Moodle SSO

[jaminben]

So I've been trying to setup Moodle with SSO and followed all the instructions I can find but its not happening for me so need to ask for some help.... please.

 

What I'm running:

 

AD Users - Windows Server 2012

Moodle Server - Ubuntu Server 12.04.3

Moodle Version - Moodle 2.5.4

Testing with Browser - IE 11 & Chrome

 

Instructions from - NTLM authentication - MoodleDocs (Using the NTLM part of Samba for Apache on Linux)

 

NTLM Authentication is working

Moodle Server is joined to the domain and running 'wbinfo -u' or 'wbinfo -g' returns results as expected

 

Has anyone who has this working got any advice or tips?

 

Thanks

 

Ben

Edited February 4, 2014 by jaminben

[clodhopper]

I had this working in a test environment a year or so ago so please excuse me if I'm a bit "fuzzy" on it :-)

 

Which browser are you using IE / Chrome / Firefox ??

 

As I remember you had to add your moodle site to I think it was "trusted zones" for it to work

[penfold_99]

Hi @jaminben

 

Could you expand on "its not happening for me"? What is not happening.

 

To invoke a NTLM login you need to go to my.moodledomain.com/login/

If you are using IE your moodle site needs to be in either trusted sites or local intranet so IE will forward on the login credentials.

If you are using chrome or firefox you will need to turn NTLM on. (quick google will resolve that)

[danbuntu]

have to added the moodle url to the 'intranet zone' in IE?

[jaminben]

I had this working in a test environment a year or so ago so please excuse me if I'm a bit "fuzzy" on it :-)

 

Which browser are you using IE / Chrome / Firefox ??

 

As I remember you had to add your moodle site to I think it was "trusted zones" for it to work

 

Thanks, Using IE & Chrome... its also added to the trusted zone.

 

have to added the moodle url to the 'intranet zone' in IE?

 

Thanks, Done that.

 

Hi @jaminben

To invoke a NTLM login you need to go to my.moodledomain.com/login/

 

Thanks, I'm going to http://192.168.110.6/moodle/login/

 

Hi @jaminben

If you are using IE your moodle site needs to be in either trusted sites or local intranet so IE will forward on the login credentials.

 

Thanks, Done that.

 

Hi @jaminben

If you are using chrome or firefox you will need to turn NTLM on. (quick google will resolve that)

 

Thanks, NTLM is on and working... manual login.

 

Hi @jaminben

Could you expand on "its not happening for me"? What is not happening.

 

Its not working... been trying to get it working for awhile now and I'm at the end of the road. I don't see how I can check to see what part isn't working (logging).

 

 

EDIT

Just double checking: My trusted sites address is http://192.168.110.6 I guess this is correct?

Edited February 4, 2014 by jaminben

[jaminben]

Still can't get this to work... can anyone spot any issues with my settings below?

 

Moodle NTLM SSO:

 

Enable: yes

Subnet: 255.255.255.0/24

MS IE fast Path: No

Authentication Type: NTLM

Remote username format: %domain%\%username%

 

When running wbinfo -u I return usernames in the following format:

 

RHSC\username1

RHSC\username2

 

My apache2.conf file is located @ /etc/apache2/ and I've added the following lines at the bottom of the file:

 

     LoadModule auth_ntlm_winbind_module /usr/lib/apache2/modules/mod_auth_ntlm_winbind.so

 

    
        NTLMAuth on
        AuthType NTLM
        AuthName "Moodle NTLM Authentication"
        NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
        NTLMBasicAuthoritative on
        require valid-user
    

 

The mod_auth_ntlm_winbind.so is located @ /usr/lib/apache2/modules/

The ntlmsso_magic.php is located @ /var/www/moodle/auth/ldap/

 

I can't find anywhere which will allow debugging apart from the apache2.log.

 

Anyone got any thoughts or anything else I can check?

 

Thanks

 

Ben

Edited February 6, 2014 by jaminben

[jamesfed]

Could it be that under User attribute in moodle you have cn listed instead of samaccountname?

 

Ran into this myself a while back and blogged about it here - Moodle and LDAP authentication – login doesn

[jaminben]

Could it be that under User attribute in moodle you have cn listed instead of samaccountname?

 

Thanks for the reply,

 

I have User Lookup Settings > User Attribute > samAccountName

[jaminben]

Fixed it.... I had the wrong subnet set for NTLM SSO, it should have been 192.168.100.0/28

 

Happy feeling for a Friday afternoon

[chrisjako]

Hi @jaminben

 

Could you expand on "its not happening for me"? What is not happening.

 

To invoke a NTLM login you need to go to my.moodledomain.com/login/

If you are using IE your moodle site needs to be in either trusted sites or local intranet so IE will forward on the login credentials.

If you are using chrome or firefox you will need to turn NTLM on. (quick google will resolve that)

 

thanks, logging into moodledomain.com/login/ was the final piece to my puzzle, feel like jumping for joy as it took me 2 days to figure out I had a duplicate entry in global workgroup for my smb.conf file!