MRBS and LDAP

[karldenton]

Hi,

Struggling to get MRBS working with LDAP (Active Directory)

 

Code is as follows; Our domain name is school but netbios name is stjohns.local

Whenever you try to login on mrbs it just goes to a white screen

 

// 'auth_ldap' configuration settings

// Where is the LDAP server

$ldap_host = "2003server.stjohns.local";

// If you have a non-standard LDAP port, you can define it here

//$ldap_port = 389;

// If you do not want to use LDAP v3, change the following to false

$ldap_v3 = true;

// If you want to use TLS, change the following to true

$ldap_tls = false;

// LDAP base distinguish name

// See AUTHENTICATION for details of how check against multiple base dn's

$ldap_base_dn = "ou=users,dc=stjohns,dc=local";

// Attribute within the base dn that contains the username

$ldap_user_attrib = "mrbs";

// If you need to search the directory to find the user's DN to bind

// with, set the following to the attribute that holds the user's

// "username". In Microsoft AD directories this is "sAMAccountName"

$ldap_dn_search_attrib = "mrbs";

// If you need to bind as a particular user to do the search described

// above, specify the DN and password in the variables below

$ldap_dn_search_dn = "cn=mrbs,cn=Users,dc=stjohns,dc=local";

$ldap_dn_search_password = "********";

[amvc]

Hi Karldenton

 

This is our working section of the LDAP auth code, i notice that you have a group in Ad for MRBS users? we just allow staff access and set the administrator as our usual admin.

 

 

// 'auth_ldap' configuration settings
// Where is the LDAP server
$ldap_host = "10.112.32.180";
// If you have a non-standard LDAP port, you can define it here
$ldap_port = 389;
// If you do not want to use LDAP v3, change the following to false
$ldap_v3 = true;
// If you want to use TLS, change the following to true
$ldap_tls = false;
// LDAP base distinguish name
// See AUTHENTICATION for details of how check against multiple base dn's
$ldap_base_dn[] = "ou=Teachers, ou=Teaching Staff, ou=Staff, ou=Establishment, dc=amvc, dc=internal";
$ldap_base_dn[] = "ou=SMT, ou=Teaching Staff, ou=Staff, ou=Establishment, dc=amvc, dc=internal";
$ldap_base_dn[] = "ou=Temp, ou=Teaching Staff, ou=Staff, ou=Establishment, dc=amvc, dc=internal";
$ldap_base_dn[] = "ou=Support Staff, ou=Staff, ou=Establishment, dc=amvc, dc=internal";
$ldap_base_dn[] = "ou=Admin Accounts, ou=Establishment, dc=amvc, dc=internal";
$ldap_base_dn[] = "ou=IT, ou=Establishment, dc=amvc, dc=internal";
// Attribute within the base dn that contains the username
$ldap_user_attrib = "uid";
// If you need to search the directory to find the user's DN to bind
// with, set the following to the attribute that holds the user's
// "username". In Microsoft AD directories this is "sAMAccountName"
$ldap_dn_search_attrib = "sAMAccountName";
// If you need to bind as a particular user to do the search described
// above, specify the DN and password in the variables below
$ldap_dn_search_dn = "cn=sysmanager,ou=Admin Accounts, ou=establishment, dc=amvc,dc=internal";
$ldap_dn_search_password = "********";

 

HTH

 

Jon

[karldenton]

Thanks,

 

Just done a few changes to ours as follows:

 

// 'auth_ldap' configuration settings

// Where is the LDAP server

$ldap_host = "192.168.42.242";

// If you have a non-standard LDAP port, you can define it here

$ldap_port = 389;

// If you do not want to use LDAP v3, change the following to false

$ldap_v3 = true;

// If you want to use TLS, change the following to true

$ldap_tls = false;

// LDAP base distinguish name

// See AUTHENTICATION for details of how check against multiple base dn's

$ldap_base_dn = "ou=StJohnsUsers, ou=Staff, dc=stjohns, dc=local";

// Attribute within the base dn that contains the username

$ldap_user_attrib = "uid";

// If you need to search the directory to find the user's DN to bind

// with, set the following to the attribute that holds the user's

// "username". In Microsoft AD directories this is "sAMAccountName"

$ldap_dn_search_attrib = "sAMAccountName";

// If you need to bind as a particular user to do the search described

// above, specify the DN and password in the variables below

$ldap_dn_search_dn = "cn=mrbs,cn=Users,dc=stjohns,dc=local";

$ldap_dn_search_password = "*********";

 

When I try to login the screen is still white. The netbios name is stjohns.local but the domain name is "school". Does the ldap server need to be set to the IP or localhost as its on that machine.

[amvc]

Thanks,

Does the ldap server need to be set to the IP or localhost as its on that machine.

 

Either should do I think.

 

I think your problem is how you are defining your AD structure in the config code, these 2 segments seem to contradict each other?

 

// See AUTHENTICATION for details of how check against multiple base dn's

$ldap_base_dn = "ou=StJohnsUsers, ou=Staff, dc=stjohns, dc=local";

 

// above, specify the DN and password in the variables below

$ldap_dn_search_dn = "cn=mrbs,cn=Users,dc=stjohns,dc=local";

$ldap_dn_search_password = "*********";

 

This last one should be a user with rights to search the AD (I think)

 

Jon

[karldenton]

$ldap_dn_search_dn = "cn=administrator,OU=Users,dc=stjohns,dc=local";

$ldap_dn_search_password = "*******";

 

OK, changed the last section to administrator in the Users OU as its not in the StJohnsUsers OU. Still the same problem

[amvc]

We did struggle to get this working properly to start with and had the same error as you with the white screen.

 

Can you post a screenie of your AD structure like ours below?

 

 

Jon

[karldenton]

Find attached.

[amvc]

Ok, try...

 

 

// See AUTHENTICATION for details of how check against multiple base dn's

$ldap_base_dn = "ou=Staff, ou=StJohnsUsers, dc=stjohns, dc=local";

// Attribute within the base dn that contains the username

 

 

Jon

Edited August 7, 2009 by amvc

[karldenton]

Still the same problem mate.

[amvc]

Still the same problem mate.

 

Hmmmm, I dunno then

 

I am on hols now so wont be able to check here much for the next couple of weeks, but i have attached our complete config.inc.php, see if there is anything else you may have missed.

 

config.inc.zip

 

Jon

[jeffy]

I know that I am late in commenting, but I am just now thinking about setting MRBS and LDAP. When I set up my Joomla site to authenticate using LDAP, I had a white screen when LDAP was not enabled in php config and the proper dll file was not installed. Perhaps that is your issue? Or have you already solved this?

Jeff

[walkden-high]

Hi Karldenton

 

When you installed php did you install the Ldap extension during setup I had problems when I first started and thats what was letting me down.

 

Here is my config hope this can be any help to you.

 

// 'auth_ldap' configuration settings

// Where is the LDAP server

$ldap_host = "lh-whs-email.walkden.local";

// If you have a non-standard LDAP port, you can define it here

$ldap_port = 389;

// If you do not want to use LDAP v3, change the following to false

$ldap_v3 = true;

// If you want to use TLS, change the following to true

$ldap_tls = false;

// LDAP base distinguish name

// See AUTHENTICATION for details of how check against multiple base dn's

$ldap_base_dn = "ou=users,ou=walkden,dc=walkden,dc=local";

// Attribute within the base dn that contains the username

$ldap_user_attrib = "sAMAccountName";

// If you need to search the directory to find the user's DN to bind

// with, set the following to the attribute that holds the user's

// "username". In Microsoft AD directories this is "sAMAccountName"

$ldap_dn_search_attrib = "sAMAccountName";

// If you need to bind as a particular user to do the search described

// above, specify the DN and password in the variables below

$ldap_dn_search_dn = "cn=search, ou=ldap,ou=users,ou=walkden,dc=walkden,dc=local";

$ldap_dn_search_password = "*****";

[Chris_Cook]

Possibly a bit late, but i think $ldap_dn_search_attrib should be set to "sAMAccountName" (case sensitive).

 

 

// If you need to search the directory to find the user's DN to bind

// with, set the following to the attribute that holds the user's

// "username". In Microsoft AD directories this is "sAMAccountName"

$ldap_dn_search_attrib = "mrbs";

 

Hope this helps.

[ksaravana]

Hi,

 

Mine is working fine, but strugling with setting up the admin account in ldap configuration,

 

Thanks in advance.

[Chris_Cook]

Hi,

 

Mine is working fine, but strugling with setting up the admin account in ldap configuration,

 

Thanks in advance.

 

You need to make sure you have the following in your config.inc.php

 

 

// The list of administrators (can modify other peoples settings).
//
// This list is not needed when using the 'db' authentication scheme EXCEPT
// when upgrading from a pre-MRBS 1.4.2 system that used db authentication.
// Pre-1.4.2 the 'db' authentication scheme did need this list.   When running
// edit_users.php for the first time in a 1.4.2 system or later, with an existing
// users list in the database, the system will automatically add a field to
// the table for access rights and give admin rights to those users in the database
// for whom admin rights are defined here.   After that this list is ignored.
unset($auth["admin"]);              // Include this when copying to config.inc.php
$auth["admin"][] = "127.0.0.1";     // localhost IP address. Useful with IP sessions.
$auth["admin"][] = "administrator"; // A user name from the user list. Useful 
                                   // with most other session schemes.

 

Just after this, add the following line, but change "administrator" to the username of your ldap admin user. The

 

$auth["admin"][] = "administrator";

 

That should hopefully give you admin rights with that user.

 

In future it is best to start a new thread if you are not having the same problem and symptoms as described in the first post. This makes it easier for people to follow posts on the forum.

 

Hope you are enjoying your holidays.

[bentech4u]

HI

 

i am also facing the same issue. my MRBS works fine and i configured ldap authentication , but it's working

 

i enabled debug option on configuration file and the error i am getting on httpd error log is like this : [Thu Sep 19 10:49:35 2013] [error] [client 127.0.0.1] authLdapAction: Got LDAP c - Pastebin.com

 

also i am attaching my config file.please help me to fix this issue

 

thanks & Regards

Ben

config.inc (2).zip