vb.org Archive
Page 2 of 3 1 2 3
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 3.6 Add-ons (https://vborg.vbsupport.ru/forumdisplay.php?f=194)
-   -   Integration with vBulletin - vBulletin Ldap Authentication Plugin (https://vborg.vbsupport.ru/showthread.php?t=148573)

malcolmx 10-28-2007 08:45 AM
Quote:
Originally Posted by grahamar (Post 1369225)
Hi
I tried this plugin and followed the instructions but I get the following error:

Warning: ldap_search() [function.ldap-search]: Search: No such object in /ldapAuth/controller.php on line 37

Warning: ldap_get_entries(): supplied argument is not a valid ldap result resource in /ldapAuth/controller.php on line 38


I'm not technical at all - but line 37 in the code is this:

36: // search for the username and get the DN
37: $searchDn=ldap_search($ldapConnection,$ldapBase,$l dapFilter);
38: $searchResult=ldap_get_entries($ldapConnection,$se archDn);

Can any one offer some help as to how I can fix this. I would really like to get this working. We want touse VB within our intranet and LDAP is used extensively.

Thanks

Graham
hey,

please show me the content of the variables
Code:
$ldapBase
$ldapFilter
thanks

-malc

fhs2006 10-29-2007 06:53 AM
the error is in your $ldapBase.

the base is just: "dc=sun,dc=com"

all the other stuff like ?sub? (objectclass=*) has nothign to do with the deafault search base (=$ldapbase).

my script is searching for a specific user ($ldapFilter in controller.php) below the $ldapBase in your ldap directory.

if you want to want to add an (objectclass=*) to your search filter you have to add that to line 29 in controller.php
Code:
$ldapFilter = "(uid=" . $vbulletin->GPC['vb_login_username'] .")";
you do not have to add ?sub? to your query, because phps ldapsearch scope defaults to SUB.

-fhs

malcolmx 10-29-2007 10:52 AM
please user controller.debug.php and change in line 17 the debug output file location (if needed)
Code:
if(defined('LDDEBUG')) { $fp=fopen('/tmp/apache.debug', "a+"); }
then show me the content of that file.

-malc

malcolmx 10-29-2007 01:13 PM
Quote:
Originally Posted by grahamar (Post 1371078)
Hi Malc,

Just to confirm: Do you want me to run controller.debug.php from the browser after the login fails? or do you mean something else?

Graham
easiest you can do is:
  1. rename controller.php to controller.php.orig
  2. rename controller.debug.php to controller.php

:)

-malc

malcolmx 10-29-2007 02:39 PM
please do me a favour:

on the linux commandline (if available) try the following:
ldapsearch -W -D "XXXX" -x -b YYYY -h ZZZZZZ "(uid=grahamar)"

exchange:
XXXX: the FULL DN to your username (e.g. uid=grahamar,ou=bla=o=buh)
YYYY: the ldap search base
ZZZZ: the ldap server ip

1) additional questions from my side:
is the wiki doing an ldapbind or is it comparing the hash values of the password?

2) are you sure you did all changes to the vbulletin php files as written in the INSTALL file?
especially:
PHP Code:
defined('DISABLE_PASSWORD_CLEARING') ? 1 : 0; 
to check that, add in the debug controller file below line 63
PHP Code:
 // bind to the ldap server with specified credentials (dn, password) 
the following piece of code:
PHP Code:
if(defined('LDDEBUG')) {
   $pass = $vbulletin->GPC['vb_login_password']; 
    wrlog("++ your password  is:\t  $pass");
} 
i dont have an working vb installation at home, but that should do fine. now if you login, you should see your password in plaintext in the debug output file. if this is not your password, please check all the installation steps.

-malc

malcolmx 10-29-2007 02:43 PM
Quote:
Originally Posted by Mark Tomlinson (Post 1361626)
Nice hack, works like a charm. Except...

[S]I set up vBulletin with the usual "Admin" account. After adding the hack, I logged in as myself with my LDAP ID - which automagically created my user ID in the user database. Then I logged on as Admin again gave my user ID administrative permissions. (I'll be wanting to give a couple of other users subsets of admin privledges as well).

Well, what happens is that I can not log into the Admin CP with my LDAP ID.
* I can log into the forums with my LDAP ID just fine.
* And I can log into the Admin CP with 'Admin' just fine.
* But I can't log into the Admin CP with my LDAP ID.
* And I can't log into the forums with 'Admin'.
My theory here is that there is a different log-in process for the Admin CP and it is trying to verify my password against the vBulletin database.

Familiar with this problem? Am I just missing something?[/S]

Nevermind! Missed the comment in the description that says LDAP is not used for the admin or moderation control panels. That's not going to work for me. I need it to check the LDAP directory and the database in all cases. I will settle for just checking LDAP, but would rather it check both.

Sounds like I need to do some digging.
just comment out the following code:
PHP Code:
// if login form is admin or moderator login, dont use ldap authentication
if(($vbulletin->GPC['logintype'] == "cplogin") || ($vbulletin->GPC['logintype'] == "modcplogin"))
{
        return;
} 

malcolmx 10-29-2007 03:15 PM
when your password is shown correctly then you should have done the install instructions.

i have to do some brainwork now... no idea where the problem could be.

malcolmx 10-31-2007 04:10 PM
Code:
ldapsearch --help 2>&1 |grep W
  -W        prompt for bind password
-W is for password austhentication
-D is the full DN to your entity in the directory.

please test if this authentication works.

thanks

-malc

ps: i will be gone over the weekend. i am back on monday.

grahamar 11-08-2007 06:29 AM
Hi Malc,

any update you can give to help proceed with this?

Thank you

Graham

grahamar 11-11-2007 11:16 AM
Hi,

I now have LDAP working on another a Bulletin board from another Source.
I'll leave the situation of not being able to use LDap on vbulletin as it is.

Thanks for those who tried to help me.

Graham

malcolmx 11-14-2007 05:13 PM
i am sorry, but i had no time to help :( we had a cooling problem in our machine room, so i had some stressy days fixing broken and damaged machines..

if you need any help (if you give it one more try) ill help you. if it is possible for you and your company i can fix the problem for you.

-malc

upnorth 02-25-2008 04:40 PM
I'm looking at using this mod but was wondering

#1 will it work with vB 3.6.8

#2 for users authenticated by the LDAP server but not registered in vBulletin, from what I understand a new users created? If understood correctly what user group does the new user automatically get added to?

fhs2006 03-04-2008 05:15 AM
#1 probably yes
#2 yes, new users get created. users are added to the registered group (can be changed in the script with some vbulletin documentation reading)

-fhs

upnorth 03-10-2008 06:05 PM
First off....THIS IS A GREAT MOD!!!

One question that I do have is I've noticed that all the "User Registration Options" on the forum get by passed. i.e send welcome email, default registration options etc. which makes sense as you are creating a user directly in the db table. But is there anyway that I can set some of these user options and send an email notification to the admin, when the user is created and assigned to the registration group? Anyone able to help with this?

upnorth 03-11-2008 01:27 PM
Sorry for the multiple post but I just ran into a small problem. My ID is setup as an administrator and when I attempt to log in the board will not take either my local vB password or my LDAP password? Any ideas? I'm able to log in directly to the admin cp which then provides rights to the forum but for some reason it doesn't by pass the LDAP for admins? Am I understanding this correctly that if you are an admin then it shouldn't use LDAP but instead use the vB id and password?

The info in my debug file is as follows:
++ ---------- START ------- ++
++ LoginType: Normal Login
++ LdafFilter (uid=myUserID)
++ LdapServer connection successful
++ ldap bind did not succeed

Does this mean that it doesn't think that my account is an admin account?

SteveCoppin 03-12-2008 10:27 AM
Quote:
Originally Posted by malcolmx (Post 1371160)
just comment out the following code:
PHP Code:
// if login form is admin or moderator login, dont use ldap authentication
if(($vbulletin->GPC['logintype'] == "cplogin") || ($vbulletin->GPC['logintype'] == "modcplogin"))
{
        return;
} 
When I try this, I get an error saying that no password has been provided.. The form vairable is the same so I'm not sure what's going on. Any ideas?

SteveCoppin 03-13-2008 01:40 PM
Quote:
Originally Posted by SteveCoppin (Post 1462901)
When I try this, I get an error saying that no password has been provided.. The form vairable is the same so I'm not sure what's going on. Any ideas?
Got a fix for this.. Instead of going via the LDAP route for modcp and admincp I store the encrypted password in the database. I already have a set of users so have decided to put the code in the section that gets executed if the user already exists. The other advantage is that if a user's LDAP password changes, it's reflected in the database on the next time they log in. Code is as follows:

PHP Code:
// load the user
$userdata =& datamanager_init('user', $vbulletin, ERRTYPE_STANDARD);
$userdata->set_existing($vbulletin->userinfo);
// set password
$userdata->set('password', $vbulletin->GPC['vb_login_password']);
// save the user
$userdata->save(); 
I'm still pretty new to vBulletin so please let me know if I've done something horribly wrong!!

Steve

SteveCoppin 03-17-2008 10:24 AM
Great mod, but I have another slight problem.

The 'remember me' feature isn't working on my instance and I think it may be something to do with this mod. Has anyone else had the same problem?

upnorth 03-27-2008 05:10 PM
Does anyone know how to modify this code to bypass the LDAP log-in for specific user groups?

D0ubleStakked 03-30-2008 11:37 PM
Fantastic mod.
Thanks malcolmx for building this.

had a little bit of trouble at the start, but I have it working now for me.
Thought I'd share my experience.

1.) all the installation steps were easy to follow. I got tripped up on the ldap_plugin.xml vs hooks_ldap.xml, but I realized my mistake pretty quickly. Maybe an update to the documentation to state which file gets uploaded?

2.) controller.debug.php was the key for me. A note to all you linux people out there, make sure the debug logfile exists first and that apache has permissions to write to it. I changed my debug file to /var/log/vbulletin_ldap.debug, logged in as root, so I did the following :

cd /var/log/
touch vbulletin_ldap.debug
chmod 666 vbulletin_ldap.debug
chown apache:apache: vbulletin_ldap.debug

after the chmod & the chown, I started seeing output in my .debug file.

Another quick observation, I didn't have openldap-clients installed, so in reading the posts in this thread, all of the instructions of running "ldapsearch" won't work unless you have openldap-clients installed. Pretty easy from fedora:

yum install openldap-clients

So after that work, I'm up and running.
In total, it took me ~1 hr to get everything running, which isn't bad.
ldap authentication for MediaWiki took me longer.

Thanks again malcolmx!
-Brian

malcolmx 04-03-2008 02:15 PM
thank you for installing my mod and sharing your experience. i do not have alot of time, thats why i could not improve the whole plugin.

but its nice to see, that its still working on newser vbulletin version :)

i have subscribed the thread, so whenever someone posts, i go here and read the post. i will help whenever its possible.

-malc

jeilers 04-17-2008 05:29 PM
OK, I can't tell if this has been answered. Trying to get this mod working on our corporate intranet. IT will not allow anonymous LDAP queries
Has anybody gotten it to work without this and can explain it succinctly to a newb?

malcolmx 04-17-2008 06:00 PM
hello,

the whole script will work without anonymous searches, if:
  • all users are below the same leaf in the ldap tree (then you do not have to search for the user DN)
  • you bind to your ldap with a user that is allowed to do searches

if you need more information just ask, i will try to help.

-malc

bada_bing 04-18-2008 01:53 AM
Do you know if I can use Cisco ACS to handle authentication rather then pointing to Ldap using this hack/add-on ?

malcolmx 04-18-2008 06:42 AM
hello,

i dont think that this works since cicso ACS is basically a radius server which gets the userdata itself from an ldap or active directory.

-malc

Martin Belak 04-30-2008 03:09 PM
Thanks for a great plugin malcolmx! Do you know if it works with vB 3.7?

/M

j_ainsworth 05-01-2008 11:19 AM
This mod is exactly what I need but I'm struggling to set it up, I've followed the instructions. We are trying to authenticate against a windows 2003 Active Directory and have allowed Anonymous Logon permissions as per the instructions. But everytime I try to login to vbulletin it says I've entered an invalid username/Password
I have tried the alternative controller.debug.php and it gives me the following
++ -------- START -------- ++
++ LoginType: Normal Login
++ LdapFiler: (uid=test)
++ LdapServer: connection successful
++ LdapSearch: there is no such user in the directory

The strange thing I always get the above output even if I put bogus info into ldapconfig.inc.php
ie If I don't use the Active directory port number 3268 or put a rubbish IP addresss or hostanem for $ldapserver
which makes me think that where it says its making a connection successful isn't actually the case
Anyideas
Any more debug that I can get out of the system, we are using vbulletin 3.6.8 on windows 2000 with php 5
Thanks

j_ainsworth 05-01-2008 01:32 PM
Hi the above problem seems to of changed slightly, now when I try to log in with ldapconfig.inc.php configure correctly it just sits at the login screen
The debug output just says
++ -------- START -------- ++
++ LoginType: Normal Login
++ LdapFiler: (uid=vbulletin)
++ LdapServer: connection successful

But doesn't get any further

I have checked and double checked settings, I have also tried authenticating against an old Windows 2000 domain but it does the same.

If anyone has any ideas I would really appreciate as I would really like to use it
Thanks
John

malcolmx 05-05-2008 06:36 AM
is there a user with the uid=xxxx ?
maybe you can find your users with cn=xxx?

you can use the command line tool "ldapsearch" to search for specific attributes in your active directory.
maybe that helps you.

-malc

malcolmx 05-05-2008 06:37 AM
Quote:
Originally Posted by Martin Belak (Post 1503486)
Thanks for a great plugin malcolmx! Do you know if it works with vB 3.7?

/M
maybe.. i have no license to check with. newest vbulletin i have is a 3.6 license. :(

j_ainsworth 05-06-2008 07:43 AM
123

j_ainsworth 05-06-2008 09:37 AM
I have managed to figure out ldp.exe and have now got anonymous searchs working against our Active Directory
However still having trouble with this mod.

I have modified the controller so
$ldapFilter = "(sAMAccountName=" . $vbulletin->GPC['vb_login_username'] .")";
using ldp.exe I can do the above search ok

Using the debug controller I can see it hangs at
$searchDn=ldap_search($ldapConnection,$ldapBase,$l dapFilter);

If I add a line before it
if(defined('LDDEBUG')) { wrlog("++ presearch /t $ldapConnection,$ldapBase,$ldapFilter"); }
I get this in my log file
++ presearch /t Resource id #15,dc=thebookpeople,dc=com,(sAMAccountName=test98 7)

ANy ideas, desperate for this to work!

Cheers
John

malcolmx 05-06-2008 09:48 AM
Quote:
Originally Posted by j_ainsworth (Post 1510220)
I get this in my log file
++ presearch /t Resource id #15,dc=thebookpeople,dc=com,(sAMAccountName=test98 7)

ANy ideas, desperate for this to work!

Cheers
John
great that you got ldap working on windows. the logfile entry shows
- $ldapBase printed (dc=thebookpeople,dc=com)
- $ldapFiler printed (sAMAccountName=test987)
- $ldapConnection is working, too

is it working when you print some text into debuglog right after $searchDn=ldap_search($ldapConnection,$ldapBase,$l dapFilter); ?

-malc

g9g6.com 05-06-2008 10:13 AM
Thanks

j_ainsworth 05-06-2008 11:49 AM
Quote:
Originally Posted by malcolmx (Post 1510227)
great that you got ldap working on windows. the logfile entry shows
- $ldapBase printed (dc=thebookpeople,dc=com)
- $ldapFiler printed (sAMAccountName=test987)
- $ldapConnection is working, too

is it working when you print some text into debuglog right after $searchDn=ldap_search($ldapConnection,$ldapBase,$l dapFilter); ?

-malc
Hi Malc
Progress! I have had some partial success.

If I specify in the ldapconfig.php the actual OU that the account exists in
$ldapBase = "OU=users,OU=Haydock,DC=thebookpeople,DC=com";

and use the cn for the ldapfilter
$ldapFilter = "(cn=" . $vbulletin->GPC['vb_login_username'] .")";

then it works if I login with the actual fullname , ie for me cn=john ainsworth

What I really need is to be able to set the Base to be our top level AD DC=thebookpeople,DC=com rather than be specific
Also to be able to use their login name rather than the Active Directory Object name

I did work out that I changed ldapfilter to query the Active Directory property sAMAccountName instead of cn
and
changed the ldapbase to be
CN=John Ainsworth,OU=HayIT,OU=Haydock,DC=thebookpeople,DC= com

then it would log me in

Cheers

malcolmx 05-06-2008 12:22 PM
if you can only find your user in the "long" tree but the search does not succed with the top level AD base, then it "could" be possivle that AD has a mechanism (like any other ldap) to deny a subtreee (scope) search.

if that works (test with the ldap client command), php standard search scope is subtree (LDAP_SCOPE_SUBTREE) - http://de.php.net/manual/en/function.ldap-search.php

your other thoughts are right:
- login with samaccountname
- search for user (samaccountname=username)
- bind with the full dn (cn=....)

-malc

j_ainsworth 05-06-2008 01:29 PM
[QUOTE=malcolmx;1510358]if you can only find your user in the "long" tree but the search does not succed with the top level AD base, then it "could" be possivle that AD has a mechanism (like any other ldap) to deny a subtreee (scope) search.

All sorted!! If you want to query sub trees in Active Directory don't use the standard port number , use 3268 instead

Once I changed the port number I was able to change the filter to
$ldapFilter = "(sAMAccountName=" . $vbulletin->GPC['vb_login_username'] .")";

to login using the AD login name rather than the cn name

Cheers for all your help malc

malcolmx 05-06-2008 01:40 PM
thanks for using my plugin and its nice to see another one using it :)

dont forget to click on "Mark as Installed" :)

thanks for your support!

-malc

rrusinko 06-09-2008 07:00 PM
I am new to using plugins for vBulletin and the error is probaly basic.
I downloaded the plugin and followed the directions, but when I get to step 6:
I receive a message "invalid file specified".
Step 6 is in admin cp import the product at "Download / Upload" Plugins
I am using the plugin hooks_ldap.xml located in the ./includes/xml/.

Any help would be appreciated.

rrusinko 06-10-2008 06:25 PM
I got it working.


All times are GMT. The time now is 01:36 PM.
Page 2 of 3 1 2 3
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01730 seconds
  • Memory Usage 1,862KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (4)bbcode_code_printable
  • (6)bbcode_php_printable
  • (8)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete