง users ด้วย
public function username (): เป็น function ที่บอกใช้ laravel ใช้ username แทน email ในการ login ที่แก้ใน login template

ทดลอง login ถ้าไม่ได้กลับไปทำขั้นตอนแรกใหม่
แก้ routes ให้ router ที่ต้องการจำเป็นต้องมีการ login ก่อนจึงใช้ได้ เปิดไฟล์ routes/web.php ลบ Auth::routes () ; ออกแทนที่ด้วย
```
// Auth::routes () ;
Route::get ('login', 'Auth\LoginController@showLoginForm') ->name ('login') ;
Route::post ('login', 'Auth\LoginController@login') ;
Route::post ('logout', 'Auth\LoginController@logout') ->name ('logout') ;
```
และครอบ routes ที่ต้องการให้ต้อง login ถึงจะใช้ได้โดย
```
Route::middleware ('auth') ->group (function () {
... Route::get ('/home', 'HomeController@index') ->name ('home') ;
...
}) ;
```
ลบส่วนที่ไม่จำเป็นออกเพื่อความปลอดภัย
- app/Http/Controllers/Auth/ForgotPasswordController.php
- app/Http/Controllers/Auth/RegisterController.php
- app/Http/Controllers/Auth/ResetPasswordController.php
- app/Http/Controllers/Auth/VerificationController.php
- database/migrations/2014_10_12_100000_create_password_resets_table.php
- resources/views/auth/passwords
- resources/views/auth/register.blade.php
- resources/views/auth/verify.blade.php

ขอบคุณ José Luis Salinas ที่เขียน laravel-simple-ldap-auth Howto: adminless LDAP authentification in Laravel ที่ช่วยไขความกระจ่างให้ config ครั้งนี้สำเร็จ

ป้ายกำกับ:Authentication, Login, Users