Miscellaneous Hacks - LDAP Authentication

I've only recently started using vBulletin, and this is my first mod so if you use this, please click Installed!

This mod (which builds on the fine work from malcomx and zemic) is intended to lower the barriers to using and LDAP directory as an external authentication source for your board. The idea is simple; capture a login attempt before authentication and test it against LDAP first, if that succeeds, see if there is already a matching user in vBulletin. If there is not, create one, using data from the LDAP to fill in the required fields, if there is already a matching user (Determined by comparing email addresses) then update the user.

You might be asking why this mod is better than the two mods I've mentioned above? Well firstly the only additional file is the XML file for the new hooks (See below), and no changes to vBulletin code so installation is simple, and upgrades to vBulletin don't get over complicated by re-applying changes. Secondly, all the settings are controlled from the admincp rather than an external config file. Thirdly (as if two wasn't enough) I've added some hook points so this mod can be extended, for example to get additional data from the LDAP and put it in user profile fields.

One important similarity with the two earlier mods is that in the admincp and modcp no LDAP authentication is performed, this is a safety feature, so even if the mod or an extending to it, breaks your board, you shouldn't ever get locked out of the admincp so you'll be able to turn if off quickly.

Additional Hooks

The mod is essentially a single plugin (plus options and help) which runs at global_complete which is before most other things have happened, but just after all the global setup has occurred.

To enable the additional hooks, you need to upload the file hooks_ldap_auth.xml to /includes/xml under your forum.

The following new hooks are created by this mod:

• ldap_auth_start - After the list of attributes to fetch has been created, this list is in $ldapAttrs. You can simply add your own attributes to this array here.
• ldap_auth_all_user - After a new user has been added to vBulletin or existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData. This happens before ldap_auth_new_user or ldap_auth_existing_user.
• ldap_auth_new_user - After a new user has been added to vBulletin, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.
• ldap_auth_existing_user - After an existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.

By requesting new attributes at ldap_auth_start and then applying them at either ldap_auth_all_user, ldap_auth_new_user or ldap_auth_existing_user you can setup your users easily without having to write all the LDAP code yourself!

AdminCP Settings

This mod creates a new options group called LDAP Authentication between email options and user registration options where you set the host name and port number of the LDAP server, the initial authentication type (Anonymous or authenticated), optionally the BindDN and Password for the LDAP server. You also set which attribute matches the vBulletin username (The default is cn which works well for inetOrgPerson based entries). You can set additional attributes to retrieve (If you want to quickly knock up a simple plugin which uses them at one of the hook points above). There is also the facility to disable (or rather make unavailable) accounts which exist in vBulletin but not in LDAP. Given that your initial admin may fall into this group, there is also a list of userids who should be allowed to log in anyway.

Requirements

• PHP 4.3+ with LDAP support.

I'll try to provide support to users of my mod, but please bear in mind I fairly new to all this, so I may not be able to solve all problems immediately. Support will only be provided via this thread (Don't PM or email me unless I ask you to). Priority will be given to users who have clicked Installed.

Release Notes

• 1.0 - Initial release
• 1.1 - Corrected SQL queries to use TABLE_PREFIX
• 1.2 - Corrected a bug which prevented the settings page from being created correctly
• 1.3 - Corrected where the existing, new and all user hooks are called (Before, not after the user profile fields are set) to support dependant plugins
• 1.4 - Added the ability to set a search base for directories which do not permit searching from the root
• 1.5 - Fixed reported bug where hooks were called in the wrong order

Installation

1. Add the command define('DISABLE_PASSWORD_CLEARING', 1); to your includes/config.php - This will NOT be overwritten by upgrades, so only needs doing once.
2. Upload the file hooks_ldap_auth.xml to includes/xml under your forum.
3. Install the latest product file (below) using the Add/Import Product link on the Manage Products page under Plugins & Products in your AdminCP.

Haqa...

[Haqa]

Originally Posted by kamalrij

We're using this plugin along with Full Name support for LDAP Auth plugin to connect to our corporate LDAP directory.

The official email ID of people in our company is to change from handle@company.com to firstname.lastname@company.com.

When people try to login after their email ID has changed they get the following error

vBulletin Message
Error creating/updating user
Array

Once the email ID updated to firstname.lastname@company.com from the admin control panel they are able to login.

Is there a way to be dynamically updated every time everytime a user logs in through this plugin OR for the user to be allowed to login with his ldap credentials but reflecting his handle@company.com ID (i.e. for the authentication to work without the error mentioned earlier).
handle@company.com would be set as an alias to firstname.lastname@company.com on the mail servers so the email notifications would continue to work.

Thanks you in advance
Kamal

The issue here is that the one thing which must not change is the users' email addresses.

You will have to manually update the email address for each account, I'm afraid...

H.

[ysam]

Hi guyz,

Any chance of getting this to work in vb4?

[ysam]

Ok so I am the first to report it works in vb4pl1.

Only problem is

Error creating/updating user
Array

but works ok if you do remove the mysql_real_escape_string() function in

WHERE LOWER(email) = LOWER('".mysql_real_escape_string($userData[0]['mail'][0])."')");

Will Test Further....

Nice work and congrats.

[chri55555]

Hi Ho, this is Chris.

I am also implementing this in VBB4 right now .....

let's get dirty

UPDATE: Ldap_Auth is woring now BUT:

If a user is NOT in the LDAP it will not get generated
Is there a way to generate Users in LDAP from Existing Account data in VBB?
We want LDAP for Moodle and OTRS Integration SingleSignOn - so we need all Usernames with PWDs in LDAP.
( I wanted to export the UserPasswords direct via batch in LDIF BUT the salting prevents me from doing so ... )

Please give me a hint on the right direction,

Chris

[Haqa]

Originally Posted by ysam

Ok so I am the first to report it works in vb4pl1.

Only problem is



but works ok if you do remove the mysql_real_escape_string() function in


Will Test Further....

Nice work and congrats.

Removing that will bite you the first time someone has a character in their email which PHP or MySQL consider significant. We, for example, had a user whos email address contained a single quote (Their name was something like Fred O'Flintstone or something, so the brain-dead windows AD made their email address fred.o'flintstone or something disturbingly similar!!).

YMMV...

Many thanks to all who have taken this and made such progress including getting it to work on 4.0, I'd expected that not to be possible... Well done all!

H.

[FFSBC]

Installed as directed and worked first try without modification. Authenticating against server 2003 AD.

[john.parlane]

We're finding that the 'remember me' tick box is not working. The cookie is not being set correctly so that when the user comes back they have to re-enter their login each time.

Is anybody else gettings this?

Currently working on a fix...

[cowbert]

Originally Posted by Haqa

Removing that will bite you the first time someone has a character in their email which PHP or MySQL consider significant. We, for example, had a user whos email address contained a single quote (Their name was something like Fred O'Flintstone or something, so the brain-dead windows AD made their email address fred.o'flintstone or something disturbingly similar!!).

YMMV...

Many thanks to all who have taken this and made such progress including getting it to work on 4.0, I'd expected that not to be possible... Well done all!

H.

Here is the fixup:

You need to use the new-style object call to escape the chars, don't use the php external function(s) (particularly because people may be using mysqli and so forth)

Replace all instances of "mysql_real_escape_string()" with:

$vbulletin->db->escape_string(htmlspecialchars_uni(

This is how functions_login.php makes the call, so should you...

[john.parlane]

Originally Posted by john.parlane

We're finding that the 'remember me' tick box is not working. The cookie is not being set correctly so that when the user comes back they have to re-enter their login each time.

Is anybody else gettings this?

Currently working on a fix...

Have implemented fix for this, as shown below. The code expands on the "if ($newuser->errors)" statement right at the end.

The problem was that after the user is saved with "$newuser->save()" the cookie salt is changed and the password rehashed in the database. The cookie then doesnt match it. Fix is to simply recreate the cookie by getting and rehashing the db password.

Have also implemented jaikumarm's fix for the first time login issue here.

 if ($newuser->errors) {
  process_logout();
  eval(standard_error("Error creating/updating user<br/>".$newuser->errors));
 } else {
  $newuserid = $newuser->save();
  
  // Saving the user (above) rehashes the password on the DB so now need to update cookie password also, or 'remember me' login optoin will fail.
  $dbuserinfo = $vbulletin->db->query_first_slave("SELECT password FROM vbull.user WHERE username = '$username'");
  if ($dbuserinfo) {
    $db_hashed_pwd = $dbuserinfo['password'];
    $cookie_hashed_pwd = md5($db_hashed_pwd.COOKIE_SALT);
    vbsetcookie('password', $cookie_hashed_pwd);
  }
  
  // Following code is necessary to fix a hook timing issue with this plugin that results in users being told their login credentials are wrong the first time they login with LDAP credentials
  verify_authentication($username, $passwd, $vbulletin->GPC['vb_login_md5password'], $vbulletin->GPC['vb_login_md5password_utf'], $vbulletin->GPC['cookieuser'], true);
  exec_unstrike_user($username);
  process_new_login($vbulletin->GPC['logintype'], $vbulletin->GPC['cookieuser'], $vbulletin->GPC['cssprefs']);
  do_login_redirect();

 }
}

Note that $username needs to be set a the top top of the script, along with $passwd, with:

$username = $vbulletin->GPC['vb_login_username'];
$passwd = $vbulletin->GPC['vb_login_password'];

And I removed the following line (118) which doesnt seem to do anything useful:

$vbulletin->GPC['cookieuser'] = $vbulletin->GPC['vb_login_username'];

[cowbert]

Originally Posted by john.parlane

Have implemented fix for this, as shown below. The code expands on the "if ($newuser->errors)" statement right at the end.

The problem was that after the user is saved with "$newuser->save()" the cookie salt is changed and the password rehashed in the database. The cookie then doesnt match it. Fix is to simply recreate the cookie by getting and rehashing the db password.

Have also implemented jaikumarm's fix for the first time login issue here.

 if ($newuser->errors) {
  process_logout();
  eval(standard_error("Error creating/updating user<br/>".$newuser->errors));
 } else {
  $newuserid = $newuser->save();
  
  // Saving the user (above) rehashes the password on the DB so now need to update cookie password also, or 'remember me' login optoin will fail.
  $dbuserinfo = $vbulletin->db->query_first_slave("SELECT password FROM vbull.user WHERE username = '$username'");
  if ($dbuserinfo) {
    $db_hashed_pwd = $dbuserinfo['password'];
    $cookie_hashed_pwd = md5($db_hashed_pwd.COOKIE_SALT);
    vbsetcookie('password', $cookie_hashed_pwd);
  }
  
  // Following code is necessary to fix a hook timing issue with this plugin that results in users being told their login credentials are wrong the first time they login with LDAP credentials
  verify_authentication($username, $passwd, $vbulletin->GPC['vb_login_md5password'], $vbulletin->GPC['vb_login_md5password_utf'], $vbulletin->GPC['cookieuser'], true);
  exec_unstrike_user($username);
  process_new_login($vbulletin->GPC['logintype'], $vbulletin->GPC['cookieuser'], $vbulletin->GPC['cssprefs']);
  do_login_redirect();

 }
}

Note that $username and $passwd need to be set up at top of script with:

$username = $vbulletin->GPC['vb_login_username'];
$passwd = $vbulletin->GPC['vb_login_password'];

And I removed the following line (118) which doesnt seem to do anything useful:

$vbulletin->GPC['cookieuser'] = $vbulletin->GPC['vb_login_username'];

Remember to use the generic TABLE_PREFIX consts. I would recommend against setting new aliased variables; it only saves typing, and then you have to add additional doco like you do. Just stick with $vbulletin->GPC[]. (Btw $passwd is already assigned on line 30, and $vbulletin->GPC['vb_login_password'] is cleared for safety). And don't forget to $vbulletin->db->escape_string either...