Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <blockquote> <p>Now the official docs say, that if the authentication against the first server fails, it will try to do so against the second one. However, That doesn't seem to be the case with my authentication script.</p> </blockquote> <p>The behaviour you describe was introduced as a solution to bug <a href="http://framework.zend.com/issues/browse/ZF-4093" rel="nofollow">ZF-409</a>. In order to get it to work as you want just set different accountDomainName (or accountDomainNameShort) in your 2 LDAP server options:</p> <pre><code>ldap.admin.accountDomainName = admin.domain ldap.admin.accountDomainNameShort = admin ldap.readonly.accountDomainName = readonly.domain ldap.readonly.accountDomainNameShort = readonly </code></pre> <p>If you login using a "readonly" valid user, it will fail to login in as admin but it will login in as readonly. The Zend_Auth_Result will be something like:</p> <pre><code>object(Zend_Auth_Result)#159 (3) { ["_code":protected] =&gt; int(1) ["_identity":protected] =&gt; string(26) "readonly\username" ["_messages":protected] =&gt; array(6) { [0] =&gt; string(0) "" [1] =&gt; string(0) "" [2] =&gt; string(312) "host=host,useSsl=1,accountDomainName=admin.domain,accountDomainNameShort=admin,accountCanonicalForm=3,baseDn=dc=mydc,dc=de,bindRequiresDn=1,useStartTls=1,group=ama_ro,groupDn=cn=ama_ro,ou=groups,dc=mydc,dc=de,groupAttr=cn,groupFilter=objectClass=groupOfNames,memberAttr=member" [3] =&gt; string(142) "Failed to verify group membership with (&amp;(&amp;(cn=admin)(member=youruserDN))(yourfilter))" [4] =&gt; string(310) "host=host,useSsl=1,accountDomainName=readonly.domain,accountDomainNameShort=readonly,accountCanonicalForm=3,baseDn=dc=mydc,dc=de,bindRequiresDn=1,useStartTls=1,group=ama_ro,groupDn=cn=ama_ro,ou=groups,dc=mydc,dc=de,groupAttr=cn,groupFilter=objectClass=groupOfNames,memberAttr=member" [5] =&gt; string(52) "readonly\username authentication successful" } } </code></pre> <p>After you get a <code>$login-&gt;isValid()</code> just perform <code>$login-&gt;getIdentity()</code> and you'll get the <strong>accountDomainNameShort</strong> value along with <strong>username</strong> provided.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload