Switching to different Connections to perform ->attach() and ->detach()

[nspaul]

My situation is as follows:

We have an AD forest with multiple child domains. We have AD Groups sprinkled in a variety of these domains, and I have a need to search for various users spread across domains and place them into various groups.

An example would be like this: 10 users in ChildDomainA and 10 users in ChildDomainB need to be added to an AD Group in ChildDomainC. Likewise, I may also want to put these same 20 users (across 2 child domains) into a group in ParentDomain.

Historically, I have done this with raw PHP, and somehow it works, but a major drawback is that I am using an account with far too many privileges, and I would also like to start using LdapRecord-Laravel for this.

So, is it possible to have a Laravel Command that starts by identifying the users using a bind account that has limited permissions, connecting on port 3269 (so that it can search the entire Global Catalog), and then once I find the relevant users, then switch to using a different Connection in the users' domains for doing the $group->attach($user) part?

I understand how to create new Connections and add them to the Container and give them different names. I guess I'm just curious how to perform the attach method while specifying a Connection for the operation.

[stevebauman]

Hi @nspaul, this is a great question. I'll do my best to help you get this working.

So, is it possible to have a Laravel Command that starts by identifying the users using a bind account that has limited permissions, connecting on port 3269 (so that it can search the entire Global Catalog)

Unfortunately I've never worked with the global catalog before. I've only worked with a domain that had two child domains (a pretty simplistic setup), so I don't have much knowledge on this.

and then once I find the relevant users, then switch to using a different Connection in the users' domains for doing the $group->attach($user) part?

You can certainly do this now using the Model::on($connection) method to initiate a query for a model on a specific connection, then use $model->setConnection($otherConnection) on a model returned from the query to swap to another.

For example:

$group = Group::on('ChildDomainC')->find('cn=group,dc=local,dc=com');

User::on('ChildDomainA')->each(function (User $user) use ($group) {
    // Using "ChildDomainA" connection to attach the user.
    $group->setConnection('ChildDomainA')->members()->attach($user);
});

User::on('ChildDomainB')->each(function (User $user) use ($group) {
    // Using "ChildDomainB" connection to attach the user.
    $group->setConnection('ChildDomainB')->members()->attach($user);
});

You'll have to configure connections for each of your domains of course, along with their own credentials.

Does this help you / answer some of your questions?

[nspaul]

I think this will be very helpful, thank you! Reading back through it after you responded, I realized I wasn't very clear on the first part. I do indeed have it working where I can query the GC for users across the forest (using port 3269), and this works great.

The important part for me will be the second part, though. I will need to check out the Model::on($connection) thing. Somehow I had not seen that in the docs yet, so this gives me something to experiment with.

I guess a followup question is... Is this going to require me to create a Model for each child domain, to serve as a stand-in for Users in those domains? For example, will I need to create a ChildDomainA model (i.e. class ChildDomainA extends Model), and then have one for each of my domains? Or can I just use the built-in User model on the fly and have it use those different connections that live in the Container?

I really hope that question makes sense. It is a little hard to describe, so if I need to explain further, I am happy to. Also, I will start to get this working and see if I run into any obstacles along the way. Thanks!

[stevebauman]

The important part for me will be the second part, though. I will need to check out the Model::on($connection) thing. Somehow I had not seen that in the docs yet, so this gives me something to experiment with.

This is my mistake, it should be located in the docs here (https://ldaprecord.com/docs/core/v2/models/#connections) but it's not. I'll update the docs tonight to resolve this! 👍

Is this going to require me to create a Model for each child domain, to serve as a stand-in for Users in those domains?

Nope -- as long as your domains are all the same directory type (i.e. ActiveDirectory) then you don't need to create separate models.

The only thing you'll have to keep in mind is that, without using Model::on() or $model->setConnection(), your default connection will be used, so in your circumstance, you'll likely always be using the above methods on all operations.

Or can I just use the built-in User model on the fly and have it use those different connections that live in the Container?

This is exactly what you will be able to do 👍

Please feel free to drop by if you encounter issues or have any further questions -- I'm happy to help!

I've created an issue to track the doc update. I'll close the issue once it's been deployed so you can check up on there for its status.

[stevebauman]

Ok I've updated the docs! Really appreciate the feedback 🙏

http://ldaprecord.com/docs/core/v2/models/#changing-connections