Integration with vBulletin - LDAP Authentication

I've been using Vbulletin for a few years, and have had some great modifications from this community, so having had to recently integrate Vbulletin with LDAP for my University discussion boards I decided to release this as a modification. This is my present to the community .

Description:

LDAP authentication for Vbulletin.

How it works:

This does not modify Vbulletin files or Vbulletin login code in anyway. We simple stick some script infront of the login process so we can validate against LDAP. Below is a breakdown of what this thing does:

• First looks to see if login form has been submitted
• Checks if it should look up "this" user in LDAP (defined in ldapconfig)
• Queries LDAP for the username
  • If user is returned check if VB MD5 password matches LDAP MD5 password
    • If it does, check the VB user table to see if the user is already in the table. If yes, update VB user table password with LDAP password by encrypting MD5 password with the users 'salt' key
    • If not, create a new user in database using VB classes/functions.
  • If user/pass do not match in LDAP then check if user is in VB user table.
    • If they are, change the password to something random so they cannot login with an old password
• If a user is not returned from LDAP, assume the user has registered on the boards in the normal way and dont do anything to the VB user table.

Requirements:

The requirements are based on the system we use. It may / may not work with other Vbulletin versions:

• PHP 4.3+
• LDAP System
• uid (username), mail (email address), and a field containing MD5 password

Installation:

1. Download and unzip the file
2. Edit "ldapconfig.php" and then upload into your "includes" folder
3. Login to Admin CP and Add / Import the product (xml file)

Extra Info / Future Plans / Help:

This LDAP integration script currently requires you to have an LDAP field with the users password stored as MD5. From my understanding, CRYPT is the default password storage for LDAP so some of you may not have an MD5 field in LDAP with the users password encrypted as MD5.

It would be possible to modify the script to check against CRYPT, but it would also require a template edit as the login form converts the password field "onSubmit" to MD5. I did not do this because we already have the MD5 in LDAP as we use it on a number of different system already, and I did not want to change VB templates.

Also, I was unable to find documentation on doing a script / releasing a modification, so in future if someone could explain to me or change the script slightly to allow editing of LDAP configuration file within ADMIN CP interface, that would be great. This would also mean not having to upload a file into the includes folder.

I'm sure there will be something I havent thought of, or will make it easier if this script had this and that, so feel free to post your ideas, and suggestions on improving this modification.

Important Info:
Hack is provided free of charge (but if you really want to get rid of money PM me ). I make no guarantee it will work on your system, but it does on mine with 15,000 users .

Version:

• 1.1 - You can now specify the field to authenticate against in ldapconfig.php (19/05/2007)
• 1.0.1 - Corrected 'mysql_num_rows' query to use VB DB class call (19/04/2007)
• 1.0 - First release (18/04/2007)

Hope its useful for some of you :up:

[rjmjr69]

Originally Posted by KevNJ

As said above... It is one of those things that if you don't know what it does, you don't need it.

I agree I dont need it but regardless I would like to LEARN more about it. And the question was directed to the author thank you.

[zemic]

Its one of them things, if you dont use it you dont need it as said above but....

Best example I can give is of my work..... we use LDAP to authenticate users accross different services we offer on campus - logging into computers, access programs, databases, and web sites. On the web for example our CMS, Blackboard, Campus Pipeline, Intranet and now VBulletin all authenticate against LDAP. This allows us to give out 1 username and password to every staff and student to access any service we offer; we can restrict access via LDAP as well.

There's a bit more to it than that. You've got to have someone to populate LDAP, or some program to automatically insert / update records i.e. our finance department enter a new staff member onto the pay roll system, and in an overnight job LDAP is synchronised with it, creating new usernames if neccessary or expire accounts if someone has left.

Its our "yellow pages" of staff and students. Benefit to us is 1 username and password to access all our services. Less maintenance. Also in time it will allow us to roll out "single sign on". Sign into a computer on the network, and then you are automatically logged into our web sites or Vbulletin when you go to that site. No need for cookies.

You may have heard of Active Directory which is similar.

Does that make sense? :s

[rjmjr69]

Actually that makes PERFECT sense as to the definition of the acronym. thank you very much for answering. Now you will get ALLOT less questions

[Paul M]

I notice that you are using mysql_num_rows() - you should update that to the equivelent vb database class call.

[zemic]

True!! Fixed , thanks for pointing that out

(attachment updated)

[bada_bing]

Wow this is great news man. I was thinking of using vb at my work for our IT department for internal knowledgebase but refrained due to the whole seperate login issues but now that LDAP is supported this is very cool.

Thanks

[ninjamaster]

thanks m8 will have a look at this

[zemic]

Let me know how you get on. .....

I've updated the attachment so the download is now a product, not just a plugin. Did this so people can do version checking. Not edited any code.

[Invalid ID]

Is there any possibility of attaching some screenshots?

Thanks

[zemic]

Originally Posted by Invalid ID

Is there any possibility of attaching some screenshots?

Thanks

Nope, there's nothing to take a screen shot of. You login with the usual Vbulletin form. Script talks to the LDAP server in the background, then continues with the Vbulletin login code.