Miscellaneous Hacks - LDAP Authentication

I've only recently started using vBulletin, and this is my first mod so if you use this, please click Installed!

This mod (which builds on the fine work from malcomx and zemic) is intended to lower the barriers to using and LDAP directory as an external authentication source for your board. The idea is simple; capture a login attempt before authentication and test it against LDAP first, if that succeeds, see if there is already a matching user in vBulletin. If there is not, create one, using data from the LDAP to fill in the required fields, if there is already a matching user (Determined by comparing email addresses) then update the user.

You might be asking why this mod is better than the two mods I've mentioned above? Well firstly the only additional file is the XML file for the new hooks (See below), and no changes to vBulletin code so installation is simple, and upgrades to vBulletin don't get over complicated by re-applying changes. Secondly, all the settings are controlled from the admincp rather than an external config file. Thirdly (as if two wasn't enough) I've added some hook points so this mod can be extended, for example to get additional data from the LDAP and put it in user profile fields.

One important similarity with the two earlier mods is that in the admincp and modcp no LDAP authentication is performed, this is a safety feature, so even if the mod or an extending to it, breaks your board, you shouldn't ever get locked out of the admincp so you'll be able to turn if off quickly.

Additional Hooks

The mod is essentially a single plugin (plus options and help) which runs at global_complete which is before most other things have happened, but just after all the global setup has occurred.

To enable the additional hooks, you need to upload the file hooks_ldap_auth.xml to /includes/xml under your forum.

The following new hooks are created by this mod:

• ldap_auth_start - After the list of attributes to fetch has been created, this list is in $ldapAttrs. You can simply add your own attributes to this array here.
• ldap_auth_all_user - After a new user has been added to vBulletin or existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData. This happens before ldap_auth_new_user or ldap_auth_existing_user.
• ldap_auth_new_user - After a new user has been added to vBulletin, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.
• ldap_auth_existing_user - After an existing user has been updated, but before the user has been saved. The new user is in $newuser and the LDAP data is in $userData.

By requesting new attributes at ldap_auth_start and then applying them at either ldap_auth_all_user, ldap_auth_new_user or ldap_auth_existing_user you can setup your users easily without having to write all the LDAP code yourself!

AdminCP Settings

This mod creates a new options group called LDAP Authentication between email options and user registration options where you set the host name and port number of the LDAP server, the initial authentication type (Anonymous or authenticated), optionally the BindDN and Password for the LDAP server. You also set which attribute matches the vBulletin username (The default is cn which works well for inetOrgPerson based entries). You can set additional attributes to retrieve (If you want to quickly knock up a simple plugin which uses them at one of the hook points above). There is also the facility to disable (or rather make unavailable) accounts which exist in vBulletin but not in LDAP. Given that your initial admin may fall into this group, there is also a list of userids who should be allowed to log in anyway.

Requirements

• PHP 4.3+ with LDAP support.

I'll try to provide support to users of my mod, but please bear in mind I fairly new to all this, so I may not be able to solve all problems immediately. Support will only be provided via this thread (Don't PM or email me unless I ask you to). Priority will be given to users who have clicked Installed.

Release Notes

• 1.0 - Initial release
• 1.1 - Corrected SQL queries to use TABLE_PREFIX
• 1.2 - Corrected a bug which prevented the settings page from being created correctly
• 1.3 - Corrected where the existing, new and all user hooks are called (Before, not after the user profile fields are set) to support dependant plugins
• 1.4 - Added the ability to set a search base for directories which do not permit searching from the root
• 1.5 - Fixed reported bug where hooks were called in the wrong order

Installation

1. Add the command define('DISABLE_PASSWORD_CLEARING', 1); to your includes/config.php - This will NOT be overwritten by upgrades, so only needs doing once.
2. Upload the file hooks_ldap_auth.xml to includes/xml under your forum.
3. Install the latest product file (below) using the Add/Import Product link on the Manage Products page under Plugins & Products in your AdminCP.

Haqa...

[khan2002]

Hy

I installed the plugin, but i get several errors or strange behaviours:

1) I can't login with an admin account
2) I get always following error at the login with an other user:

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'xxx'@'localhost' (using password: NO) in /var/www/virtual/xxx/htdocs/_forum/includes/functions.php(5721) : eval()'d code on line 106

the new user is cerated, and after i gi back to the mein site he is logged in, but befor i get this message....

Anyone an idea?

thanks in advance

[Haqa]

Originally Posted by secrtagnt

The plugin is populating vB's db properly when an exisiting LDAP user tries to login to the forums but doesn't exist in vB; however, it won't log them in -- stating they have entered an incorrect password. The samething happens for existing vB users.

The passwords are stored as an MD5 hash in LDAP, and I also made sure define('DISABLE_PASSWORD_CLEARING', 1); was in includes/config.php. The stange thing is, if I disable the plugin both exisiting and newly created users (from LDAP) can successfully login.

Any ideas on what might be causing this?

I'll have to investigate this, I have it working so it sounds like I missed something from the instructions. If I did, sorry, I'll fix it as soon as I find it.

Originally Posted by Rondo44

I have installed this plugin, but cant get it to work. Has anyone gotten this plugin to work in an active directory environment. thank for your help.

Originally Posted by ludachris

I was just going to ask if this worked with Active Directory.

I have made this work with AD, but it requires a little fiddling. At work we have AD replicated into a real LDAP server so that normal access can be used. I'll post some instructions shortly.

Originally Posted by sysadm

didn't you mix up your hooks in product-ldap_auth-1.4.xml? your ldap_auth_existing_user is called when you're creating a fresh user, while ldap_auth_new_user is called when the user has been found in forum... am i confused??

Oops, Did I? I'll check, but I don't think I did. If I did, sorry, I'll fix the download shortly.

Originally Posted by khan2002

Hy

I installed the plugin, but i get several errors or strange behaviours:

1) I can't login with an admin account
2) I get always following error at the login with an other user:



the new user is cerated, and after i gi back to the mein site he is logged in, but befor i get this message....

Anyone an idea?

thanks in advance

That sounds like your database access is at fault, but I don't understand why that would be the case if the rest of your site is working. As I stated above, I'm relatively new to VB and don't have all the answers. Perhaps someone here might know how a VB can work but sometimes throw a MySQL login failure?

Certainly though, failing to log into MySQL would prevent anyone logging in... Is the site sending you database error emails?

H.

[awillys]

Hi, does this work with vB 3.8.x and/or 3.7.5?

Thanks
A

[awillys]

Hi,

I have installed the plugin on a vB 3.7.5 following the above instruction.
I then created a new user usingthe forum registration and that user was not added in LDAP. what did i do wrong?

is it possible to get users added on ldap upon registration from the forum?

Thanks
Antonio

[jmccaffrey]

I am not using this plugin, however I developed a different product to help me use a different login source than ldap, and I used this as a base. I noticed that the hook global_complete is called AFTER login logic takes place, this seems to be counter to how the hook is designed. This might be causing some of the issues people are seeing. I modified my plugin to use global_setup_complete instead. Note, using this approach requires a bit more setup logic to be used.

[Haqa]

Originally Posted by awillys

Hi, does this work with vB 3.8.x and/or 3.7.5?

Thanks
A

Still testing with 3.8, though it looks promising.

Originally Posted by awillys

Hi,

I have installed the plugin on a vB 3.7.5 following the above instruction.
I then created a new user usingthe forum registration and that user was not added in LDAP. what did i do wrong?

is it possible to get users added on ldap upon registration from the forum?

Thanks
Antonio

I think you may have the purpose of the plugin backwards. This allows people in your LDAP to login to your VB even if they've never registered. You appear to be trying to get VB users put into your LDAP, which this plugin is not intended to do, sorry

Originally Posted by jmccaffrey

I am not using this plugin, however I developed a different product to help me use a different login source than ldap, and I used this as a base. I noticed that the hook global_complete is called AFTER login logic takes place, this seems to be counter to how the hook is designed. This might be causing some of the issues people are seeing. I modified my plugin to use global_setup_complete instead. Note, using this approach requires a bit more setup logic to be used.

I can see your point, as I've said this is my first mod. I'll go back to the code and see what refactoring would be needed to switch. However I am using this mod at work and it's working well (Or seems to be). I have many users who have all signed in without using the signup logic (Which I've disabled) and then have returned, re-logging in etc...

I'll have to revisit the code.

H.

[Haqa]

Originally Posted by sysadm

didn't you mix up your hooks in product-ldap_auth-1.4.xml? your ldap_auth_existing_user is called when you're creating a fresh user, while ldap_auth_new_user is called when the user has been found in forum... am i confused??

You are quite right. I'll try to get a revised version up ASAP. It shouldn't prevent anything else working, unless you've written your own plugins triggered from my hooks, in which case they will get called at the wrong times.

Sorry.

H.

[anthonym16]

Haqa,

I've been trying to get the plugin running with vb 3.8.1. I noticed that the gobal_complete hook isn't called on a login. I'm just learning the hooks but do I need to change that the plugin to fire on global_setup_complete?

Thanks,
Anthony

[Haqa]

Originally Posted by anthonym16

Haqa,

I've been trying to get the plugin running with vb 3.8.1. I noticed that the gobal_complete hook isn't called on a login. I'm just learning the hooks but do I need to change that the plugin to fire on global_setup_complete?

Thanks,
Anthony

I've just upgraded my dev system to 3.8.1 so it shouldn't be long before I've got a version which does support 3.8.x

H.

[anthonym16]

Originally Posted by Haqa

I've just upgraded my dev system to 3.8.1 so it shouldn't be long before I've got a version which does support 3.8.x

H.

I just got the plug-in working w/ 3.8.1. I had to add my own hook in login.php so I'm interested to see what you come up with so that no vb code is altered.

Also, I had a problem with DISABLE_PASSWORD_CLEARING. I traced it back to line 598 of global.php. I had to switched the 1 and 0 on that line so $show['nopasswordempty'] would get the right value.

-Anthony