Active Directory Guest Registration - (Mainly for use with RADIUS for wireless)

[ntoupin]

Hi All,

 

I'm working on a system that is mainly for use with our wireless system which uses a Windows RADIUS server to authenticate users onto our SSIDs. Although that's the main purpose it also can be used for general "guest" computer access as well as any system internally that uses AD to authenticate (in our case - helpdesk, booking software, etc.).

 

At its base it's a simple php script that allows any current (or designated - I currently have it set to any "staff" user (in the AD security group "staff")) AD user log in and fill out a php form that will automatically create a new account in active directory. That account will be made with a defined prefix, "guest_" for example, and created in the specified AD OU, "GuestUsers" for example, with an expiration date and time controlled by the form. Also in the form is additional information such as the guests name, location they will be in, what staff member is "sponsoring" the guest.

 

In addition to the script creating the user automatically a separate powershell script is used as a scheduled task on any domain controller which looks at the expired guest users and removes them. This is purely for the fact of "cleaning up" old guests and making the username that was used for them available again.

 

Below are some screenshots of the system. It is currently functional but I will be adding some additional features and cleaning up a lot of the code before actually using it.

It works local on a LAN but I also tested it from a remote website and with a little tweaking of the LDAP connection was able to get it successfully working there as well.

It also is responsive in its design (uses bootstrap) for mobile devices.

 

 

A base list of its current features:

• LDAP/AD login
  
• Choose what users can create a guest account
  
• Users choose guest account expiration (1 hour, 1 day, 2 day, etc.)
  
• Users choose guest username and password for ease of use
  
• Additional information gathered for system logging (location, purpose, guest first and last name, staff creating the account)
  
• Error catch for duplicate users
  
• Printable "ticket" to give to the guest on creation
  
• Automated creation of guest account in active directory/ldap with user's inputted information
  
• Automatic "cleaning" of old expired guest accounts via scheduled task on domain controller
  
• Responsive design (bootstrap) for mobile
  

 

 

Some features to add:

• History for staff users (will show a record of guests they "sponsored" in the past, when those expired, what username/password they gave them, etc.)
  
• Log system (for admin/technical use - lookup right in the script user sponsor history, search for guest name, username, etc.)
  
• A few more checks to ensure a duplicate is not being created and/or a safe fail that creates a user anyways with a randomly generated number after it.
  

 

Login screen (uses LDAP/AD credentials)

 

Registration form to fill out guest details

 

Sample form filled, dropdown of account expiration options

 

Successful registration of guest account

 

Duplicate error

 

Printable "ticket" to hand to guest

 

AD user created

 

 

I honestly don't know if this would ever be useful to others or if it has or hasn't been created before. I search a bit and figured I could just make it myself and customize it to our needs. If it would be useful for others I can share the system once it's cleaned up a bit. I'm also open to suggestions for some improvements or additions to the system.

 

Thanks!

Edited May 17, 2016 by ntoupin

[tpolwort]

This is perfect, I really wish you had the script available for download.

[kadocc]

Hi,

 

this is exactly what i am looking for! I'm hoping you will release your code soon, it seems fantastic.