Moodle - Setting SSO or Auto login

[newpersn]

Hi all,

 

So i have a project to start work on.

 

We currently have moodle setup and running (1.9.9 yep. quite old and its my project to build a new one and migrate the data over)

 

Now the old one automatically logs in when users start internet explorer. I would like the new one to do this. But cant see a simple way of doing this. LDAP is setup as it can login to the new moodle with my AD.

 

Any ideas?

Thanks

[bknaggs]

I’ve done this recently on IIS. I’ll try and remember to have a look at the config in the morning.

[newpersn]

Think I should of added. It’s running Ubuntu.

[cscc]

This any use? Covers most options.

 

https://docs.moodle.org/36/en/NTLM_authentication

 

A lot of these guides a version specific.

[bknaggs]

The Moodle docs page is what I followed. SSO for me only works if I go to https://our_moodle/auth/ldap/ntlmsso_attempt.php and I'm using a PC in the network range I've specified for SSO.

[newpersn]

Well... this is annoying:

:~$ sudo apt-get install php5-ldap libapache2-mod-auth-ntlm-winbind winbind cifs-utils smbclient samba

Reading package lists... Done

Building dependency tree

Reading state information... Done

E: Unable to locate package php5-ldap

 

My googling is not really helping me Any idea?

[cscc]

May require downloading separately if not found in the repository.

 

https://packages.ubuntu.com/trusty/php5-ldap

[newpersn]

I’m running 16.04. How do I download it from the repository ?

[cscc]

16.04 comes with PHP7 does it not? Probably why it can’t find the package.

 

The other option is to upgrade PHP to version 7 if it is on 5.

[newpersn]

16.04 comes with PHP7 does it not? Probably why it can’t find the package.

 

The other option is to upgrade PHP to version 7 if it is on 5.

 

I’ll take that bit out of the cmd and try again.

 

How do I check for upgrades for php?

[cscc]

https://thishosting.rocks/install-php-on-ubuntu/

 

Fairly comprehensive guide there. I would take a snapshot or backup first if the server is important.

[newpersn]

Do i need to join the server to my domain? I cant see the old one on AD.

[cscc]

I don't believe so, once configured it should be able to query AD with appropriate credentials.

[newpersn]

Could you share your files that contain the setting please.

 

Thanks

[cscc]

I don’t have it to hand unfortunately. It was a test build that’s been decommissioned. I was running 12.04 at the time which behaved itself with regards to the guides above. I do believe it needs joining to the domain thinking about it. Sorry I couldn’t be of more help.

[gshaw]

I have the SSO running on CentOS...

 

Install the following packages

 

• samba-common
  
• mod_auth_ntlm_winbind
  

Then basically run these commands to join to domain:

 

ADSERVER=domaincontrollername.domain.fqdn.ac.uk
DOMAIN=domain.fqdn.ac.uk
WORKGROUP=DOMAIN

authconfig --enableshadow --enablemd5 --passalgo=md5 --krb5kdc=$ADSERVER --krb5realm=$DOMAIN --smbservers=$ADSERVER --smbworkgroup=$WORKGROUP --enablewinbind --enablewinbindauth --smbsecurity=ads --smbrealm=$DOMAIN --smbidmapuid="16777216-33554431" --smbidmapgid="16777216-33554431" --winbindseparator="+" --winbindtemplateshell="/bin/false" --disablewinbindusedefaultdomain --disablewinbindoffline --winbindjoin=Administrator --disablewins --disablecache --enablelocauthorize --updateall

usermod -G wbpriv apache
chkconfig winbind on

 

Also enable KeepAlive in Apache config file and make sure you set the remote username format to whatever format it's configured to in smb.conf (usually in Moodle it needs to be set to %domain%+%username% )

[newpersn]

Having a nightmare with this!

 

Had to restore my snapshot to start again...

 

Which file do i need to edit for NTLM for our domain settings..

[newpersn]

Anyone?

[gshaw]

@newpersn

 

So run these commands as per Moodle instructions...

 

https://docs.moodle.org/36/en/NTLM_authentication

 

sudo apt-get install php5-ldap libapache2-mod-auth-ntlm-winbind winbind smbfs smbclient samba sudo a2enmod auth_ntlm_winbind sudo /etc/init.d/apache2 restart

 

Then the commands I listed in the other post go straight in at command prompt with enter in between.

 

If you need to change the Samba username format that's in /etc/samba/smb.conf

Edited December 19, 2018 by gshaw

[newpersn]

Ok. I got this far:

 

root@moodle01:~# authconfig --enableshadow --enablemd5 --passalgo=md5 --krb5kdc=$ADSERVER --krb5realm=$DOMAIN --smbservers=$ADSERVER --smbworkgroup=$WORKGROUP --enablewinbind --enablewinbindauth --smbsecurity=ads --smbrealm=$DOMAIN --smbidmapuid="16777216-33554431" --smbidmapgid="16777216-33554431" --winbindseparator="+" --winbindtemplateshell="/bin/false" --disablewinbindusedefaultdomain --disablewinbindoffline --winbindjoin=Administrator --disablewins --disablecache --enablelocauthorize --updateall

authconfig: command not found

[gshaw]

Ok. I got this far:

Try

 

sudo apt install ldap-auth-config

 

And then first try the same authconfig lines again and if it still says command not found put ldap-auth-config as the command instead

[newpersn]

Ran that. Installed some items. Reran the command and still command not found... :/

[gshaw]

Looks like the commands I used in CentOS aren't happy in Ubuntu. Revert the snapshot and looks like back to the Moodle guide again...

 

Looks like it's just the /etc/smb.conf you need to edit from reading it back again

Edited December 21, 2018 by gshaw

[newpersn]

Ok, Trying to get my head around this.. (Slowly...)

 

Do i just need to add this to the smb conf file. (Under global settings)

 

 

workgroup = Domainname.local

password server = * <<

security = domain

encrypt passwords = true

idmap uid = 10000-20000

idmap gid = 10000-20000

 

And the run this:

 

# net join DomainName.local -U Administrator (Or any other admin account that have rights)

[newpersn]

Does anyone know what this is ment to be set as:

 

####### Authentication #######

 

# Server role. Defines in which mode Samba will operate. Possible

# values are "standalone server", "member server", "classic primary

# domain controller", "classic backup domain controller", "active

# directory domain controller".

#

# Most people will want "standalone sever" or "member server".

# Running as "active directory domain controller" will require first

# running "samba-tool domain provision" to wipe databases and create a

# new domain.

server role = standalone server