Miscellaneous Hacks - LDAP Authentication

I've only recently started using vBulletin, and this is my first mod so if you use this, please click Installed!

This mod (which builds on the fine work from malcomx and zemic) is intended to lower the barriers to using and LDAP directory as an external authentication source for your board. The idea is simple; capture a login attempt before authentication and test it against LDAP first, if that succeeds, see if there is already a matching user in vBulletin. If there is not, create one, using data from the LDAP to fill in the required fields, if there is already a matching user (Determined by comparing email addresses) then update the user.

You might be asking why this mod is better than the two mods I've mentioned above? Well firstly the only additional file is the XML file for the new hooks (See below), and no changes to vBulletin code so installation is simple, and upgrades to vBulletin don't get over complicated by re-applying changes. Secondly, all the settings are controlled from the admincp rather than an external config file. Thirdly (as if two wasn't enough) I've added some hook points so this mod can be extended, for example to get additional data from the LDAP and put it in user profile fields.

One important similarity with the two earlier mods is that in the admincp and modcp no LDAP authentication is performed, this is a safety feature, so even if the mod or an extending to it, breaks your board, you shouldn't ever get locked out of the admincp so you'll be able to turn if off quickly.

Additional Hooks

The mod is essentially a single plugin (plus options and help) which runs at global_complete which is before most other things have happened, but just after all the global setup has occurred.

To enable the additional hooks, you need to upload the file hooks_ldap_auth.xml to /includes/xml under your forum.

The following new hooks are created by this mod:

• ldap_auth_start - After the list of attributes to fetch has been created, this list is in $ldapAttrs. You can simply add your own attributes to this array here.
• ldap_auth_all_user - After a new user has been added to vBulletin or existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData. This happens before ldap_auth_new_user or ldap_auth_existing_user.
• ldap_auth_new_user - After a new user has been added to vBulletin, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.
• ldap_auth_existing_user - After an existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.

By requesting new attributes at ldap_auth_start and then applying them at either ldap_auth_all_user, ldap_auth_new_user or ldap_auth_existing_user you can setup your users easily without having to write all the LDAP code yourself!

AdminCP Settings

This mod creates a new options group called LDAP Authentication between email options and user registration options where you set the host name and port number of the LDAP server, the initial authentication type (Anonymous or authenticated), optionally the BindDN and Password for the LDAP server. You also set which attribute matches the vBulletin username (The default is cn which works well for inetOrgPerson based entries). You can set additional attributes to retrieve (If you want to quickly knock up a simple plugin which uses them at one of the hook points above). There is also the facility to disable (or rather make unavailable) accounts which exist in vBulletin but not in LDAP. Given that your initial admin may fall into this group, there is also a list of userids who should be allowed to log in anyway.

Requirements

• PHP 4.3+ with LDAP support.

I'll try to provide support to users of my mod, but please bear in mind I fairly new to all this, so I may not be able to solve all problems immediately. Support will only be provided via this thread (Don't PM or email me unless I ask you to). Priority will be given to users who have clicked Installed.

Release Notes

• 1.0 - Initial release
• 1.1 - Corrected SQL queries to use TABLE_PREFIX
• 1.2 - Corrected a bug which prevented the settings page from being created correctly
• 1.3 - Corrected where the existing, new and all user hooks are called (Before, not after the user profile fields are set) to support dependant plugins
• 1.4 - Added the ability to set a search base for directories which do not permit searching from the root
• 1.5 - Fixed reported bug where hooks were called in the wrong order

Installation

1. Add the command define('DISABLE_PASSWORD_CLEARING', 1); to your includes/config.php - This will NOT be overwritten by upgrades, so only needs doing once.
2. Upload the file hooks_ldap_auth.xml to includes/xml under your forum.
3. Install the latest product file (below) using the Add/Import Product link on the Manage Products page under Plugins & Products in your AdminCP.

Haqa...

[nsidcwww]

Okay, so I got it working, somewhat...I basically added uid into the Naming Attribute field and now LDAP users are able to login, however, I get the following error message....

Error creating/updating user
Array

Now, what I did was the following:

1) Removed the hooks_ldap.xml

2) Removed the codes in the login.php file

3) Left the codes in the global.php file

4) Using the following LDAP settings:

HOST: My LDAP Server
LDAP PORT: 389
ANONYMOUS BIND: Yes
BIND DN: [Blank]
BIND PASSWORD: [Blank]
NAMING ATTRIBUTE: uid
SEARCH BASE DN: dc=colorado,dc=edu
LDAP ATTRIBUTES: cn=nsidc,ou=group,ou=people
DISABLE VBULLETIN USERS: Yes
ALLOW BUILT-IN ACCOUNTS: 1

I am so close, if anyone can assist me with overcoming this latest error, I would greatly appreciate it.

[nsidcwww]

Okay, so I fixed it by changing the following setting:

NAMING ATTRIBUTE: uid

to the followng:

NAMING ATTRIBUTE: mail

But I would like to username/uid instead.

Any thoughts of getting that to work correctly?

[Abe Koenghiem]

Haqa,

If you use a sniffer on the client's network port you see this.

POST /forum/login.php?do=login HTTP/1.1 (application/x-www-form-urlencoded)

vb_login_username=abek&vb_login_password=ThePlainT extPasswordOfAbeK&s=&securityt oken=guest&do=login&vb_login_md5password=dbfe6013c 281e40468727267d7441951&vb_log in_md5password_utf=dbfe6013c281e40468727267d744195 1

Is there anyway to stop the contents of vb_login_password from being sent as plain text from the client PC to the server?

Other than this issue, this is a great mod.

---------------------------------
EDIT

The answer to my question seems to be to serve the pages from a https server.

I have it working, vB3.8.4

[brandon515]

I just spent hours trying to get this mod to work. For anyone that is having problems, follow the directions for the mod, then:

Disable vBulletin Users: YES

[Teamghost]

Originally Posted by kamalrij

This quick fix resolved the issue related to the error around first login for the user.

:up: Yeap - this is missing for 3.8.4

great work

Thank you both

[Abe Koenghiem]

I cannot delete a few users using admincp under vB3.8.4, PHP 5.2.9, MySQL 5.0.84
I receive no error, instead I always receive a 'Deleted User Successfully' message.
And the user is always still there.

The user does not show as banned, has no threads or posts, is not a moderator.
The pattern is: users created by admincp or through vB registration can be deleted.
Users created by logging in with LDAP authentication cannot be deleted. even after the LDAP mod is disabled, uninstalled, files removed and config.php changed back. These users also seem to be uneditable.

The only other mod is vBGallery.
And I am serving https pages to protect the LDAP passwords.
I have looked at the code and the XXXXXuser table without seeing anything.
My searches on un-deletable vB users do not turn up any clues.
The funny thing is other users delete just fine.
Any thoughts?

[cschroeder1]

I have this plugin working beautifully with our active directory. my only objection is that since we do not allow anonymous BIND, in the LDAP options control panel after setup it continues to display the BIND password in plain text. We have more than one vBulletin admin, but they do not need to know the LDAP setup, and as far as I can tell, I can't restrict the LDAP Authentication options by individual admin, nor can I figure out how to have the LDAP control panel just display a blank box or dots, rather than the actual value for that parameter. Ideas anyone?

[Praxis]

Originally Posted by nsidcwww

Okay, so I fixed it by changing the following setting:

NAMING ATTRIBUTE: uid

to the followng:

NAMING ATTRIBUTE: mail

But I would like to username/uid instead.

Any thoughts of getting that to work correctly?

If no one told you it should work using sAMAccountName that gives you your Windows login account. If you have an account like john.smith LDAP will see it as john smith, sAMAccountName tosses in the dot.

[cvcheart]

After installing this product as listed in the instructions I don't belive it is working properly. The odd part is I receive no error messages. Everything looks to be correct in the LDAP settings. Anyone run into this before?

Do users still have to register or does it create the user automatically?

[bkoeppel]

Hello,

I'm using this Addon with vBulletin 3.8.4. It basically works, but:
- I had to add another ldap_bind, because I can only fetch data with a proxy user. After the ldap_auth_start-Hook:

PHP Code:

// re-bind with the proxy user, because the normal user has no access
// Bind (authenticate or anonymous depending on settings
if ($vbulletin->options['ldap_anon_bind']) {
 $ldap_bind = ldap_bind($ldapConnection);
} else {
 $ldap_bind = ldap_bind($ldapConnection, $vbulletin->options['ldap_bind_dn'], $vbulletin->options['ldap_bind_password']);
}

// ldap bind did not succeed, wrong Bind DN/Password combination in configuration
if ($ldap_bind != 1) {
 ldap_close($ldapConnection);
 if ($vbulletin->options['ldap_disable_internal_users']) {
  process_logout();
  eval(standard_error("Failed to bind to LDAP directory (Initial bind)"));
 }
 return;
} 


- whenever a user comes for the first time, or the first time after he changed his password in the LDAP database, he has no access. He sees: "You have entered an invalid username or password. Please press the back button, enter the correct details and try again.".
When he tries right again, the login works.
How could I fix that?


Anyway, great mod! Thanks.