Symfony 5.3, LDAP: Authenticator does not support the request

[schneidr]

I'm trying to implement LDAP (Active Directory) login with the new Authenticator system.

I started a new project:

symfony new project --full
composer require symfony/ldap
composer require symfony/security-bundle
composer require annotations
composer require symfony/apache-pack
composer require twig

My services.yaml:

parameters:

services:
    _defaults:
        autowire: true
        autoconfigure: true

    App\:
        resource: '../src/'
        exclude:
            - '../src/DependencyInjection/'
            - '../src/Entity/'
            - '../src/Kernel.php'
            - '../src/Tests/'

    Symfony\Component\Ldap\Ldap:
        arguments: ['@Symfony\Component\Ldap\Adapter\ExtLdap\Adapter']
        tags:
            - ldap
    Symfony\Component\Ldap\Adapter\ExtLdap\Adapter:
        arguments:
            -   host: '%env(ADLDAP_HOST)%'
                port: '%env(ADLDAP_PORT)%'
                options:
                    protocol_version: 3
                    referrals: false

my security.yaml:

security:
    enable_authenticator_manager: true
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
    providers:
        ad_ldap:
            ldap:
                service: Symfony\Component\Ldap\Ldap
                base_dn: '%env(ADLDAP_BASEDN)%'
                search_dn: '%env(ADLDAP_USERDN)%'
                search_password: '%env(ADLDAP_PASSWORD)%'
                default_roles: ROLE_USER
                extra_fields: ['mail','distinguishedName']

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            lazy: true
            provider: ad_ldap

            form_login:
                login_path: app_login

            logout:
                path: app_logout

    access_control:
        - { path: ^/login, roles: PUBLIC_ACCESS }
        - { path: ^/, roles: ROLE_USER }

my .env file:

APP_ENV=dev
APP_SECRET=e4e999e2812345678954abe96629df2f
MAILER_DSN=smtp://smtp.example.com
DATABASE_URL="sqlite:///%kernel.project_dir%/var/data.db"
ADLDAP_DOMAINNAME=testdomain.example.com
ADLDAP_HOST=testdc01.testdomain.example.com
ADLDAP_PORT=389
ADLDAP_BASEDN=DC=testdomain,DC=igd,DC=fraunhofer,DC=de
ADLDAP_USERDN=CN=username,OU=Mitarbeiter,OU=Personen,OU=IT,DC=testdomain,DC=igd,DC=fraunhofer,DC=de
ADLDAP_PASSWORD=password
ADLDAP_BASEDN_DEPTH=6

src/Controller/SecurityController.php

<?php

namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;

class SecurityController extends AbstractController
{
    /**
    * @Route("/login", name="app_login")
    */
    public function login(AuthenticationUtils $authenticationUtils): Response
    {
        if ($this->getUser()) {
            return $this->redirectToRoute('target_path');
        }

        // get the login error if there is one
        $error = $authenticationUtils->getLastAuthenticationError();
        // last username entered by the user
        $lastUsername = $authenticationUtils->getLastUsername();

        return $this->render('security/login.html.twig', ['last_username' => $lastUsername, 'error' => $error]);
    }

    /**
    * @Route("/logout", name="app_logout")
    */
    public function logout()
    {
        throw new \LogicException('This method can be blank - it will be intercepted by the logout key on your firewall.');
    }

    /**
    * @Route("/", name="index")
    */
    public function index() {
        return $this->render('security/index.html.twig');
    }
}

When I open the site in the browser the login form appears, but when I submit it the form just reappears blank, without the username prefilled, and without any message indicating an error or success. The debug toolbar shows that I am not authenticated.

The .env file is copy&paste from a previous Symfony project where LDAP authentication is working, but with the old pre-Guards auth system, so I can rule out wrong credentials.

The only thing that strikes me from the log:

Authenticator does not support the request

All log entries from that request

[2021-08-23T10:23:17.063116+02:00] request.INFO: Matched route "_wdt". {"route":"_wdt","route_parameters":{"_route":"_wdt","_controller":"web_profiler.controller.profiler::toolbarAction","token":"d7b07a"},"request_uri":"http://gut.example.com/acc/_wdt/d7b07a","method":"GET"} []
[2021-08-23T10:43:07.465106+02:00] request.INFO: Matched route "app_login". {"route":"app_login","route_parameters":{"_route":"app_login","_controller":"App\\Controller\\SecurityController::login"},"request_uri":"http://gut.example.com/acc/login","method":"POST"} []
[2021-08-23T10:43:07.467324+02:00] security.DEBUG: Checking for authenticator support. {"firewall_name":"main","authenticators":1} []
[2021-08-23T10:43:07.467369+02:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"main","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"} []
[2021-08-23T10:43:07.467401+02:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"main","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"} []
[2021-08-23T10:43:07.475648+02:00] doctrine.DEBUG: SELECT name FROM sqlite_master WHERE type = 'table' AND name != 'sqlite_sequence' AND name != 'geometry_columns' AND name != 'spatial_ref_sys' UNION ALL SELECT name FROM sqlite_temp_master WHERE type = 'table' ORDER BY name [] []
[2021-08-23T10:43:07.476779+02:00] doctrine.DEBUG: SELECT name FROM sqlite_master WHERE type = 'table' AND name != 'sqlite_sequence' AND name != 'geometry_columns' AND name != 'spatial_ref_sys' UNION ALL SELECT name FROM sqlite_temp_master WHERE type = 'table' ORDER BY name [] []
[2021-08-23T10:43:07.476907+02:00] doctrine.DEBUG: SELECT name FROM sqlite_master WHERE type = 'table' AND name != 'sqlite_sequence' AND name != 'geometry_columns' AND name != 'spatial_ref_sys' UNION ALL SELECT name FROM sqlite_temp_master WHERE type = 'table' ORDER BY name [] []

URLs I read on the topic:

• https://symfony.com/doc/current/security/authenticator_manager.html
• https://symfony.com/doc/current/reference/configuration/security.html#ldap-authentication
• https://symfony.com/doc/current/security/ldap.html
• Symfony 5.3 - Can't display login error messages #42386
• https://stackoverflow.com/questions/68131217/how-to-use-the-ldap-form-login-and-form-login-on-symfony-5-3-with-the-new-authen
• https://stackoverflow.com/questions/67917465/how-to-upgrade-symfony-5-ldap-security-to-the-new-authenticator-based

What is somewhat frustrating: Everything in the documentation regarding LDAP points toward deprecated stuff.

I don't really want to write my own Authenticator (if I don't have to), I'd rather use what comes with Symfony.

[jfsenechal]

You must set

form_login_ldap:
login_path: app_login

I have create a topic at https://stackoverflow.com/questions/68611281/symfony-authenticate-with-local-sql-or-ldap/68613308#68613308

[schneidr]

form_login_ldap is deprecated and one shouldn't use it anymore with the new Authenticator system (according to this and other comments I can't find right now. I'd prefer a solution without deprecated elements.

[ahundiak]

I was the one who posted the comment about form_login_ldap going away on your stackoverflow link. Turns out I was wrong and I have removed the comment. So form_login_ldap should work using the new authentication system. Can't help with the specifics as I don't use ldap myself.

I still think it would be cleaner to get rid of all the form_ configuration stuff and just make authenticator classes but that is just me.

[S-Tian86]

Hello,

You had the same thing happen to you as me, but it has nothing to do with LDAP authentication itself, that the form just reappears blank, without the username prefilled, and without any message indicating an error or success.

Take a look at this comment #42521 (comment) and you will be enlightened a bit about the problem. Let me know if it helps.

Note: the key is in the support method.