Active Directory Guest Registration

[ntoupin]

Hi All,

 

I put this initially in the edugeek projects ideas forum, not sure if that was right but I found this location afterwards and it looked like a better spot based on other threads located here.

 

I'm working on a system that is mainly for use with our wireless system which uses a Windows RADIUS server to authenticate users onto our SSIDs. Although that's the main purpose it also can be used for general "guest" computer access as well as any system internally that uses AD to authenticate (in our case - helpdesk, booking software, etc.).

 

At its base it's a simple php script that allows any current (or designated - I currently have it set to any "staff" user (in the AD security group "staff")) AD user log in and fill out a php form that will automatically create a new account in active directory. That account will be made with a defined prefix, "guest_" for example, and created in the specified AD OU, "GuestUsers" for example, with an expiration date and time controlled by the form. Also in the form is additional information such as the guests name, location they will be in, what staff member is "sponsoring" the guest.

 

In addition to the script creating the user automatically a separate powershell script is used as a scheduled task on any domain controller which looks at the expired guest users and removes them. This is purely for the fact of "cleaning up" old guests and making the username that was used for them available again.

 

Below are some screenshots of the system. It is currently functional but I will be adding some additional features and cleaning up a lot of the code before actually using it.

It works local on a LAN but I also tested it from a remote website and with a little tweaking of the LDAP connection was able to get it successfully working there as well.

It also is responsive in its design (uses bootstrap) for mobile devices.

 

 

A base list of its current features:

• LDAP/AD login
  
• Choose what users can create a guest account
  
• Users choose guest account expiration (1 hour, 1 day, 2 day, etc.)
  
• Users choose guest username and password for ease of use
  
• Additional information gathered for system logging (location, purpose, guest first and last name, staff creating the account)
  
• Error catch for duplicate users
  
• Printable "ticket" to give to the guest on creation
  
• Automated creation of guest account in active directory/ldap with user's inputted information
  
• Automatic "cleaning" of old expired guest accounts via scheduled task on domain controller
  
• Responsive design (bootstrap) for mobile
  

 

 

Some features to add:

• History for staff users (will show a record of guests they "sponsored" in the past, when those expired, what username/password they gave them, etc.)
  
• Log system (for admin/technical use - lookup right in the script user sponsor history, search for guest name, username, etc.)
  
• A few more checks to ensure a duplicate is not being created and/or a safe fail that creates a user anyways with a randomly generated number after it.
  

 

Login screen (uses LDAP/AD credentials)

 

Registration form to fill out guest details

 

Sample form filled, dropdown of account expiration options

 

Successful registration of guest account

 

Duplicate error

 

Printable "ticket" to hand to guest

 

AD user created

 

 

 

I honestly don't know if this would ever be useful to others or if it has or hasn't been created before. I search a bit and figured I could just make it myself and customize it to our needs. If it would be useful for others I can share the system once it's cleaned up a bit. I'm also open to suggestions for some improvements or additions to the system.

 

Thanks!

[matt40k]

First thing, what are the guests going to be doing on your network? Who are the guests? Are they actual guests or someone who really should be setup on the system. We have public o2 wifi, it gives our guests (folks walking passed) free internet access and its managed by o2, so they worry about filtering etc. Just thinking if you create an account in AD for random person (say sales person) so they can get onto the internet then your going to have to worry about all the ball ache of basically being an ISP. How do you deal with a muppet putting in the name of "demo user", equally how do you actually track it back to a person? You also have the issue of licensing - your need a CAL and your education licensing won't cover non-staff or students. You also open up your AD to hackers - ok, there are various layers of protection, but its another worry.

 

Apart from all that, nice idea

[jmak]

I could see this being useful - it sounds ideal for agency supply teachers. They generally arrive before me(!) and have a genuine need for temporary access to the network.

 

The only issue I have is that I don't (yet) have a radius server set up...

[ntoupin]

First thing, what are the guests going to be doing on your network? Who are the guests? Are they actual guests or someone who really should be setup on the system. We have public o2 wifi, it gives our guests (folks walking passed) free internet access and its managed by o2, so they worry about filtering etc. Just thinking if you create an account in AD for random person (say sales person) so they can get onto the internet then your going to have to worry about all the ball ache of basically being an ISP. How do you deal with a muppet putting in the name of "demo user", equally how do you actually track it back to a person? You also have the issue of licensing - your need a CAL and your education licensing won't cover non-staff or students. You also open up your AD to hackers - ok, there are various layers of protection, but its another worry.

 

Apart from all that, nice idea

 

Hi,

 

I completely understand your skepticism at first, and maybe our situation is different than others. This would be more for the teachers or admins use, not a tech departments. The guests are typically guest speakers, presenters, etc. that are presenting in a classroom or auditorium and would need wifi access to use their own device and/or a guest credential to use one of our devices to bring up a presentation or video on for example. It would not be intended for guests in case of people that just entered the building or a short meeting like a salesperson, but strictly for planned guests that have a legitimate need for access.

 

Even if someone (only teachers/admins can create these guest accounts) simply put in "demo user" the staff member that created the user gets attached to it. Right now simply by extra details on the AD account itself, but also I'll be adding logs directly to the script to monitor/track it. The responsibility of that guest ultimately gets attached to the person creating the account, just as someone physically signing in a guest into the school for a reason becomes their responsibility.

 

For licensing, I'm not sure how this is an issue. We don't license our servers via CAL's but by physical cores, so maybe we're different there. I'm not an expert on MS licensing but again, I don't see how this would have any issues for us.

 

It doesn't open it up to hackers any more than giving students and staff AD credentials, and in our experience the students are the ones to worry about.

 

 

I appreciate the feedback!

Edited May 18, 2016 by ntoupin

[ntoupin]

I could see this being useful - it sounds ideal for agency supply teachers. They generally arrive before me(!) and have a genuine need for temporary access to the network.

 

The only issue I have is that I don't (yet) have a radius server set up...

 

Certainly could work for something like that. The baseline purpose is to make it more of a self-service or end-user level task for when non-regular staff have a genuine need for authentication access to wifi or AD (computers/etc.)

 

I didn't have one before I was testing with this and testing for our new wireless system we'll be putting in place (Cisco Meraki's). It's actually extremely easy, I had ours up and running and acting as a RADIUS authentication system for testing with Meraki within 15 minutes.

 

Here's their guide on doing it, the general setup can be used with pretty much any system that will take RADIUS auth: https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise

Edited May 18, 2016 by ntoupin

[matt40k]

I could see this being useful - it sounds ideal for agency supply teachers. They generally arrive before me(!) and have a genuine need for temporary access to the network.

 

Not for supply teacher. Supply teachers should have their own proper AD account, they should have this linked to your MIS system. What you want to do is get identity management (IDM) solution, so cover supervisor books them, adds their details into the MIS (like SIMS) - then IDM solution then automatically provisions the AD account etc in a predefined way (cough SalamanderSoft). One of the reasons you want to do it, is AD accounts aren't your problem, they are setup correctly, every time. From the non-IT side they aren't having to wait for IT. The reason they should be (mainly aiming this at supply staff) in the MIS (SIMS most likely) is if they work 28 days or more over the year, you'll most likely have to include them in the Workforce Census.

[matt40k]

For licensing, I'm not sure how this is an issue. We don't license our servers via CAL's but by physical cores, so maybe we're different there. I'm not an expert on MS licensing but again, I don't see how this would have any issues for us.

 

It doesn't open it up to hackers any more than giving students and staff AD credentials, and in our experience the students are the ones to worry about.

 

I would check with your Microsoft licensing rep - better to be safe then get lumped with back dated bill

 

I disagree, I'm not aware of any school giving pupils/staff a laptop with Kali install an AD account

 

Suppose the benefit of this over public wifi is the kids won't get on without a code, still guess that depends on your school policy of BYOD into school, still be hard to block mobile broadband

[ntoupin]

I would check with your Microsoft licensing rep - better to be safe then get lumped with back dated bill

 

I disagree, I'm not aware of any school giving pupils/staff a laptop with Kali install an AD account

 

Suppose the benefit of this over public wifi is the kids won't get on without a code, still guess that depends on your school policy of BYOD into school, still be hard to block mobile broadband

 

I'll contact my state rep just in case, but we don't license anything from Microsoft on a user base, we own the licenses based on device (W7/W8.1 Volume license, Server 2012 R2 Standard licenses)

 

Staff and students all have access to use their own device on wireless so again, it's no different than what they have. The wireless is separated from our internal and has only internet access, it cannot contact the domain at all beyond using AD credentials to authenticate through the radius server.

 

Our AP's (although probably not as successful as they advertise it to be) target rogue SSIDs and contain it. At the very least we become known of any hotspots almost instantly. Partially on our side is the fact there's little to no cell coverage in our buildings (1-2 bars tops).

[kadocc]

Hi, as i said in your previous post, this project looks awsome and fit perfectly with our needs: creating a quick AD user for guest wifi access with expiration date by out staff people (typpicaly human resources) on an elegant and intuitive interface.

 

I would love to test your solution. Is there any way you can share your project?

[ntoupin]

Hi, as i said in your previous post, this project looks awsome and fit perfectly with our needs: creating a quick AD user for guest wifi access with expiration date by out staff people (typpicaly human resources) on an elegant and intuitive interface.

 

I would love to test your solution. Is there any way you can share your project?

 

Hi,

 

It's still in the development stage - it works but the code and organization needs a big overhaul as I coded it just to get it to work, not be deployable/customizable yet. I'm planning to put it up on github sometime soon.

[kadocc]

Hi ntoupin,

 

well, it's a great news! Big thanks for your work!

[ntoupin]

Hi ntoupin,

 

well, it's a great news! Big thanks for your work!

 

Now on GitHub: https://github.com/ntoupin/AD-Guest-Registration

 

Again, it's at the very beginning stags, the code is all over and there's configuration in just about every file you would need to do to make it work with the current code.

[Norphy]

@ntoupin

 

I am trying to get this working as it would fulfill my needs pretty well.

 

What platform is this designed to be run on? Windows? Linux? IIS? Apache? Are additional PHP modules required or can it run on a base installation?

 

Thanks

[ntoupin]

@ntoupin

 

I am trying to get this working as it would fulfill my needs pretty well.

 

What platform is this designed to be run on? Windows? Linux? IIS? Apache? Are additional PHP modules required or can it run on a base installation?

 

Thanks

 

I have it running on a apache webserver on linux. No reason it can't work on IIS/windows though, it's just PHP code.

 

It requires PHP openLDAP to be enabled.

[Norphy]

I have it running on a apache webserver on linux. No reason it can't work on IIS/windows though, it's just PHP code.

 

It requires PHP openLDAP to be enabled.

 

I've installed this on both a Windows server running IIS and a Linux server running Apache. Both are running PHP7 and the openLDAP module. I've edited the PHP files, reflecting the organisation as it's set up here. However, on both I'm getting "Login failed: Incorrect user name, password, or rights". I can't see anything in any logs to indicate any problems.

 

Is there anything else on the AD side that I need to get running? LDAPS is enabled on the DC that I've set this to connect to.

[MatthewL]

Have you got an account set in the code that has permission in AD to create accounts?

[Norphy]

Yes.

 

However, I'm not even getting that far. I can't log into the interface at all.

[markwilfan]

Php7 has broken most things I have tried recently. Have you tried php 5.6

[Norphy]

Not tried with 5.6, does the same with 5.3 though

 

/edit just got it up to 5.6, still the same

Edited August 31, 2017 by Norphy

[markwilfan]

I get the same. lamp with php 5.6

 

Login failed: Incorrect user name, password, or rights

[Norphy]

Glad to know I’m not being daft.

@ntoupin, any suggestions?

[markwilfan]

Anybody got any further with this? I still can't get past the login page

 

I know ldaps is working

 

ld = ldap_sslinit("sch4304.internal", 636, 1);

Error 0 = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION, 3);

Error 0 = ldap_connect(hLdap, NULL);

Error 0 = ldap_get_option(hLdap,LDAP_OPT_SSL,(void*)&lv);

Host supports SSL, SSL cipher strength = 256 bits

Established connection to sch4304.internal.

Retrieving base DSA information...

Getting 1 entries:

Dn: (RootDSE)

configurationNamingContext: CN=Configuration,DC=SCH4304,DC=internal;

currentTime: 30/11/2017 10:48:14 GMT Standard Time;

defaultNamingContext: DC=SCH4304,DC=internal;

dnsHostName: Ralph.SCH4304.internal;

domainControllerFunctionality: 7 = ( WIN2016 );

domainFunctionality: 7 = ( WIN2016 );

dsServiceName: CN=NTDS Settings,CN=RALPH,CN=Servers,CN=KAS,CN=Sites,CN=Configuration,DC=SCH4304,DC=internal;

forestFunctionality: 7 = ( WIN2016 );

highestCommittedUSN: 6342287;

isGlobalCatalogReady: TRUE;

isSynchronized: TRUE;

ldapServiceName: SCH4304.internal:[email protected];

namingContexts (5): DC=SCH4304,DC=internal; CN=Configuration,DC=SCH4304,DC=internal; CN=Schema,CN=Configuration,DC=SCH4304,DC=internal; DC=DomainDnsZones,DC=SCH4304,DC=internal; DC=ForestDnsZones,DC=SCH4304,DC=internal;

rootDomainNamingContext: DC=SCH4304,DC=internal;

schemaNamingContext: CN=Schema,CN=Configuration,DC=SCH4304,DC=internal;

serverName: CN=RALPH,CN=Servers,CN=KAS,CN=Sites,CN=Configuration,DC=SCH4304,DC=internal;

subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=SCH4304,DC=internal;

supportedCapabilities (6): 1.2.840.113556.1.4.800 = ( ACTIVE_DIRECTORY ); 1.2.840.113556.1.4.1670 = ( ACTIVE_DIRECTORY_V51 ); 1.2.840.113556.1.4.1791 = ( ACTIVE_DIRECTORY_LDAP_INTEG ); 1.2.840.113556.1.4.1935 = ( ACTIVE_DIRECTORY_V61 ); 1.2.840.113556.1.4.2080 = ( ACTIVE_DIRECTORY_V61_R2 ); 1.2.840.113556.1.4.2237 = ( ACTIVE_DIRECTORY_W8 );

supportedControl (38): 1.2.840.113556.1.4.319 = ( PAGED_RESULT ); 1.2.840.113556.1.4.801 = ( SD_FLAGS ); 1.2.840.113556.1.4.473 = ( SORT ); 1.2.840.113556.1.4.528 = ( NOTIFICATION ); 1.2.840.113556.1.4.417 = ( SHOW_DELETED ); 1.2.840.113556.1.4.619 = ( LAZY_COMMIT ); 1.2.840.113556.1.4.841 = ( DIRSYNC ); 1.2.840.113556.1.4.529 = ( EXTENDED_DN ); 1.2.840.113556.1.4.805 = ( TREE_DELETE ); 1.2.840.113556.1.4.521 = ( CROSSDOM_MOVE_TARGET ); 1.2.840.113556.1.4.970 = ( GET_STATS ); 1.2.840.113556.1.4.1338 = ( VERIFY_NAME ); 1.2.840.113556.1.4.474 = ( RESP_SORT ); 1.2.840.113556.1.4.1339 = ( DOMAIN_SCOPE ); 1.2.840.113556.1.4.1340 = ( SEARCH_OPTIONS ); 1.2.840.113556.1.4.1413 = ( PERMISSIVE_MODIFY ); 2.16.840.1.113730.3.4.9 = ( VLVREQUEST ); 2.16.840.1.113730.3.4.10 = ( VLVRESPONSE ); 1.2.840.113556.1.4.1504 = ( ASQ ); 1.2.840.113556.1.4.1852 = ( QUOTA_CONTROL ); 1.2.840.113556.1.4.802 = ( RANGE_OPTION ); 1.2.840.113556.1.4.1907 = ( SHUTDOWN_NOTIFY ); 1.2.840.113556.1.4.1948 = ( RANGE_RETRIEVAL_NOERR ); 1.2.840.113556.1.4.1974 = ( FORCE_UPDATE ); 1.2.840.113556.1.4.1341 = ( RODC_DCPROMO ); 1.2.840.113556.1.4.2026 = ( DN_INPUT ); 1.2.840.113556.1.4.2064 = ( SHOW_RECYCLED ); 1.2.840.113556.1.4.2065 = ( SHOW_DEACTIVATED_LINK ); 1.2.840.113556.1.4.2066 = ( POLICY_HINTS_DEPRECATED ); 1.2.840.113556.1.4.2090 = ( DIRSYNC_EX ); 1.2.840.113556.1.4.2205 = ( UPDATE_STATS ); 1.2.840.113556.1.4.2204 = ( TREE_DELETE_EX ); 1.2.840.113556.1.4.2206 = ( SEARCH_HINTS ); 1.2.840.113556.1.4.2211 = ( EXPECTED_ENTRY_COUNT ); 1.2.840.113556.1.4.2239 = ( POLICY_HINTS ); 1.2.840.113556.1.4.2255; 1.2.840.113556.1.4.2256; 1.2.840.113556.1.4.2309;

supportedLDAPPolicies (20): MaxPoolThreads; MaxPercentDirSyncRequests; MaxDatagramRecv; MaxReceiveBuffer; InitRecvTimeout; MaxConnections; MaxConnIdleTime; MaxPageSize; MaxBatchReturnMessages; MaxQueryDuration; MaxDirSyncDuration; MaxTempTableSize; MaxResultSetSize; MinResultSets; MaxResultSetsPerConn; MaxNotificationPerConn; MaxValRange; MaxValRangeTransitive; ThreadMemoryLimit; SystemMemoryLimitPercent;

supportedLDAPVersion (2): 3; 2;

supportedSASLMechanisms (4): GSSAPI; GSS-SPNEGO; EXTERNAL; DIGEST-MD5;

 

and according to phpinfo php-ldap is working

 

ldap

 

LDAP Support enabled

RCS Version $Id: 8ab0fe072786e6f8d7dbd47b6a4897e81ce89ec3 $

Total Links 0/unlimited

API Version 3001

Vendor Name OpenLDAP

Vendor Version 20442

SASL Support Enabled

 

As far as I can see my config and authentication files look correct

[Norphy]

I gave up with it and rolled my own in PowerShell.

[markwilfan]

I gave up with it and rolled my own in PowerShell.[/quote @Norphy share or it didn't happen

[Norphy]

It's rather rough and ready and there isn't much in the way of documentation but it is mostly functional.

create wireless user.ps1