MRBS - LDAP idiots guide required

[timbo343]

So after struggling to get MRBS working ive now found myself *trying* to get LDAP to work but there doesnt seem to be any idiots guides around on how to get it to work, unless im missing something. Has anyone got one or is able to help getting ldap working on MRBS. At the end of the day, ldap might be a bit too much for the purpose of this booking system but it would be nice to try and get AD logins to work on MRBS.

 

THanks

[localzuk]

To use LDAP, I have the following set in my config.inc.php file:

 

$auth["type"] = "ldap";

$ldap_host = '10.5.143.139';
$ldap_port = 389;
$ldap_v3 = true;
$ldap_tls = false;
$ldap_base_dn[] = "ou=Teaching,ou=Staff,dc=domain,dc=local;
$ldap_base_dn[] = "ou=Admin,ou=Staff,dc=domain,dc=local;
$ldap_base_dn[] = "ou=Management,ou=Staff,dc=domain,dc=local;
$ldap_user_attrib = "uid";
$ldap_dn_search_attrib = "sAMAccountName";
$ldap_dn_search_dn = "cn=User,cn=Users,dc=domain,dc=local;
$ldap_dn_search_password = "PASSWORD";
$ldap_disable_referrals = true;
$ldap_get_user_email = true;
$ldap_email_attrib = 'mail';

[timbo343]

So basically just add this to the bottom of the config.inc.php file?

[localzuk]

Adjusting for your own Active Directory structure, yeah.

[timbo343]

Haha, yeah of course [emoji1].

 

Oh, i thought there was more to it than that, thank you.

 

Will try it tomorrow.

[timbo343]

Just tried the auth settings and got a white screen whilst logging in with a domain user so had to upgrade MRBS to 1.6.1 - apparently the fix is in there and it works but... how do i now tell MRSB what level each user is?

 

I must admit, the documentation isn't great for this software.

[localzuk]

You can either specify admins using the lines:

 

$auth["admin"][] = "username";

 

for each admin user, or you can use this:

 

$ldap_admin_group_dn='cn=Domain Admins,cn=Users,dc=domain,dc=local;
$ldap_admin_group_member_attrib='memberof';

 

We use the first way - as there's only 2 admins for it.

[Achandler]

We use the 2nd way and it definitely works.

[chekmate1984]

Does all the bvelow fields needs configuring?

 

$auth["type"] = "ldap";

 

$ldap_host = '10.5.143.139';

$ldap_port = 389;

$ldap_v3 = true;

$ldap_tls = false;

$ldap_base_dn[] = "ou=Teaching,ou=Staff,dc=domain,dc=local;

$ldap_base_dn[] = "ou=Admin,ou=Staff,dc=domain,dc=local;

$ldap_base_dn[] = "ou=Management,ou=Staff,dc=domain,dc=local;

$ldap_user_attrib = "uid";

$ldap_dn_search_attrib = "sAMAccountName";

$ldap_dn_search_dn = "cn=User,cn=Users,dc=domain,dc=local;

$ldap_dn_search_password = "PASSWORD";

$ldap_disable_referrals = true;

$ldap_get_user_email = true;

$ldap_email_attrib = 'mail';

 

I have filled in the below

 

$ldap_host = 'xxx';

$ldap_port = 389;

$ldap_base_dn[] = "OU=xxx,OU=xxx,DC=GM,DC=Internal;

 

But not sure if others are generic ones or i need to fill in?

[Achandler]

A lot of them need filling but not all.

 

For example the:

$ldap_dn_search_attrib = "sAMAccountName";

$ldap_dn_search_dn = "cn=User,cn=Users,dc=domain,dc=local;

$ldap_dn_search_password = "PASSWORD";

 

This tells the LDAP setup what account to look with the search_dn and the search_password. The attribute is what it is returning, hence sAMAccoutnName

 

You probably want it to return the email address as well.

 

By the way if you have ADFS setup there is SAML modules which are probably a better way to do internal logins now.

[evasion]

yes, SAML modules is a good idea - any sample config to help with setting this up?

[Achandler]

Have you got ADFS set up already?

 

If so then make sure you have a valid cert on your Moodle installation, then install the plugin. The SAML plugin creates the config file to copy into ADFs from memory.