The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
LDAP Authentication Details »» | |||||||||||||||||||||||||||
I've only recently started using vBulletin, and this is my first mod so if you use this, please click Installed!
This mod (which builds on the fine work from malcomx and zemic) is intended to lower the barriers to using and LDAP directory as an external authentication source for your board. The idea is simple; capture a login attempt before authentication and test it against LDAP first, if that succeeds, see if there is already a matching user in vBulletin. If there is not, create one, using data from the LDAP to fill in the required fields, if there is already a matching user (Determined by comparing email addresses) then update the user. You might be asking why this mod is better than the two mods I've mentioned above? Well firstly the only additional file is the XML file for the new hooks (See below), and no changes to vBulletin code so installation is simple, and upgrades to vBulletin don't get over complicated by re-applying changes. Secondly, all the settings are controlled from the admincp rather than an external config file. Thirdly (as if two wasn't enough) I've added some hook points so this mod can be extended, for example to get additional data from the LDAP and put it in user profile fields. One important similarity with the two earlier mods is that in the admincp and modcp no LDAP authentication is performed, this is a safety feature, so even if the mod or an extending to it, breaks your board, you shouldn't ever get locked out of the admincp so you'll be able to turn if off quickly. Additional Hooks The mod is essentially a single plugin (plus options and help) which runs at global_complete which is before most other things have happened, but just after all the global setup has occurred. To enable the additional hooks, you need to upload the file hooks_ldap_auth.xml to /includes/xml under your forum. The following new hooks are created by this mod:
By requesting new attributes at ldap_auth_start and then applying them at either ldap_auth_all_user, ldap_auth_new_user or ldap_auth_existing_user you can setup your users easily without having to write all the LDAP code yourself! AdminCP Settings This mod creates a new options group called LDAP Authentication between email options and user registration options where you set the host name and port number of the LDAP server, the initial authentication type (Anonymous or authenticated), optionally the BindDN and Password for the LDAP server. You also set which attribute matches the vBulletin username (The default is cn which works well for inetOrgPerson based entries). You can set additional attributes to retrieve (If you want to quickly knock up a simple plugin which uses them at one of the hook points above). There is also the facility to disable (or rather make unavailable) accounts which exist in vBulletin but not in LDAP. Given that your initial admin may fall into this group, there is also a list of userids who should be allowed to log in anyway. Requirements
I'll try to provide support to users of my mod, but please bear in mind I fairly new to all this, so I may not be able to solve all problems immediately. Support will only be provided via this thread (Don't PM or email me unless I ask you to). Priority will be given to users who have clicked Installed. Release Notes
Installation
Haqa... Download Now
Show Your Support
|
Благодарность от: | ||
Jimbot |
Comments |
#132
|
|||
|
|||
Quote:
I run on Windows, so installing LDAP support for PHP was simply an option I chose in the PHP installer (under 'extensions' if I recall correctly). Good luck! |
Благодарность от: | ||
jugbugs |
#133
|
|||
|
|||
I am new to vBulletin so this is all new to me. I just installed the LDAP Authentication plugin referenced in this thread and for the most part it seems to be working just fine. However, I have a question. I have logged in as two different users from our LDAP server and vBulletin did indeed allow them to login and did create user accounts for them. However, I noticed that for some reason the "Primary Usergroup" for both of those users was set by default to "Super Moderators". It seems to me that they should be set to "Registered Users" instead.
If I go into the vbulletin admin panel and manually add a user the default settings does seem to be "Registered Users". Is there any way to tell the LDAP Authentication plugin that new users should be created as "Registered Users" instead of "Super Moderators"? Thanks in advance. |
#134
|
|||
|
|||
Quote:
If you're using my version, from the post above, you'll need to edit line 193 of the plugin, shown in the snip below. The line that sets the usergroupid to 5 makes the new user a supermoderator. The 'Registered users' group has a usergroupid of 2 (at least it does in mine). So change the 5 to a 2, and that should resolve the issue. The usergroup IDs can be found in Usergroup manager in the admin control panel. PHP Code:
|
#135
|
|||
|
|||
Quote:
Code:
$newuser->set('usergroupid', 5); Code:
$newuser->set('usergroupid', 2); Thank you. |
#136
|
|||
|
|||
Quote:
Thanks again. |
#137
|
|||
|
|||
Quote:
What we really should do is make it a config setting. Not sure when I'll get time to do this.... |
#138
|
|||
|
|||
I didn't have any luck with using the original set_userfields method. The aforementioned code had:
PHP Code:
PHP Code:
Has anyone conceived of the idea or attempted setting the username to the LDAP 'displayname' or 'givenname' and 'sn' while allowing the user to both login and authenticate using their LDAP credentials? ie, login as: jdoe, but username is set to John Doe so that all posts, member list, user profile and all show John Doe. My forum is internal, consists only of LDAP users all on the same domain and I've disabled registration since the LDAP auth code can create a new user. I've made a user profile field set to displayname but if I don't have to go through and modify the template to show the displayname userfield in lieu of username, that would be awesome. Unless it's easier now to modify the template using the built-in search/replace? Suggestions or ideas? |
#139
|
|||
|
|||
Quote:
|
#140
|
|||
|
|||
I have another question, which is php related.
I have this plugin (vb4 version) and it is working, however, I cannot get the "Allow Built-in Accounts" (ldap_allow_builtin) setting to work when putting in a comma separated list. If I only have one userid in this setting it works for that user only, which leads me to believe this is an easy solution. Given the fact that I am php retard, the answer is not glaringly obvious, therefore, I will summarize what I know in hopes someone can help me. In the product xml, this variable (setting) is defined as follows: Code:
<setting varname="ldap_allow_builtin" displayorder="100"> <datatype>free</datatype> <defaultvalue>1</defaultvalue> </setting> PHP Code:
Thanks. |
#141
|
||||
|
||||
Quote:
Thanks to everyone for their excellent work! I have successfully implemented the above version on vBulletin 4.1.10 With regard to this problem: Quote:
After: PHP Code:
PHP Code:
Hope this helps someone Alex |
Thread Tools | |
|
|
X vBulletin 3.8.12 by vBS Debug Information | |
---|---|
|
|
More Information | |
Template Usage:
Phrase Groups Available:
|
Included Files:
Hooks Called:
|