Skip to content
Northwestern Laravel Starter

Wildcard Photos

The Wildcard Photos integration downloads a user’s Northwestern Wildcard ID card photo from the Directory Search API and stores it in S3. Photos are served to the application via time-limited presigned URLs.

This feature is disabled by default and can be enabled with a single environment variable.

How It Works

Section titled “How It Works”

  1. Photo sync triggered

    During SSO login, FindOrUpdateUserFromDirectory conditionally dispatches a DownloadWildcardPhotoJob if WILDCARD_PHOTO_SYNC_ENABLED is true. The job can run synchronously (during login) or asynchronously on the queue.

  2. LDAP photo retrieval

    The job calls DirectorySearch::lookupByNetId() with 3 retries and 100ms delay. The jpegPhoto attribute in the LDAP response contains the base64-encoded photo.

  3. S3 storage

    The decoded photo is written to wildcard-photos/{netid}.jpg on the s3 disk. The user record is updated with the wildcard_photo_s3_key and wildcard_photo_last_synced_at timestamp. If no photo is found, the key is set to null.

  4. Serving photos

    WildcardPhotoController generates a 30-minute presigned S3 URL and returns a redirect response. If no photo is stored, it falls back to a default profile image.

Authorization

Section titled “Authorization”

The photo endpoint requires authentication and checks Gate::allows('view', $user) before returning the photo URL. This ensures users can only access photos they are authorized to see.

The response includes Cache-Control: private, max-age=1800 (30 minutes) to match the presigned URL lifetime.

Routes

Section titled “Routes”
MethodURINameNotes
GET/users/{user}/wildcard-photousers.wildcard-photoOnly registered when feature is enabled

Enabling the Feature

Section titled “Enabling the Feature”
.env
WILDCARD_PHOTO_SYNC_ENABLED=true

When disabled, the photo route is not registered and the DownloadWildcardPhotoJob is not dispatched during login. The feature is completely inert.