@@ -346,9 +346,8 @@ You **must** insert the trait `Adldap\Laravel\Traits\AdldapUserModelTrait` onto
346346Add the public property ` adldapUser ` to your model.
347347
348348``` php
349- // app/User.php
350-
351349<?php
350+ // app/User.php
352351
353352namespace App;
354353
@@ -403,8 +402,68 @@ To enable it, simply set the option to true in your `adldap_auth.php` configurat
403402'login_fallback' => false, // Set to true.
404403```
405404
405+ #### Windows Authentication (SSO) Middleware
406+
407+ > ** Note** : This feature was introduced in ` v1.4.3 ` . You will need to re-publish the Adldap Auth configuration file
408+ to receive this option.
409+
410+ > ** Requirements** : This feature assumes that you have enabled ` Windows Authentication ` in IIS, or have enabled it
411+ in some other means with Apache. Adldap does not set this up for you. To enable Windows Authentication, visit:
412+ https://www.iis.net/configreference/system.webserver/security/authentication/windowsauthentication/providers/add
413+
414+ SSO authentication allows you to authenticate your users by the pre-populated ` $_SERVER['AUTH_USER'] ` (or ` $_SERVER['REMOTE_USER ` ] )
415+ that is filled when users visit your site when SSO is enabled on your server. This is configurable in your ` adldap_auth.php `
416+ configuration file.
417+
418+ To use the middleware, insert it on your middleware stack:
419+
420+ ``` php
421+ protected $middlewareGroups = [
422+ 'web' => [
423+ Middleware\EncryptCookies::class,
424+ \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
425+ \Illuminate\Session\Middleware\StartSession::class,
426+ \Illuminate\View\Middleware\ShareErrorsFromSession::class,
427+ Middleware\VerifyCsrfToken::class,
428+ \Adldap\Laravel\Middleware\WindowsAuthenticate::class, // Inserted here.
429+ ],
430+ ];
431+ ```
432+
433+ Now when you visit your site, a user account will be created (if one doesn't exist already)
434+ with a random 16 character string password and then automatically logged in. Neat huh?
435+
436+ #### Login Limitation Filter
437+
438+ > ** Note** : This feature was introduced in ` v1.4.6 ` . You will need to re-publish the Adldap Auth configuration file
439+ to receive this option.
440+
441+ Inside of your ` config/adldap_auth.php ` configuration, you can now insert a raw LDAP filter to specify what users are allowed to authenticate.
442+
443+ This filter persists to the Windows Authentication Middleware as well.
444+
445+ For example, to allow only users with an email address, insert the filter: ` (mail=*) ` :
446+
447+ ``` php
448+ /*
449+ |--------------------------------------------------------------------------
450+ | Limitation Filter
451+ |--------------------------------------------------------------------------
452+ |
453+ | The limitation filter allows you to enter a raw filter to only allow
454+ | specific users / groups / ous to authenticate.
455+ |
456+ | This should be a standard LDAP filter.
457+ |
458+ */
459+
460+ 'limitation_filter' => '(mail=*)',
461+ ```
462+
406463#### Multiple Authentication Connections
407464
465+ > ** Note** : This feature was introduced in ` v2.0.0 ` .
466+
408467To swap connections on the fly, set your configurations default connection and try re-authenticating the user:
409468
410469``` php
0 commit comments