Override the user.auth service in ldap_authentication to do the password check

@larowlan

Drupal 8 has a new UserAuthInterface that is responsible for checking a username and password and returning a matching $uid if the authentication was a success.

See Drupal\user\UserAuth.

Ldap auth module should override this service using a ServiceProvider and substitute it's own, deferring to the parent implementation as necessary for fallback sake.

@larowlan

[1:50pm] larowlan: so you need a ServiceProvider
[1:51pm] larowlan: that alters user.auth to use an ldap provider
[1:51pm] larowlan: that extends from UserAuth
[1:51pm] larowlan: it tries to authenticate agains ldap
[1:51pm] larowlan: and if it fails
[1:51pm] larowlan: defers back to parent
[1:51pm] larowlan: so that user 1 can still login when ldap is down etc

@larowlan

A sample service provider https://github.com/md-systems/file_entity/blob/8.x-2.x/src/FileEntitySer...
And there's a write up by some gumby here https://www.previousnext.com.au/blog/overriding-services-drupal-8-advanc...

@johnbarclay

In this area, your best allies/sources of code for ldap authentication are any other authentication module that is developing for Drupal 8 or the core user module and openid module.

You just need to look at a module one that uses credentials entered directly into Drupal and one that uses external server for users authentication such shib or a saml module. The core user module and openid modules did this in Drupal 7 and may also be good to imitate in drupal 8. In drupal 7, I could not imitate them because of (1) a bug in the user module, (2) because I tried to put both types of authentication in one module, and (3) because I had to create user accounts on the fly on logon.