any updates on how to get this working with Active Directory? Additionally I would like to use it without anonymous query access...for other apps that authenticate with Active Directory I have a specific user for that...

Unfortunately my AD server had an accident (Well it corrupted its boot disk) so I can test AD at the moment, but the Bind DN and Bind Password are what you need for the user and password for non-anonymous access - But remember you'll need to be running in mixed (compatible) mode or the AD will require kerberos which PHP doesn't support out of the box (Or at all as far I can tell).

You should find the it will work, but you need to set the correct Naming Attribute, can't remember what it needs to be of the top of my head, but and LDAP browser should be able to connect and you should see which entry you want.

H.

Hi Haqa,

I'm using your LDAP add-on (version 1.5) on my vBulletin 3.8.1 Patch Level 1.
I'm a new to LDAP, I tried a lot of times, but still could not get the parameters right.
Attachment is my configuration, would you please teach me what's wrong with my parameters? Thank you!

I'd say you're pretty much spot on with the parameters. (For those looking for the attribute names for AD, these are they!!) however there appears to be an issue with 3.8.x where the hook I was using no longer occurs in the correct place.

I'm working on a new, 3.8 compatible version (Which therefore will probably NOT work on 3.7) but due to work commitments it's not going as quickly as I would like.

H.

Hi Haqa,

Thank you for your generous reply, I just get the vBulletin 3.7.6 and tried again, no matter I configured as the picture you posted, or as the picture I posted, it still doesn't work. Can you explain me the exact meaning of the fields "Naming Attribute", "Search Base DN" and "LDAP Attributes"? And can these fields be blank? Thank you!

Ahh.. hmm.. Yes, to use this product you need to know a little about how LDAP works. I don't claim to be a total expert but I'll try to help.

Firstly LDAP is a hierarchical database, that is it is structured like a file system with branches (Think directory) and leaves (Think file). Each node, either branch or leaf has a Distingushed Name (DN) which is made up of the Naming Attribute followed by the DN of the node in which it sits so if you have a branch of your tree called:-

dc=example,dc=com

And the naming attribute for an inetOrgPerson class is CN then an inetOrgPerson with CN=fred would have the DN of:-

cn=fred,dc=example,dc=com

The search base is the point in the tree to start searching from. Think of it like this, if on a windows machine you are searching for a document, you don't want to search the entire hard disk, you might start searching in "C:\Documents and Settings" to limit the time taken to find the file. This is what the search base does, so in my example above, to find fred I might set the search base to:-

dc=example,dc=com

The Additional LDAP Attributes setting is to support my add-on products, like Location Support and Fullname Support. For them to work you need to put the attribute name here so that the LDAP Authentication module pulls out the data needed by the add-on modules. If you are not using any modules which extend LDAP Authentication then you don't need to put anything there.

While I'm at it, don't forget that some AD servers don't support what's known as Simple Bind (Which is all that standard PHP can do) but instead need a different sort of login called Kerberos. If your Windows Server is configured to only support Native authentication then there is a good chance that PHP won't be able to bind (Login) and my module just won't work at all. I'm afraid there is nothing I can do about that, it's simply not possible with the standard version of PHP.

I hope this makes a rather complex and confusing subject a little clearer.

H.

Haqa I'm having a heck of a time getting this to work with 3.8.2.

I know you don't have it certified to work with it yet but I've seen a few others mention that they got it working with their AD setups.

The information in the screen shot is a copy and paste from a working LDAP tie in from a PHP/Tomcat application as well the PHPBB forums which I had running BEFORE I purchased VBulletin to switch over.

When I activate the plug-in

• Cannot log in with the admin account (after the fact on another browser)
• Cannot log in with a normal account

I don't need to add users to the database, all I really need is VB to reach out, see that the user is there, see that their password is correct and then let them in. We're an educational institution with our own Active Directory structure and we just want to unify as much as possible around one account system.

Side Note:
If anyone has any information on where I can turn on advanced logging to see if there's additional information I can get out of the VB that would be awesome.

Hi Haqa, with your so detailed explanation, I think I get a little understand LDAP.
But still, I could not get the authentication passed.

I tried four times with different parameter groups, these parameters are not changed through my test:

"LDAP Server" is set "172.29.128.29" (IP address of my AD server),
"LDAP Port" is "389" (Default value),
"Naming Attribute" is set "cn",
"Search Base DN" is set "dc=test,dc=com" (My domain is test.com),
"LDAP Attributes" is always blank,
"Allow Built-in Accounts" is always set "1".

The other fields in the four test groups are:

1. "Anonymous Bind" is set "Yes",
"Bind DN" and "Bind Password" are set blank,
"Disable vBulletin Users" is set "Yes"

When I login with my domain account, it shows "You have entered an invalid username or password. ..."

2. "Anonymous Bind" is set "Yes",
"Bind DN" and "Bind Password" are set blank,
"Disable vBulletin Users" is set "No"

When I login with my domain account, it shows "You have entered an invalid username or password. ..."

3. "Anonymous Bind" is set "No",
"Bind DN" is set "Administrator"
"Bind Password" is set password for account "Administrator" in domain "test.com",
"Disable vBulletin Users" is set "Yes"

When I login with my domain account, it shows "Failed to bind to LDAP directory (Initial bind)"

4. "Anonymous Bind" is set "No",
"Bind DN" is set "Administrator"
"Bind Password" is set password for account "Administrator" in domain "test.com",
"Disable vBulletin Users" is set "No"

When I login with my domain account, it shows "You have entered an invalid username or password. ..."

Could you please tell me that did I get anything wrong for your program? Thank you!

I think I figured my problem out.

Haqa,

In your instructions you say to place the line below in to config.php

//LDAP Access Control
define('DISABLE_PASSWORD_CLEARING', 1);

Did you mean to say global.php?

Once I added it to global.php I was able to authenticate most of my users. I do believe there's a problem with users that have very long passwords. They're not able to log in.

I got some PMs asking how I got Haqa's plugin working in 3.8.1 so here's what I did...

Start off by creating a hook in login.php and registering it by following the directions here:
https://vborg.vbsupport.ru/showthread.php?t=148573

Do the edit to global.php mentioned in the directions above. I verified that the 1 and 0 for DISABLE_PASSWORD_CLEARING in global.php were swapped in 3.8.1. If you don't do that edit, vb will encrypt the user's password in an md5 hash onsubmit of the login form. Unless your AD passwords are stored in an md5 hash, the password check will fail.

Install Haqa's plugin and go into the plugin manager and set it to fire on the new hook you created. I setup some logging in the plugin code so I could see what was going on. If you get this far, it's all configuration from there.


I extracted the logging code from the plugin linked above to help me debug and added it to Haqa's plugin code:


The only downside of this approach is that I had to edit vb source. This is only a temporary solution I hope. I just upgraded to 3.8.2 and saw that global.php and login.php were both overwritten... Hopefully Haqa comes up with a way do to all this without altering any vb source.

Something else for people that are having trouble... vb uses your email as a primary key for users. Initially, my vb admin account was setup to use my email. When I went to test the plugin by using my username from AD to log in, the plugin code tried to create me a new account but failed because my email was already in use by the admin account.