Moodle problem - Cannot access at all

[witch]

In recent weeks our virtual learning platform seems to have gone a bit awry and some people can no longer log on.

I think it is tied to our AD so they use their normal school credentials but I had nothing to do with it and I am at a loss as to what to look at to sort this out. (some people are still fine,strangely)

Is there some sort of resetting I could do? I think our version is 2.2.3

 

mrwITch upgraded it for us but even so he doesn't really understand that much about it.

 

Can anyone give me a few pointers?

[Dkeen94]

Is it running on a windows box or a linux box?

 

Im assuming you have the admin credentials? have you tried removing and re-adding in the AD settings?

 

If you want some help with this give me a shout!

[witch]

@Dkeen94

Running on my server - 2008R2

I am the admin, yes

Not sure where the AD settings are tbh

Could do with a bit of help - not my thing at all

[unixman_again]

The AD connection is in Site administration > Plugins > Authentication > LDAP server

The gotchas are Distinguished name and Contexts, probably the former.

[Dkeen94]

@witch

Unixman beat me to it! Have you managed to have a look around your AD settings?

If you are struggling with distinguished names and all that, try "Softerra LDAP Administration 2014". It helped me locate the right information to enter into the fields, just shout if you want help

[witch]

Presumably everyone is already there and I really don't think I can muck about with it unless it is very simple to remove and add things - is that one person or the whole lot or what?

[Dkeen94]

Depending on the way the settings have been entered it should point at the whole of your AD. Did you say you upgraded? Im running 2.7 at the moment.

 

Have any changes been made to the users that cant login?

[tj2419]

A couple of things that might be worth a check

 

Go to site administration, users, browse users. Find one that cannot login and click the little cog to edit their account. Check next to authentication method, it should say LDAP if it is linked to your AD. We had some randomly change to no login a while back. If it says no login change it back to ldap or manual and reset the password.

 

As above check your AD settings.

 

Are they the same type of user. E.g just teachers experiencing the no login problem or just students?

[sister_annex]

This may seem a little silly but I know it is an issue that plagues our school... if the passwords are over 20 Characters the login box trims it down and therefore not passing it to LDAP properly and failing the authentication.

 

We have had to tell everyone here to keep their passwords below 20 characters until moodle fix the issue - we are running version 1.9 and 2.8 and both do this.

[Jamo]

I seem to remember something a while back that Moodle can have an 'auto remove' feature where if an account no longer exists in the LDAP source it will either expire, or completely remove the account. This is obviously good behaviour, but.....

 

If you AD returns over 1000 objects (by default) when doing the LDAP search the Moodle import process will only import the first 1000 leaving the remaining accounts locked as they have, in Moodles eyes, been removed from the LDAP source. I think the setting is removed ext user (https://docs.moodle.org/23/en/LDAP_authentication#User_lookup_settings)

 

To change you have to dive into NTDSUtil.exe, see the section "Setting up regular automatic synchronisation using cron" which gives a link to How to view and set LDAP policy in Active Directory by using Ntdsutil.exe and a way of fixing the issue (assuming its that)

 

Note that disabled and expired users are still counted in the 1000 objects which moodle imports.

[andrewnicols]

This may seem a little silly but I know it is an issue that plagues our school... if the passwords are over 20 Characters the login box trims it down and therefore not passing it to LDAP properly and failing the authentication.

 

We have had to tell everyone here to keep their passwords below 20 characters until moodle fix the issue - we are running version 1.9 and 2.8 and both do this.

 

Really? I'm not aware of this limitation, and there are no issues reports against the Moodle Tracker that I can find. Perhaps you should investigate this further.

On Moodle master, I just tried setting a 32 character password for one of my non-LDAP accounts and all works as expected. I suspect your problem lies somewhere outside of the core Moodle code-base and it certainly isn't in the login dialogue. I've also had a quick look through the ldap code and can't see any such trimming going on.

 

Andrew Nicols

[andrewnicols]

I seem to remember something a while back that Moodle can have an 'auto remove' feature where if an account no longer exists in the LDAP source it will either expire, or completely remove the account. This is obviously good behaviour, but.....

 

If you AD returns over 1000 objects (by default) when doing the LDAP search the Moodle import process will only import the first 1000 leaving the remaining accounts locked as they have, in Moodles eyes, been removed from the LDAP source. I think the setting is removed ext user (https://docs.moodle.org/23/en/LDAP_authentication#User_lookup_settings)

 

To change you have to dive into NTDSUtil.exe, see the section "Setting up regular automatic synchronisation using cron" which gives a link to How to view and set LDAP policy in Active Directory by using Ntdsutil.exe and a way of fixing the issue (assuming its that)

 

Note that disabled and expired users are still counted in the 1000 objects which moodle imports.

 

Since LDAPv3 and Moodle version 2.4 this is no longer necessary. See https://tracker.moodle.org/browse/MDL-36119 for more information.

 

Andrew

[sister_annex]

Really? I'm not aware of this limitation, and there are no issues reports against the Moodle Tracker that I can find. Perhaps you should investigate this further.

On Moodle master, I just tried setting a 32 character password for one of my non-LDAP accounts and all works as expected. I suspect your problem lies somewhere outside of the core Moodle code-base and it certainly isn't in the login dialogue. I've also had a quick look through the ldap code and can't see any such trimming going on.

 

Andrew Nicols

 

maybe it is just us then... I don't want to hijack the thread with my issue but will definitely look in to it...

[witch]

Some useful stuff in there - will have a noodle around the moodle today

 

Apparently some people can't sign in at all and others get logged out almost immediately. The 1000 users thing sounds a possibility as nothing else has changed.

[Jamo]

Since LDAPv3 and Moodle version 2.4 this is no longer necessary. See https://tracker.moodle.org/browse/MDL-36119 for more information.

 

Andrew

 

It will still happen if you haven't updated php to 5.5 as well as the Moodle version.

 

https://docs.moodle.org/25/en/LDAP_authentication#Setting_up_regular_automatic_synchronisation_using_cron

[andyrite]

2.2.11 is the highest version on that branch. Try updating to that first.

[witch]

Problem is, I really don't know enough to update the Moodle. mrwITch did it last time but it took him a long time and lots of effort and scary moments, all for a brief " thank you" from the HT. I don't think he wants to bother again

[Jamo]

Problem is, I really don't know enough to update the Moodle. mrwITch did it last time but it took him a long time and lots of effort and scary moments, all for a brief " thank you" from the HT. I don't think he wants to bother again

 

The other thing to do is start removing disabled users to get under 1000?

 

Or increase the max page size, that's what I did back in the day when i was looking after a Moodle installation. Set mine to 3000 in the end

[witch]

The problem is - I have nothing to do with the students and I don't know which ones have left - unless there is a way of finding out when they were registered?

How do I increase the maximum page size?

[Jamo]

The problem is - I have nothing to do with the students and I don't know which ones have left - unless there is a way of finding out when they were registered?

How do I increase the maximum page size?

 

You have to run ntdsutil. Its a command line utility

 

http://support2.microsoft.com/default.aspx?scid=kb;en-us;315071&sd=tech

 

There is a section on how to do this in the url above. Maxpagesize is the var you need to change

[witch]

The moodle has 1007 users

Is there any way of printing a report about them? I dont understand where they have come from as we only have around 500 students and I deleted the old students from last year at the beginning of term (so I dont know their names)

Edited November 20, 2014 by witch

[Jamo]

The moodle has 1007 users

Is there any way of printing a report about them? I dont understand where they have come from as we only have around 500 students and I deleted the old students from last year at the beginning of term (so I dont know their names)

 

you can have more than 1000 in Moodle, just not more than 1000 results returned at once from AD.

 

How many ad accounts are returned? That needs to include expired and disabled ones

[witch]

How do I find that out?

[Jamo]

How do I find that out?

 

Really quick and dirty way is to find the root dn where the Moodle search begins, looking at the moodle docs this is user lookup settings/contexts, go to ad users and computers and right click that ou then just press search. It will list the total returned objects under that ou at the bottom of the aduc search box

[witch]

This morning I have come in to find that the link to the moodle platform isn't working either internally or externally from our website. The timer just goes on twirling!

What can have happened. This is difficult as I had nothing to do with it ever and now I am being expected to know what is going on