Add group and base dn login restriction

app/Ldap/Rules/LoginBaseDnRule.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Ldap\Rules;
+
+use Illuminate\Database\Eloquent\Model as Eloquent;
+use LdapRecord\Laravel\Auth\Rule;
+use LdapRecord\Models\Model as LdapRecord;
+
+/**
+ * User must be in this end-dn to login
+ *
+ * The base DN is defined by LDAP_LOGIN_BASE_DN
+ */
+class LoginBaseDnRule implements Rule
+{
+	private const LOGKEY = 'LDNR';
+
+    public function passes(LdapRecord $user, Eloquent $model = null): bool
+    {
+		if ($x=config('pla.login.base')) {
+			$user_dn = $user->getDn();
+			$result = str_ends_with($user_dn, $x);
+
+			if (!$result)
+				\Log::alert(sprintf('%s:User login denied for [%s], not in the base dn (%s)',self::LOGKEY,$user_dn,$x));
+
+			return $result;
+
+			// Otherwise allow the user to login
+		} else {
+			\Log::debug(sprintf('%s:No login base dn rule, permitting login',self::LOGKEY));
+
+			return TRUE;
+		}
+    }
+}

app/Ldap/Rules/LoginGroupRule.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Ldap\Rules;
+
+use Illuminate\Database\Eloquent\Model as Eloquent;
+use LdapRecord\Laravel\Auth\Rule;
+use LdapRecord\Models\Model as LdapRecord;
+
+/**
+ * User must have this group to login
+ *
+ * The group is defined by LDAP_LOGIN_GROUP
+ */
+class LoginGroupRule implements Rule
+{
+	private const LOGKEY = 'LGR';
+
+    public function passes(LdapRecord $user, Eloquent $model = null): bool
+    {
+		if ($x=config('pla.login.group')) {
+			$result = $user->groups()->exists($x);
+
+			if (!$result)
+				\Log::alert(sprintf('%s:User login denied for [%s], not using the approved group: %s',self::LOGKEY,$user->getDN(),$x));
+
+			return $result;
+
+			// Otherwise allow the user to login
+		} else {
+			\Log::debug(sprintf('%s:No login group rule, permitting login',self::LOGKEY));
+
+			return TRUE;
+		}
+    }
+}

config/auth.php

@@ -75,6 +75,8 @@
                 'model' => App\Ldap\User::class,
                 'rules' => [
                         App\Ldap\Rules\LoginObjectclassRule::class,
+                        App\Ldap\Rules\LoginGroupRule::class,
+                        App\Ldap\Rules\LoginBaseDnRule::class,
                 ],
         ],
     ],

config/pla.php

@@ -107,6 +107,10 @@
 		'objectclass' => explode(',',env('LDAP_LOGIN_OBJECTCLASS', 'posixAccount')),
 		// Alert if DN is being used, and the login fails, and the the DN doesnt exist
 		'alert_rootdn' => env('LDAP_ALERT_ROOTDN',TRUE) && strtolower(env('LDAP_LOGIN_ATTR','uid')) === 'dn',
+		// Group that users must be part of to login (null if unrestricted)
+		'group' => env('LDAP_LOGIN_GROUP', null),
+		// Base DN for allowed logins (will default to RootDN if null)
+		'base' => env('LDAP_LOGIN_BASE_DN', null),
 	],
 
 	/*