# Struggling to understand LDAP authentication in CakePHP 5

**URL:** <https://discourse.cakephp.org/t/struggling-to-understand-ldap-authentication-in-cakephp-5/12326>\
**Category:** Need Help\
**Created:** [December 2, 2024, 3:43pm UTC](https://discourse.cakephp.org/t/struggling-to-understand-ldap-authentication-in-cakephp-5/12326 "2024-12-02T15:43:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![AMLDarren](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@AMLDarren](https://discourse.cakephp.org/u/AMLDarren)\
**Post date:** [December 2, 2024, 3:43pm UTC](https://discourse.cakephp.org/t/struggling-to-understand-ldap-authentication-in-cakephp-5/12326/1 "2024-12-02T15:43:39Z")

</div>

Hi,

I’m struggling to understand user authentication in CakePHP 5 - in particular LDAP authentication (using Active Directory).

I can’t seem to find any documentation/examples for LDAP on CakePHP v5. I have the local user auth working as per the example in the Cake documentation, but don’t really understand what I need to get ldap auth implemented correctly.

I have ldap working on my current project using 3.8, but seems this will no longer work…Not being a full time dev and having a lot of time to spend on this between jobs is not helping things!

Any help appreciated in pointing me in the right direction!

---

<div class="post-metadata">

**Author:** ![KevinPfeifer](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/kevinpfeifer/32/3365_2.png) [@KevinPfeifer](https://discourse.cakephp.org/u/KevinPfeifer)\
**Post date:** [December 4, 2024, 10:30am UTC](https://discourse.cakephp.org/t/struggling-to-understand-ldap-authentication-in-cakephp-5/12326/2 "2024-12-04T10:30:49Z")

</div>

The Authentication Plugin already has a [LDAP Identifier](https://book.cakephp.org/authentication/3/en/identifiers.html#ldap) present.

So all you really should need is to add the Identifier to your AuthenticationService:

```auto
    $service->loadIdentifier('Authentication.Ldap', [
        'fields' => [
           'username' => 'username',
           'password' => 'password'
        ],
        'host' => 'ldap.mydomain.com',
        'port' => '389',
        'bindDN' => function($username) {
                return 'uid='.$username.',DC=example,DC=com';
            },
        'options' => [LDAP_OPT_PROTOCOL_VERSION => 3]
    ]);

```

or something alike

---

<div class="post-metadata">

**Author:** ![AMLDarren](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@AMLDarren](https://discourse.cakephp.org/u/AMLDarren)\
**Post date:** [December 12, 2024, 6:03pm UTC](https://discourse.cakephp.org/t/struggling-to-understand-ldap-authentication-in-cakephp-5/12326/3 "2024-12-12T18:03:53Z")

</div>

Thanks for the reply and pointing me in the right direction.

I do actually have code in there now as MS CoPilot actually suggested something very similar (where nothing else made sense…) But it’s still not working - but I will try and spend some time on it soon and have a play with the code - at least I could see traffic going to the AD server at during login attempts - so fingers crossed it’s just sometime silly I’ve missed.

Cheers  
Darren

---

<div class="post-metadata">

**Author:** ![KevinPfeifer](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/kevinpfeifer/32/3365_2.png) [@KevinPfeifer](https://discourse.cakephp.org/u/KevinPfeifer)\
**Post date:** [December 12, 2024, 6:11pm UTC](https://discourse.cakephp.org/t/struggling-to-understand-ldap-authentication-in-cakephp-5/12326/4 "2024-12-12T18:11:30Z")

</div>

You can also look into [authentication/src/Identifier/LdapIdentifier.php at 3.x · cakephp/authentication · GitHub](https://github.com/cakephp/authentication/blob/3.x/src/Identifier/LdapIdentifier.php) and [authentication/src/Identifier/Ldap/ExtensionAdapter.php at 3.x · cakephp/authentication · GitHub](https://github.com/cakephp/authentication/blob/3.x/src/Identifier/Ldap/ExtensionAdapter.php) if you want to adjust some code manually. Those just live inside your `vendor/cakephp/authentication` directory

---

<div class="post-metadata">

**Author:** ![AMLDarren](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@AMLDarren](https://discourse.cakephp.org/u/AMLDarren)\
**Post date:** [December 16, 2024, 3:15pm UTC](https://discourse.cakephp.org/t/struggling-to-understand-ldap-authentication-in-cakephp-5/12326/5 "2024-12-16T15:15:20Z")

</div>

Thanks Kevin, will take a look.

---

<div class="post-metadata">

**Author:** ![AMLDarren](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@AMLDarren](https://discourse.cakephp.org/u/AMLDarren)\
**Post date:** [December 27, 2024, 1:57pm UTC](https://discourse.cakephp.org/t/struggling-to-understand-ldap-authentication-in-cakephp-5/12326/6 "2024-12-27T13:57:48Z")

</div>

Just an update to say I finally got authentication working, thanks to the pointers above from Kevin - after some further debugging, I was able to work out what the problem was (basically username needed to be user@domain format).

So it turned out to be quite easy to get the authentication implemented in the end.

Just added this code to my Application.php file in the src directory under the Authentication.Form identifier.

```
    // Load Ldap identifier
    $authenticationService->loadIdentifier('Authentication.Ldap', [
        'host' => 'ldap://myservername',
        'port' => 389,
        'bindDN' => function($username) {
                return $username;
            },
        'baseDN' => 'OU=myusers,DC=mydomain,DC=co,DC=uk',
        'options' => [
            LDAP_OPT_PROTOCOL_VERSION => 3,
        ]
    ]);

```

Now to work out how to get group membership details for Authorisation purposes, which will no doubt be more fun!