LDAP Search Filter

This document outlines how to go about constructing a more sophisticated filter for the userSearchFilter and groupSearchFilter attributes in your AtlassianUser LDAP config file.

Once you have constructed your search filter using this document, you must escape the ampersand symbol and the exclamation mark symbol before adding to your XML file. So for example, (&(objectClass=person)(!(objectClass=user))) becomes (&(objectClass=person)(!(objectClass=user))) Refer to this external documentation on other XML characters that need escaping.

How do I match more than one attribute?

For example, if my users are distinguished by having two objectClass attributes (one equal to 'person' and another to 'user'), this is how I would match for it:

(&(objectClass=person)(objectClass=user))

Notice the ampersand symbol '&' symbol at the start. Translated this means: search for objectClass=person AND object=user.

Alternatively,

(|(objectClass=person)(objectClass=user))

Translated this means: search for objectClass=person OR object=user.

The pipe symbol '|' denotes 'OR'. As this is not a special XML character, then it should not need escaping.

Wildcards

(&(objectClass=user)(cn=*Marketing*))

This means: search for all entries that have objectClass=user AND cn that contains the word 'Marketing'.

How do I match 3 attributes?

This gets a little tricky:

(&(&(objectClass=user)(objectClass=top))(objectClass=person))

Notice how we weave one query into another. For 4 attributes, this would be:

(&(&(&(objectClass=top)(objectClass=person))(objectClass=organizationalPerson))(objectClass=user))

And so on.

Matching Components of Distinguished Names 

You may want to match part of a DN, for instance when you need to look for your groups in two subtrees of your server.

(&(objectClass=group)(|(ou:dn:=Chicago)(ou:dn:=Miami)))

will find groups with an OU component of their DN which is either 'Chicago' or 'Miami'. 

Using 'not'

To exclude entities which match an expression, use '!'. Note that this must be represented as the entity '!' in your XML file.

So

(&(objectClass=group)(&(ou:dn:=Chicago)(!(ou:dn:=Wrigleyville))))

will find all Chicago groups except those with a Wrigleyville OU component.

Note the extra parentheses: (!(<expression>))

Source : http://confluence.atlassian.com/display/DEV/How+to+write+LDAP+search+filters

Read more!

Symfony 2 - User Direct Login / Single Sign On

In applications integration, single sign on is mandatory. In this post, I won't cover how applications integration process. To be more specific, I assume you know how to integrate/share users between multiple applications.

This piece of code bellow will show how to do a login process in symfony 2 programatically for single sign on purpose. But before you can use the following code you have to implement your own custom user class implementing UserInterface for Symfony 2, custom role class implementing RoleInterface and have read Symfony 2 manual about how to setup a firewall in Symfony security configuration file.

The scenario :

We have exisiting web based application called Alice, and I write new application with Symfony 2 called Bob. Now, we want to integrate Bob as part of Alice application. The situation is Alice already have users because it was still used. And Bob will use users from Alice as its users.

The requirements :

Users want to login only one time from Alice login page in order to use both Alice and Bob applications.

The solution :

Flow chart

In above scheme, when a user try to access Bob, it will check for the user's credentials of Alice. If Bob found the user is not authenticated from Alice, it will send a redirect response to Alice login page. If the user is an authenticated user of Alice, then Bob will ask Alice the all the user information it needs and mark the user as an authenticated user in Bob application.

So in Bob authentication validator, we can use the following code to mark the authenticated user of Alice as an authenticated user of Bob.

$token = new UsernamePasswordToken($user, null, $firewall, $user->getRoles());
$this->get('security.context')->setToken($token);
$session = $this->get('session');
$session->set('_security_'.$firewall,serialize($token));

Happy coding (:

Read more!

[Symfony 2] Assetic with jqueryui

I've been learning to use Symfony 2 for a couple of days and quite astonished by how Symfony 2 is able to simplify most of web application development process without losing flexibility and scalability which is needed by every web programmer.

Standard package of Symfony 2 framework comes with many features from 3rd party vendor. One of them is Assetic, asset management framework for web resources, such as css stylesheet files and javascript files.

One of the problems i've encountered when learning to use Assetic was there's only few documentations and was poorly written. Maybe it was due to Symfony 2 is still in an early stage. This post will show you how to integrate Jquery-UI with Assetic.

First, we need to create a subfolder under 'Resources' folder named 'public' in our Symfony 2 bundle folder. This folder will hold all of our CSS and javascript files.

Inside the folder, we add css file from jquery-ui installation file.

From our console in top directory of symfony installation, run bellow command :

$php app/console assetic:dump

to tell assetic to generate dynamic css and javascript file.

Then run :

$php app/console assets:install --symlink web

to install the generated files from previous step.

After installed, we can use asset_url in twig as usual.

The problem occur when jquery-ui css file trying to find images in the url.


The solution is to move the whole jquery-ui images directory :

./jqueryui-1.x.x/themes/images/

to Symfony 2 web css dir. So the directory will be like :

./web/css/images

And your jquery-ui css will run as it supposed to be. (:

Read more!