Moodle Resource id #8 Bind Result error with ldap user accounts

[gaz003]

I have used Microsoft web app gallery to setup my PHP, MySQL and Moodle installation. I have configured Moodle so it can be accessed Internally and Externally, But I now have the issue of trying to setup Active Directory user accounts to moodle. I hope there may be someone who can help as I am starting to pull my hair out I have tried every setting I can think of with this and cannot get it to work. I have reset the password of the account and created a new account just in case.

 

I have entered the ldap settings

 

Host Url: ldap://172.16.0.1.augustines.school.local also tried ldap://172.16.0.1 and just the IP address

Version 3 ldap encoding: utf-8

Distinguisehd name: cn=ldaplink,ou=moodle,dc=schoolname,dc=school,dc=local;CN=Administrator,OU=Users,DC=schoolnames,DC=school,DC=local

user type: msactive directory

contexts ou=staff users,dc=schoolname,dc=school,dc=local

Search sub contexts - yes

User attribute: samaccountname (Is this case sensitive because everytime I set it in the correct case and save it reverts back to this? does anyone know where the file is located so I can manually add it)

firstname: givenName

surname sn

[carvjo]

Hi

 

When we set our up, I worked through this and it did the job!

 

LDAP authentication - MoodleDocs

 

Regards

[Achandler]

I have just checked ours, it is hosted on site.

 

Our Host URL is just ldap://server.domain.local

 

the other differences are below, we upgraded from 1.9 to 2.2 though:

our distinguished name is set as [email protected]

 

The user attribute does remain with the capitals though, but when i hit save it went lower case, then after i logged in again to check it worked, it was back to the original format (odd I know).

 

 

Edit: if your Moodle is externally hosted, remember the firewall ports for LDAP over SSL etc need sorting.

[gaz003]

Still not working

Tried the Host Url and distinguished name but have the same error

[Achandler]

Is it internally hosted? Also does your AD server give any errors from the binding?

[gaz003]

Internally hosted, but can also be accessed externally through the dns records and public facing IP address we configured.

Checked AD and cannot see any errors in relation to this

[Achandler]

Have you tried using a domain admin account as the bind account to make sure the permissions are correct?

[SovietRussia]

Distinguisehd name: cn=ldaplink,ou=moodle,dc=schoolname,dc=school,dc=l ocal;CN=Administrator,OU=Users,DC=schoolnames,DC=school,DC=local

 

You have a space... That would do it - Or you dont have a space and my PC is screwed.

[Achandler]

There is indeed a space, I didn't even notice. Let's hope that solves it for him.

[gaz003]

Thank you for your suggestions, I am not sure what happened with the copying from Moodle to the forum site - logged on as the moodle admin and there are no spaces in any of the words? it might have been when I removed our domain name and I put schoolname in its place on the forum site. sorry!

 

Also added the administrator account as recommended and again I still cannot log on and get the same ldap error.

[Achandler]

I don't mean to insult you, but you defo have the ldap module in your php, and you defo have the samaccountname filled in AD right?

[Achandler]

I wonder if it doesn't like the space in "cn=staff users" do you have an OU you could try with no space?

[gaz003]

achandler - Thanks again for your advice, always good to talk over what I did to start with in case I didn't quite do it right.

 

I have gone in to c:\program files (x86)\ php\v5.3\edited the php configuration settings file

in extensions added extension=php_ldap.dll

 

The dll file is located in c:\program files (x86)\ php\v5.3\extensions folder

 

It was a Microsoft web app install so hopefully that's the location where it all needed changing?

 

Originally it all worked on a test with xammpp but I was told it wasn't secure to use this solution, so stuck with Microsoft (wasn't sure if that was wise!)

[gaz003]

the moodle directory for the ldaplink account, should that not work?

[gaz003]

One thing I keep coming back to is the samaccoutnname is all lower case, It wont let me change it case sensitive, I save the settings return to the page after logging out and its all lower case?

[Achandler]

you can see if the ldap module is installed and working by going to site administration then server then php info

 

Do a search do ldap there.

 

I mean the directory with the contexts, although it would appear you might not even be getting to that part. Don't worry about the samaccountname part, mine has stayed lowercase now and still works.

[gaz003]

There is a section for LDAP

LDAP support - enabled

API version 3001

vendor name: openldap

SA SL support - enabled

[Marci]

Try it as follows... make sure your domain is correct on the end of distinguished name and that ldaplink is a valid activated user account... and that your staff contexts are correct.

 

Host Url: ldap://172.16.0.1 (presuming this is the correct IP address for your Domain Controller... if it's the same machine, then localhost or 127.0.0.1 should work)

Version: 3

ldap encoding: utf-8

Distinguished Name: [email protected]

user type: msactive directory

contexts: ou=staff users,dc=augustines,dc=school,dc=local

Search sub contexts: yes

User attribute: samaccountname

firstname: givenName

surname: sn

[SovietRussia]

achandler - Thanks again for your advice, always good to talk over what I did to start with in case I didn't quite do it right.

 

I have gone in to c:\program files (x86)\ php\v5.3\edited the php configuration settings file

in extensions added extension=php_ldap.dll

 

The dll file is located in c:\program files (x86)\ php\v5.3\extensions folder

 

It was a Microsoft web app install so hopefully that's the location where it all needed changing?

 

Originally it all worked on a test with xammpp but I was told it wasn't secure to use this solution, so stuck with Microsoft (wasn't sure if that was wise!)

 

IIS was the best solution, also for a quick tip next time, to enable LDAP on PHP, go to IIS Manager > Your moodle site > PHP > Extensions > find php_ldap in the list and right click, enable.

[Achandler]

The problem is now resolved.