Register Members List Search Today's Posts Mark Forums Read

Reply
 
Mod Options
LDAP Authentication Details »
LDAP Authentication
Mod Version: 1.5, by Haqa (Member) Haqa is offline
Developer Last Online: Jun 2010 I like it Show Printable Version Email this Page

This modification is currently quarantined.
vB Version: 3.7.x Rating: (18 votes - 4.61 average) Installs: 65
Released: 18 Nov 2008 Last Update: 19 Mar 2009 Downloads: 802
Not Supported Uses Plugins Additional Files Re-usable Code Translations External Content  

I've only recently started using vBulletin, and this is my first mod so if you use this, please click Installed!

This mod (which builds on the fine work from malcomx and zemic) is intended to lower the barriers to using and LDAP directory as an external authentication source for your board. The idea is simple; capture a login attempt before authentication and test it against LDAP first, if that succeeds, see if there is already a matching user in vBulletin. If there is not, create one, using data from the LDAP to fill in the required fields, if there is already a matching user (Determined by comparing email addresses) then update the user.

You might be asking why this mod is better than the two mods I've mentioned above? Well firstly the only additional file is the XML file for the new hooks (See below), and no changes to vBulletin code so installation is simple, and upgrades to vBulletin don't get over complicated by re-applying changes. Secondly, all the settings are controlled from the admincp rather than an external config file. Thirdly (as if two wasn't enough) I've added some hook points so this mod can be extended, for example to get additional data from the LDAP and put it in user profile fields.

One important similarity with the two earlier mods is that in the admincp and modcp no LDAP authentication is performed, this is a safety feature, so even if the mod or an extending to it, breaks your board, you shouldn't ever get locked out of the admincp so you'll be able to turn if off quickly.

Additional Hooks

The mod is essentially a single plugin (plus options and help) which runs at global_complete which is before most other things have happened, but just after all the global setup has occurred.

To enable the additional hooks, you need to upload the file hooks_ldap_auth.xml to /includes/xml under your forum.

The following new hooks are created by this mod:
  • ldap_auth_start - After the list of attributes to fetch has been created, this list is in $ldapAttrs. You can simply add your own attributes to this array here.
  • ldap_auth_all_user - After a new user has been added to vBulletin or existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData. This happens before ldap_auth_new_user or ldap_auth_existing_user.
  • ldap_auth_new_user - After a new user has been added to vBulletin, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.
  • ldap_auth_existing_user - After an existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.

By requesting new attributes at ldap_auth_start and then applying them at either ldap_auth_all_user, ldap_auth_new_user or ldap_auth_existing_user you can setup your users easily without having to write all the LDAP code yourself!

AdminCP Settings

This mod creates a new options group called LDAP Authentication between email options and user registration options where you set the host name and port number of the LDAP server, the initial authentication type (Anonymous or authenticated), optionally the BindDN and Password for the LDAP server. You also set which attribute matches the vBulletin username (The default is cn which works well for inetOrgPerson based entries). You can set additional attributes to retrieve (If you want to quickly knock up a simple plugin which uses them at one of the hook points above). There is also the facility to disable (or rather make unavailable) accounts which exist in vBulletin but not in LDAP. Given that your initial admin may fall into this group, there is also a list of userids who should be allowed to log in anyway.

Requirements
  • PHP 4.3+ with LDAP support.

I'll try to provide support to users of my mod, but please bear in mind I fairly new to all this, so I may not be able to solve all problems immediately. Support will only be provided via this thread (Don't PM or email me unless I ask you to). Priority will be given to users who have clicked Installed.

Release Notes
  • 1.0 - Initial release
  • 1.1 - Corrected SQL queries to use TABLE_PREFIX
  • 1.2 - Corrected a bug which prevented the settings page from being created correctly
  • 1.3 - Corrected where the existing, new and all user hooks are called (Before, not after the user profile fields are set) to support dependant plugins
  • 1.4 - Added the ability to set a search base for directories which do not permit searching from the root
  • 1.5 - Fixed reported bug where hooks were called in the wrong order

Installation
  1. Add the command define('DISABLE_PASSWORD_CLEARING', 1); to your includes/config.php - This will NOT be overwritten by upgrades, so only needs doing once.
  2. Upload the file hooks_ldap_auth.xml to includes/xml under your forum.
  3. Install the latest product file (below) using the Add/Import Product link on the Manage Products page under Plugins & Products in your AdminCP.

Haqa...

Download Now

Only licensed members can download files, Click Here for more information.

Addons

Screenshots

Click image for larger version

Name:	product-ldap_auth_admincp.jpg
Views:	1042
Size:	93.3 KB
ID:	89509  

Show Your Support

  • This modification may not be copied, reproduced or published elsewhere without author's permission.
Similar Mod
Mod Developer Type Replies Last Post
Integration with vBulletin vBulletin Ldap Authentication Plugin malcolmx vBulletin 3.6 Add-ons 117 19 Jun 2013 12:18
Integration with vBulletin LDAP Authentication zemic vBulletin 3.6 Add-ons 61 08 Mar 2010 22:18

  #136  
Old 22 Nov 2011, 23:21
Jimbot Jimbot is offline
 
Join Date: Aug 2011
Originally Posted by roarkh View Post
And now the default usergroup is Registered Users instead of Super Moderators. I'm wondering if this should not be the default behavior?
Perhaps you are right. For my setup, though, by default LDAP users are considered 'trusted', and members using internal VB authentication are not. So all LDAP users are granted the super mod privileges.

What we really should do is make it a config setting.

Not sure when I'll get time to do this....
Reply With Quote
  #137  
Old 26 Nov 2011, 16:53
rguser rguser is offline
 
Join Date: Nov 2011
I didn't have any luck with using the original set_userfields method. The aforementioned code had:

Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

It worked when I switched it to this:

Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

I think it's because the account I was testing was my own account which was promoted to administrator.

Has anyone conceived of the idea or attempted setting the username to the LDAP 'displayname' or 'givenname' and 'sn' while allowing the user to both login and authenticate using their LDAP credentials? ie, login as: jdoe, but username is set to John Doe so that all posts, member list, user profile and all show John Doe. My forum is internal, consists only of LDAP users all on the same domain and I've disabled registration since the LDAP auth code can create a new user. I've made a user profile field set to displayname but if I don't have to go through and modify the template to show the displayname userfield in lieu of username, that would be awesome.

Unless it's easier now to modify the template using the built-in search/replace? Suggestions or ideas?
Reply With Quote
  #138  
Old 08 Dec 2011, 23:08
jugbugs jugbugs is offline
 
Join Date: Jul 2006
Originally Posted by Jimbot View Post
I've not got that error, but I have the LDAP extension for PHP installed. You can check the status of ldap through the vbulletin admincp->Maintenance->PHP info. There's a whole section devoted to ldap in mine.

I run on Windows, so installing LDAP support for PHP was simply an option I chose in the PHP installer (under 'extensions' if I recall correctly).

Good luck!
This worked perfectly... thank you
Reply With Quote
  #139  
Old 08 Dec 2011, 23:18
jugbugs jugbugs is offline
 
Join Date: Jul 2006
I have another question, which is php related.

I have this plugin (vb4 version) and it is working, however, I cannot get the "Allow Built-in Accounts" (ldap_allow_builtin) setting to work when putting in a comma separated list. If I only have one userid in this setting it works for that user only, which leads me to believe this is an easy solution. Given the fact that I am php retard, the answer is not glaringly obvious, therefore, I will summarize what I know in hopes someone can help me.

In the product xml, this variable (setting) is defined as follows:


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

The piece of code that I believe to be broken that uses this variable is:


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

So, what is wrong with the php code that is not searching "ldap_allow_builtin" as if it is an array?

Thanks.
Reply With Quote
  #140  
Old 24 Jan 2012, 22:32
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Originally Posted by Jimbot View Post
For this to work you'll need the following files. They go in the following locations:
./includes/xml/hooks_ldap_auth.xml
./includes/devtools.php

A big thanks to everyone who has contributed to this solution: kpatten, haqa, malcolmx and zemic.

Thanks to everyone for their excellent work!

I have successfully implemented the above version on vBulletin 4.1.10

With regard to this problem:

Originally Posted by kpatten View Post
1. This plugin doesn't seem to work if your Search Base DN begins with a DN in AD. You must have your search base begin with an OU. This means that if you have multiple OU's at the top level of AD that contain users, you may have a problem.
I have managed to get ldap_search to properly recurse through the sub-OU's on a Server 2008 DC running in 2008/2003 mixed mode by doing the following:

After:
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Add:

Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Now if I set the Base DN to DC=domain,DC=com it will find users in all OU's in the domain.

Hope this helps someone

Alex
Reply With Quote
  #141  
Old 03 Feb 2012, 23:01
ItsDrew ItsDrew is offline
 
Join Date: Feb 2012
Originally Posted by rguser View Post
Has anyone conceived of the idea or attempted setting the username to the LDAP 'displayname' or 'givenname' and 'sn' while allowing the user to both login and authenticate using their LDAP credentials? ie, login as: jdoe, but username is set to John Doe so that all posts, member list, user profile and all show John Doe. My forum is internal, consists only of LDAP users all on the same domain and I've disabled registration since the LDAP auth code can create a new user. I've made a user profile field set to displayname but if I don't have to go through and modify the template to show the displayname userfield in lieu of username, that would be awesome.

Unless it's easier now to modify the template using the built-in search/replace? Suggestions or ideas?
rguser: Did you ever find a good solution to this? The LDAP passes their employee ID as their user logon (required). But I would rather have all their posts show as their LDAP "displayName."

The closest I got was to modify the product-ldap_auth-1.5.1_vb4.xml to set the usertitle to the LDAP displayName so at least their name is below their employee ID.

I'd like to know how you worked around this.


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Reply With Quote
  #142  
Old 28 Feb 2012, 20:37
roarkh roarkh is offline
 
Join Date: Nov 2011
vBulletin 4.1.8 to 4.1.10 upgrade

I am relatively new to vBulletin still but have version 4.1.8 installed and working just fine with this plug-in. I have never performed a vBulletin upgrade before and was just wondering what to expect regarding installed plugins when upgrading from 4.1.8 to 4.1.10. Will the LDAP Authentication plugin continue to work as it does now? Or will it need to be modified and/or reinstalled?

Thanks in advance.
Reply With Quote
  #143  
Old 06 Jun 2012, 15:07
tdarvill tdarvill is offline
 
Join Date: Mar 2011
Version 4.2.x compatibility

Are there any issues with using this mod on vBulletin 4.2.0?
Reply With Quote
  #144  
Old 30 Aug 2012, 20:43
rguser rguser is offline
 
Join Date: Nov 2011
Originally Posted by ItsDrew View Post
rguser: Did you ever find a good solution to this? The LDAP passes their employee ID as their user logon (required). But I would rather have all their posts show as their LDAP "displayName."

The closest I got was to modify the product-ldap_auth-1.5.1_vb4.xml to set the usertitle to the LDAP displayName so at least their name is below their employee ID.

I'd like to know how you worked around this.


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.
Sorry for the very late response. Yes, I solved this similarly to how you have it.

The username is only valid from the login screen. Within the code the username is converted over to the full display name right away and used consistently throughout. New account vs existing account is determined by doing a search for the userData[0]['mail'][0].

In transition, I just wrote a script to update all usernames from user alias to full name.
Reply With Quote
  #145  
Old 29 Sep 2012, 01:48
Tweak589's Avatar
Tweak589 Tweak589 is offline
 
Join Date: Nov 2003
Real name: David
Hello,

I am trying to set this up in 4.2.0 and am at a loss right now what I have done wrong. I don't have any errors or any problems so far. I've installed the plugin fine, have LDAP PHP module ready, etc.

I have read this thread and seen that the plugin has many improvements contributed to it and it seems that jimbot's post is where the latest version ends up: http://www.vbulletin.org/forum/showp...&postcount=129

I've followed some instructions in post 127 as well, but I think my problem here is that I simply cannot connect to my LDAP server. My login system on vBulletin does not seem different at all, and is using my traditional "5 attempts" login. So you can imagine when trying this, it gets quite frustrating to have to wait 15 minutes to try logging in again. Every time I am trying new settings nothing changes. I am not sure if I am even connecting to Active Directory. This is what I have currently for settings:

My LDAP settings (having trouble connecting?):
LDAP Server: mydomain.blah.site.com
LDAP Port: xxxx
Anonymous Bind: NO
Bind DN: DOMAIN\username
Bind Password: xxxxxxxxxxx
Naming Attribute: sAMAccountNAme (how does this look, is it first initial + lastname? (e.g. John Doe = jdoe))
Search Base DN: CN=distributionlistname,OU=Distribution Lists,DC=max,DC=blah,DC=site,DC=com
LDAP Attributes: [blank]
Disable vBulletin USers: No
Allow Built-in Accounts: 1 (my admin account id)
Update username: No (I will play with this later)
Disallow disable LDAP logins: Yes
Debug: Yes (in hopes I can see what is wrong! But I don't even see debug output when logging in at the moment)


Any advice as to what works and doesn't work would be helpful. Thank you!
Reply With Quote
  #146  
Old 10 Oct 2012, 17:15
havokit havokit is offline
 
Join Date: Oct 2012
Originally Posted by Tweak589 View Post
Hello,

I My login system on vBulletin does not seem different at all, and is using my traditional "5 attempts" login. So you can imagine when trying this, it gets quite frustrating to have to wait 15 minutes to try logging in again.
I'm having difficulty too with the latest version 4

Wireshark on your LDAP / AD server can tell you if its hitting your server for authentication.. Use the filter ip.addr==192.168.1.34 or something similar

Also under General Settings turn off (Use Login "Strikes" System) which will remove the 15 minute gap problem!

Hope this helps!
Reply With Quote
  #147  
Old 10 Oct 2012, 18:00
Tweak589's Avatar
Tweak589 Tweak589 is offline
 
Join Date: Nov 2003
Real name: David
Thanks havokit.

Hopefully someone comes along in this thread to resolve our connection issues in 4.2.0 . I didn't think a plugin such as this would be incompatible from a few older versions of 4.x. Perhaps it is something to do with the hook(s).

I am not knowledgeable with PHP or any of this, so I am stuck trying to figure this out.
Reply With Quote
  #148  
Old 30 Jan 2013, 19:59
miklr miklr is offline
 
Join Date: Jan 2013
Question were you able to get this working?

Originally Posted by Tweak589 View Post
Thanks havokit.

Hopefully someone comes along in this thread to resolve our connection issues in 4.2.0 . I didn't think a plugin such as this would be incompatible from a few older versions of 4.x. Perhaps it is something to do with the hook(s).

I am not knowledgeable with PHP or any of this, so I am stuck trying to figure this out.
Tweak589, were you able to get this working? We are also in the process of LDAP implementation.

thanks

Last edited by miklr; 30 Jan 2013 at 20:32. Reason: No subject.
Reply With Quote
  #149  
Old 10 May 2013, 13:50
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
FWIW I've just done an upgrade from 4.1.10 to 4.2.1 and the plugin is still working fine for me!

My settings are:

LDAP Server dcname.domain.com
LDAP Port 389
Anonymous Bind No
Bind DN CN=Account Name,CN=Users,DC=domain,DC=com
Bind Password <password for above account>
Naming Attribute sAMAccountName
Search Base DN DC=domain,DC=com (see my earlier post in this thread about searching sub-OU's)
LDAP Attributes fullName,mail,sAMAccountName,displayname,title,l

Last edited by alexm; 10 May 2013 at 13:58.
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Mod Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 23:23.

Layout Options | Width: Wide Color: