Miscellaneous Hacks - LDAP Authentication

I've only recently started using vBulletin, and this is my first mod so if you use this, please click Installed!

This mod (which builds on the fine work from malcomx and zemic) is intended to lower the barriers to using and LDAP directory as an external authentication source for your board. The idea is simple; capture a login attempt before authentication and test it against LDAP first, if that succeeds, see if there is already a matching user in vBulletin. If there is not, create one, using data from the LDAP to fill in the required fields, if there is already a matching user (Determined by comparing email addresses) then update the user.

You might be asking why this mod is better than the two mods I've mentioned above? Well firstly the only additional file is the XML file for the new hooks (See below), and no changes to vBulletin code so installation is simple, and upgrades to vBulletin don't get over complicated by re-applying changes. Secondly, all the settings are controlled from the admincp rather than an external config file. Thirdly (as if two wasn't enough) I've added some hook points so this mod can be extended, for example to get additional data from the LDAP and put it in user profile fields.

One important similarity with the two earlier mods is that in the admincp and modcp no LDAP authentication is performed, this is a safety feature, so even if the mod or an extending to it, breaks your board, you shouldn't ever get locked out of the admincp so you'll be able to turn if off quickly.

Additional Hooks

The mod is essentially a single plugin (plus options and help) which runs at global_complete which is before most other things have happened, but just after all the global setup has occurred.

To enable the additional hooks, you need to upload the file hooks_ldap_auth.xml to /includes/xml under your forum.

The following new hooks are created by this mod:

• ldap_auth_start - After the list of attributes to fetch has been created, this list is in $ldapAttrs. You can simply add your own attributes to this array here.
• ldap_auth_all_user - After a new user has been added to vBulletin or existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData. This happens before ldap_auth_new_user or ldap_auth_existing_user.
• ldap_auth_new_user - After a new user has been added to vBulletin, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.
• ldap_auth_existing_user - After an existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.

By requesting new attributes at ldap_auth_start and then applying them at either ldap_auth_all_user, ldap_auth_new_user or ldap_auth_existing_user you can setup your users easily without having to write all the LDAP code yourself!

AdminCP Settings

This mod creates a new options group called LDAP Authentication between email options and user registration options where you set the host name and port number of the LDAP server, the initial authentication type (Anonymous or authenticated), optionally the BindDN and Password for the LDAP server. You also set which attribute matches the vBulletin username (The default is cn which works well for inetOrgPerson based entries). You can set additional attributes to retrieve (If you want to quickly knock up a simple plugin which uses them at one of the hook points above). There is also the facility to disable (or rather make unavailable) accounts which exist in vBulletin but not in LDAP. Given that your initial admin may fall into this group, there is also a list of userids who should be allowed to log in anyway.

Requirements

• PHP 4.3+ with LDAP support.

I'll try to provide support to users of my mod, but please bear in mind I fairly new to all this, so I may not be able to solve all problems immediately. Support will only be provided via this thread (Don't PM or email me unless I ask you to). Priority will be given to users who have clicked Installed.

Release Notes

• 1.0 - Initial release
• 1.1 - Corrected SQL queries to use TABLE_PREFIX
• 1.2 - Corrected a bug which prevented the settings page from being created correctly
• 1.3 - Corrected where the existing, new and all user hooks are called (Before, not after the user profile fields are set) to support dependant plugins
• 1.4 - Added the ability to set a search base for directories which do not permit searching from the root
• 1.5 - Fixed reported bug where hooks were called in the wrong order

Installation

1. Add the command define('DISABLE_PASSWORD_CLEARING', 1); to your includes/config.php - This will NOT be overwritten by upgrades, so only needs doing once.
2. Upload the file hooks_ldap_auth.xml to includes/xml under your forum.
3. Install the latest product file (below) using the Add/Import Product link on the Manage Products page under Plugins & Products in your AdminCP.

Haqa...

[john.parlane]

Yep agreed, these are all things you could do to make it more robust.

[Teamghost]

My user try to get the password - I thought this is disabled with the

PHP Code:

define('DISABLE_PASSWORD_CLEARING', 1); 


in the config file. How can I disable this function for Ldap User?

'Disable vBulletin Users' is No - I think this is related to this problem.

I'm using 3.8.4 and ldap 1.5 with the 'first logIn' fix

[fth]

thanks for such a great plugin easy to use is there anyone try to transfer dateof birth and avatar from ldap to vbulletin? its because this plugin is only transfer email username and password

thanks.

[fth]

Originally Posted by Haqa

The issue here is that the one thing which must not change is the users' email addresses.

You will have to manually update the email address for each account, I'm afraid...

H.

Anyone fix this problem? if ldap user change their email address from ldap and then try to login again it says
Error creating/updating user
Array

vb 4.02

[fth]

is there anyone help me how can i set language for this plugin some non english characters on the location doesnt appear properly if not english at all thanks

[jjuarez]

Hi, Does anyone has make ldap work on vb 4.0.7?

I follow install instructions, but when I try to login with a AD valid user, display error "500 Internal Server Error" page.

Please help me...

Tanks a Lot.

jjuarez

[ginab143]

Originally Posted by jjuarez

Hi, Does anyone has make ldap work on vb 4.0.7?

I follow install instructions, but when I try to login with a AD valid user, display error "500 Internal Server Error" page.

Please help me...

Tanks a Lot.

jjuarez

I really need help as well. All I get is a blank page with this in the address field: http://hostname/login.php?do=login

No errors or anything else. I know I have the LDAP connections setup properly because I have other apps that I connect with LDAP that use the same parameters.

I haven't made any mods to the code that I see others talking about. If someone could provide a little direction I can figure it out from there.

Thanks

[Abe Koenghiem]

I really need help as well. All I get is a blank page with this in the address field: http://hostname/login.php?do=login

When I get blank pages it is usually caused by permissions problems. If you are using apache then the user you configured in the httpd.conf file (usually apache) must have permission to read the vBulletin files. There may be a better explaination of this on the board somewhere, if someone knows, please post a link.

If this is the cause; then it is just a webserver configuration problem and not a problem with LDAP or this mod.

Good luck ginab143

[ginab143]

Originally Posted by Abe Koenghiem

When I get blank pages it is usually caused by permissions problems. If you are using apache then the user you configured in the httpd.conf file (usually apache) must have permission to read the vBulletin files. There may be a better explaination of this on the board somewhere, if someone knows, please post a link.

If this is the cause; then it is just a webserver configuration problem and not a problem with LDAP or this mod.

Good luck ginab143

Thanks for the suggestion Abe. I played with this all day yesterday and couldn't get it to work. I get the 500 error on IE and blank on FF. I'm hosting this on an in-house 2003 IIS server to 2003 AD. I tried adding full permissions on the files, playing around with the IIS security, tried the mods from some of these posts... Nada. If there is anywhere else I should look at permissions I would love to know.

I can also connect over ldap from the command line using the same credentials so I know it is not a host connection issue. I just don't get it. I was really hoping to use ldap because I want to use VB as the front end for my end users. If they have to remember another password I may be in trouble.

If anyone else has any ideas I'm all ears.

Thanks

[jjuarez]

Hi, the error 500 is because I don´t have Ldap support on Php installation.

Just install or reinstall PHP with LDAP Support and this resolve the Blank page.

Now, there are some way to debug the Ldap connection, because I configure the LDAP Settings and when I try authenticate with an Active ¿Directory valid user, only say thar I entered an invalid username or password.

Tanks a Lot