Integration with vBulletin - LDAP Authentication

I've been using Vbulletin for a few years, and have had some great modifications from this community, so having had to recently integrate Vbulletin with LDAP for my University discussion boards I decided to release this as a modification. This is my present to the community .

Description:

LDAP authentication for Vbulletin.

How it works:

This does not modify Vbulletin files or Vbulletin login code in anyway. We simple stick some script infront of the login process so we can validate against LDAP. Below is a breakdown of what this thing does:

• First looks to see if login form has been submitted
• Checks if it should look up "this" user in LDAP (defined in ldapconfig)
• Queries LDAP for the username
  • If user is returned check if VB MD5 password matches LDAP MD5 password
    • If it does, check the VB user table to see if the user is already in the table. If yes, update VB user table password with LDAP password by encrypting MD5 password with the users 'salt' key
    • If not, create a new user in database using VB classes/functions.
  • If user/pass do not match in LDAP then check if user is in VB user table.
    • If they are, change the password to something random so they cannot login with an old password
• If a user is not returned from LDAP, assume the user has registered on the boards in the normal way and dont do anything to the VB user table.

Requirements:

The requirements are based on the system we use. It may / may not work with other Vbulletin versions:

• PHP 4.3+
• LDAP System
• uid (username), mail (email address), and a field containing MD5 password

Installation:

1. Download and unzip the file
2. Edit "ldapconfig.php" and then upload into your "includes" folder
3. Login to Admin CP and Add / Import the product (xml file)

Extra Info / Future Plans / Help:

This LDAP integration script currently requires you to have an LDAP field with the users password stored as MD5. From my understanding, CRYPT is the default password storage for LDAP so some of you may not have an MD5 field in LDAP with the users password encrypted as MD5.

It would be possible to modify the script to check against CRYPT, but it would also require a template edit as the login form converts the password field "onSubmit" to MD5. I did not do this because we already have the MD5 in LDAP as we use it on a number of different system already, and I did not want to change VB templates.

Also, I was unable to find documentation on doing a script / releasing a modification, so in future if someone could explain to me or change the script slightly to allow editing of LDAP configuration file within ADMIN CP interface, that would be great. This would also mean not having to upload a file into the includes folder.

I'm sure there will be something I havent thought of, or will make it easier if this script had this and that, so feel free to post your ideas, and suggestions on improving this modification.

Important Info:
Hack is provided free of charge (but if you really want to get rid of money PM me ). I make no guarantee it will work on your system, but it does on mine with 15,000 users .

Version:

• 1.1 - You can now specify the field to authenticate against in ldapconfig.php (19/05/2007)
• 1.0.1 - Corrected 'mysql_num_rows' query to use VB DB class call (19/04/2007)
• 1.0 - First release (18/04/2007)

Hope its useful for some of you :up:

[Iceboxer]

Hi, Zemic:

Brilliant bit, thanks (for those of us desperately trying to integrate VB with a CMS)...may I ask what Directory Server you are using? Red Hat, or Sun, or...? I note you mentioned Active Directory as something you are clearly NOT using. Did you write your own directory server?

Second, do I take it from your explanation that your hack authenticates but does not populate the directory?

Thanks,

Iceboxer

[zemic]

Originally Posted by Iceboxer

Hi, Zemic:

Brilliant bit, thanks (for those of us desperately trying to integrate VB with a CMS)...may I ask what Directory Server you are using? Red Hat, or Sun, or...? I note you mentioned Active Directory as something you are clearly NOT using. Did you write your own directory server?

Second, do I take it from your explanation that your hack authenticates but does not populate the directory?

Thanks,

Iceboxer

Thanks !

You could integrate the code with pretty much anything i.e. a CMS. Just change the bit of code that speaks to VB to talk to your CMS. Making a connection to LDAP, authenticating etc. is standard PHP/LDAP code, nothing fancy. Read through the plugin code. I've commented on every bit of the login process.

We are on SUN systems, with the look of bringing in Active Directory during this year (not my idea! those upstairs ). I didnt write the directory server and im not responsible for any part of the LDAP system. Leave the headache of that to the system admins , but I know we have extra fields over a standard "installation" of LDAP i.e. MD5.

As mentioned earlier.......Ideally this script would authenticate against CRYPT, but without changing Vb code it wont. *I THINK* most establishments that use ldap will have the password stored in MD5 as well as crypt anyway, so this is probably not as big of an issue as I think it is, but I point it out incase someone scratches their heads for hours trying to figure out why this script might not work with their system. I can post some extra CRYPT instructions if neccessary.

My hack does not change anything in LDAP. I assume that LDAP is always correct. We have other tools to change password in LDAP so this was not needed. If you want to though, you could add a bit of code so that when the user changes his/her password in Vbulletin it would update LDAP, but here, I've removed the link to "Change Password" from USER CP in Vbulletin just incase the users get confused; we have another website/tool for users to manage their computer account.

[Iceboxer]

Zemic:

Thanks again. I'm struggling to "get" the LDAP concept - not so much in straight-up validation, LDIF, etc., but in populating the Directory db in an automatic fashion and in figuring out how to make this work regardless of which (VB, my CMS, etc.) program is used for user registration - which from your earlier posts, isn't a problem with which you've had to concern yourself. :-)

I'm slogging through some tutorials on LDAP now, and hopefully I can figure this out. :erm: However, that being said, it's a GREAT help to those of us out here trying to create fully integrated sites to have this Add-on from you, and I just wanted to express my gratitude...it's made my day to see this here.

Thx,

Iceboxer

[zemic]

No problem, if its useful for someone other than me then thats made my day . I've not populated LDAP myself before so dont think I could be of any help. We have other (mainly payroll) type software / system to do that automatically, as well as perl scripts which can be run on a server - code written "in-house" by other people so cannot share im afraid.

Let me know how you get on. :up:

[fhs2006]

i am sorry to say, but as long as i have to use md5 in ldap so the hashes match, this thing is not really useful. most of the time, people want to use an existing ldap directory, where 99% of the time another password mechanism is used (crypt, sha1). i stick with the plugin from www.sartori.at

[zemic]

Like I said in a previous post, this could be modified to work with CRYPT. All that is required is changing the VBulletin login form (template) so it doesnt MD5 the password as soon as you hit enter ( I would need to look into possibility of this breaking something else) or leave the MD5 thing, and pass plain text password, or crypt the password on submit. A simple template edit would do this.

Give me a couple of days to fit this in around work and I'll do it.

Cant see what that script at the above URL does any different to mine. If you've got the code to share, or could give me a hint, I'm sure I could add something into mine to do the same. Could save people 100euro's

[fhs2006]

yes i do have the code, because i bought this plugin. but to be honest, i will not share the code. it would not be fair towards the developer. selling php code is always pain in the ass and a developer who sells his piece of code trusts his customers.

[zemic]

Fair enough .

If anyone has feature requests, just reply to the topic or PM me.

[David_McPherson]

Zemic,
You have no idea what this means for me at this moment.. If I can get this to function I'll be a happy, happy man.

I'm getting this... when I attempt to login with a known user in our LDAP system.

Fatal error: Call to undefined function: ldap_connect() in D:\Intranet\links\forum\global.php(356) : eval()'d code on line 25

Idea? And... I cannot even log into the forum under my admin to reverse the process.

[zemic]

Hello !

To me, that looks like your running PHP in a Windows environment, and it doesnt support LDAP. I've just downloaded my code again from here just incase I'd done a little mistake in the code after a recent update, but deffo havent.

To remove the Product / Plugin you'll need to edit your config.php file to disable plugins. I'll have a search on the forums for the variable to put into your config.php now, because I cant remember off the top of my head....