MRBS Unknown User

[ITTony]

Hi Guys,

 

I have just installed the most recent version of mrbs and it works well in fact really well.

 

I have come across a slight snag! well more a hole in my knowledge base, ldap!

 

I am trying to get mrbs to authenticate users against Active directory and it seems to fail whichever setting I put in ? does anyone one have an example of their working config.ini.php file? who may be using ldap? I have been browsing multiple threads and I just dont get it

 

any help would be very much appreciated.

[ITTony]

here is the ldap portion of my config.inc.php most likely wrong

 

$ldap_host = "12.404.238.2";

$ldap_v3 = true;

$ldap_tls = false;

$ldap_base_dn = "ou=Accounts,dc=chinham,dc=county,dc=sch,dc=uk,dc=local,";

$ldap_base_dn = "ou=pupils,dc=chinham,dc=county,dc=sch,dc=uk,dc=local,";

$ldap_user_attrib = "sAMAccountName";

$ldap_get_user_email = FALSE;

$ldap_email_attrib = 'mail';

$ldap_group_member_attrib = 'memberof';

$ldap_unbind_between_attempts = FALSE;

$ldap_debug = TRUE;

?>

[Danp]

I gave up with this and setup users just for this! So, if you do get it working I would love to know the details.

[pcstru]

The ldap part of our config looks like :

 

$auth["session"] = "php";
$auth["type"] = "ldap";

$ldap_host = "192.168.9.100";
$ldap_port = 389;
$ldap_v3 = true;
$ldap_tls = false;

$ldap_base_dn[] = "ou=Support Staff, dc=ourschool, dc=org, dc=uk";
$ldap_base_dn[] = "ou=Teaching Staff, dc=ourschool, dc=org, dc=uk";

$ldap_user_attrib = "sAMAccountName";
$ldap_dn_search_dn = "cn=LDAPQ,cn=Users,dc=ourschool, dc=org, dc=uk";
$ldap_dn_search_attrib = "sAMAccountName";
$ldap_dn_search_password = "*******";

 

We have the user LDAPQ set up with permissions to query AD.

[ITTony]

So I need to setup a user with permission to read AD and basically add in

 

$ldap_user_attrib = "sAMAccountName";

$ldap_dn_search_dn = "cn=LDAPQ,cn=Users,dc=ourschool, dc=org, dc=uk";

$ldap_dn_search_attrib = "sAMAccountName";

$ldap_dn_search_password = "*******";

 

but with my details?

[pcstru]

Possibly. Your AD may be set up to accept anonymous queries in which case you don't (shouldn't) need a user to do that. Your $ldap_base_dn looks a little odd to me.

 

$ldap_base_dn = "ou=Accounts,dc=chinham,dc=county,dc=sch,dc=uk,dc= local,";

$ldap_base_dn = "ou=pupils,dc=chinham,dc=county,dc=sch,dc=uk,dc=lo cal,";

 

The dc=local in the first line there is a space before local, in the second after the o. I'm sure the spaces are incorrect but do you even need the local?

[ITTony]

Corrected my mistakes and still no avail! tried with and without .local

unable to get it going by adding in admin account to search AD aswell

hmm at a loss here and dont fancy exporting the contents of AD to add in manually that will be a long day! lol

[pcstru]

Is this a windows or linux server? Do you have the correct php extensions installed?

 

I do remember it being a pain to get it working.

[ITTony]

Ah yes my setup might help.

 

So currently installed on a windows 7 machine using xampp (apache & mysql) and the AD is on a server 2003 machine

I have uncommented the ldap line in php.ini as this was throwing up an error.

 

Not sure if there is anything else I should have running. first time using xampp as usually would use IIS but could not get mrbs to work properly (have Stopped all IIS services running)

[pcstru]

Do you have the php_ldap library installed? (is about the last thing I can think of)? I'm presuming the xampp build had ldap support compiled in - but I'm afraid I use linux for that sort of thing, so no expertise on your platform.

[ITTony]

So I went over a handful of things and came across a post in regards to 3 .dll files that need to be copied from xampp folder to windows/system

 

From C:\xampp\php copy the following files to C:\Windows\system.

 

• libeay32.dll
  
• libsasl.dll
  
• ssleay32.dll
  

I had already uncommented the ldap line in php.ini so no need to do that part.

 

Restarted xampp and.... nothing lol!

Im just going to go over my changes and do them again in case one of them was actually working and I was just missing those 3 files.

 

Wish me luck

 

Thanks for you help pcstru i'll keep you all posted.

[ITTony]

Ok so finally got this to work so anyone else having difficulties these are the steps I used to get this working :

 

If using xampp in windows-

 

Firstly enable the ldap module for php-

 

To enable php ldap module in XAMPP, find the following files and copy them.

From C:\xampp\php copy the following files to C:\Windows\system.

 

• libeay32.dll
  
• libsasl.dll
  
• ssleay32.dll
  

 

Find and edit C:\xampp\php\php.ini and uncomment “extension=php_ldap.dll” around line 965

 

And then copy the ldap settings from systemdefaults.inc.php into config.inc.php

 

And then edit as nessecary

$auth["type"] = "ldap"; 
$ldap_host = "servername.schoolname.county.co.uk.local";
$ldap_port = 389;
$ldap_v3 = true;
$ldap_tls = false;
$ldap_base_dn = "ou=users,dc=servername,dc=county,dc=co,dc=uk,dc=local";
$ldap_user_attrib = "sAMAccountName";
$ldap_dn_search_attrib = "sAMAccountName";
$ldap_dn_search_dn = "CN=User Name,OU=users,OU=admins,DC=schoolname,DC=county,DC=co,DC=uk,DC=local";
$ldap_dn_search_password = "password";
$ldap_get_user_email = FALSE;
$ldap_email_attrib = 'mail';
$ldap_group_member_attrib = 'memberof';
$ldap_unbind_between_attempts = FALSE;
$ldap_debug = FALSE;

//---end---

 

It turns out I needed to add .local on the end and also needed to authenticate with a user to search AD

the $ldap_dn_search_dn line was wrong I had not included all the OU paths of the tree for that specific user.

I used Softerra LDAP Administrator 2014.1 to get the correct search_dn name for the account to authenticate with, to search AD

 

Hope this helps someone else

Thanks for your help