[Haqa]

Ok, so how do you use the hooks to make a mod which can use and extend ldap_auth?

Roughly like this:

1. Set a plugin on hook ldap_auth_start which adds the additional LDAP attributes you'll be using to the array $ldapAttrs.
2. Choose when you want to use the attributes:
   • If you want to use them every time a user logs in, plug in at hook ldap_auth_all_user
   • If you only want to use them if the user has never logged in before choose ldap_auth_new_user
   • If you want to use them only if the user HAS logged in before, choose ldap_auth_existing_user
3. Whichever hook (or hooks) you choose the process is the same:
   • If you want to add data to the user, you'll find the users datamanager object in the variable $newuser
   • If you want to set a value into the users profile fields, then you just need to set that value into the array $userFields with the key being the field name

There are, of course, many other things you could choose to do in your plugin, for example if you call the standard_error function, you'll display a nice error message page (For example if the user has a flag denoting the account is disabled) HOWEVER you need to call process_logout() first as the user will be partly logged in (If their account already exists in vBulletin).

Examples of this can be found in the LDAP Authentication plugin in this mod, or in the Full Name Support for LDAP Auth and Location Support for LDAP Auth mods (Coming soon).

Hope this helps

Haqa...

[codershark]

---

[Haqa]

Originally Posted by codershark

Absolutly Great Timepoint where you post it, because I need it for my exam !

Thanks !

Well be careful, I don't claim that the code is perfect, only that it works for me - There may well be hidden bugs, or aspects of vBulletin that I don't understand properly yet.

Good luck with your exam!

H.

[codershark]

---

[Lionel]

You should use TABLE_PREFIX for vbulletin :-)

[daFish]

Great to see this addon and I have one single question as of now: What if I use this with an empty directory? Does this addon automatically inserts the users to the LDAP?

[Haqa]

Originally Posted by Lionel

You should use TABLE_PREFIX for vbulletin :-)

You are right, I should (And I though I did...). I'll fix this and release an update.

Originally Posted by daFish

Great to see this addon and I have one single question as of now: What if I use this with an empty directory? Does this addon automatically inserts the users to the LDAP?

No, the way it works is it takes users from the directory and creates them in vBulletin as they log in. It doesn't work the other way round.

There are a number of good tools for LDAP management, I use yala, though this does open a potential security hole unless you are VERY careful (It exposes your LDAP to the internet via the web).

H.

[daFish]

Originally Posted by Haqa

No, the way it works is it takes users from the directory and creates them in vBulletin as they log in. It doesn't work the other way round.

There are a number of good tools for LDAP management, I use yala, though this does open a potential security hole unless you are VERY careful (It exposes your LDAP to the internet via the web).

I don't know if this is achievable, but it would be great if there would be an tool for synchronize the user databases, especially if you try to connect your forum to an backend with LDAP as the authentification service.

[Freezerator]

Nice hack, planning on using this in the future to have only one userdatabase

[Haqa]

Originally Posted by Lionel

You should use TABLE_PREFIX for vbulletin :-)

Thanks for the pointer, this is fixed. Also I noticed I'd forgotten the hook definition file, this is now available above...

H.

[codershark]

---

[Haqa]

Originally Posted by codershark

Is it possible to make a SingleSignOn ??? When someone logIn into Windows he is also logIn in forum ????

In theory, yes that should be possible, but it would require so pretty extensive changes to the VB login pages, which would pretty much break upgradability. The problem is that windows login sso works using a version of HTTP Digest auth (AFAIK) which is normally only supported by IIS - This would need to be faked by the login system, and is probably beyond my current level of experience with VB.

The other point is that I'm trying to make my mods so that they don't break upgradability of VB (or any other products).

Anyone else know of a simpler way to do Windows SSO?

H.

[Haqa]

Originally Posted by codershark

Is it possible to make a SingleSignOn ??? When someone logIn into Windows he is also logIn in forum ????

I've been doing some reasearch, and if you have control over your webserver (and the modules installed) you could try playing with mod_auth_vas which implements SPNEGO - The basis for windows domain login support for IIS/IE.

You'd still need some fairly significant mods to vB, (or perhaps a plug somewhere near global_start???) to tell it to use and trust the external username supplied by SPNEGO.

H.

[anybodytech]

Very nice mod - installed with no fuss.

I though had the problem that my LDAP server was containing a new user where the username was not used in vB, but the email was already taken by another username in vB.

This means that your plugin tries to create the new user when a correct username/password is issued (seen from the LDAP server). But due to that the email already exists i vB with another username then the creation of the new user fails. This is properly okay, as two different users can not have the same email. But the error messages indicates that a wrong password/username is issued.

My suggestion for improvement is to give better response to this case.

Best regards
Tom