moodle sso help

[cobra]

Hi

I am using Server 2008, iis 7 and moodle 2.0.2, i have ldap working but I am having trouble getting sso working so thought that I would come on here for some help.

 

I have followed the guides that moodle provides (but these dont seem to be tailored to moodle 2) and some iis sso guides. I have enabled windows authentication and disabled annonymous authentication in IIS. I have configured the ntlm sso settings in moodle but I am still not having any luck i believe that I am missing a stage, so I hoping that someone on here could tell me if there is anything else that I need to configure??

 

Also can you set a range of ip addresses in the subnet mask when setting up ntlm on moodle? if so what is the format that you type it into moodle? I have typed it in as: iprange1/bitmask, iprange2/bitmask, iprange3/bitmask

but I am not sure if this is the correct way to do it.

 

Thank you for your help

[sonofsanta]

Relevant info for me was @ NTLM authentication - MoodleDocs

 

You can do slash notation, or just list subnets, with any blank octets being wildcarded - so if you tell it to use SSO with 192.168.1. then anything from 192.168.1.1-255 would get an SSO attempt

 

This was Moodle 1.9ish tho, don't know about v2

[cobra]

Thanks for the reply.

At my work we use the range of ips xxx.xxx.40.0 - xxx.xxx.47.0 do you think that I should write this in moodle as xxx.xxx.40.1 - xxx.xxx.47.1? or is that not possible... Most of our student stations are on xxx.xxx.41.1, do you think that i may have to just use this one ip range?

[danbuntu]

Have you added the moodle url to the internet zone in IE?

[sonofsanta]

I think ranges can only cover the last octet, but you can list multiple ranges... so just use the following list

xxx.yyy.40.,xxx.yyy.41.,xxx.yyy.42.,xxx.yyy.43.,xxx.yyy.44.,xxx.yyy.45.,xxx.yyy.46.,xxx.yyy.47.

Obviously replacing the x and y's with whatever you need. The final full stop is important, so use it in exactly that format (if Moodle 2 is the same anyway)

[cobra]

Thanks guys, ive changed my settings the that exact code. Il add the url into our internet zone now too dabuntu and see if sso starts working then

[Disaster]

HAHA, now you've broke it, fooooooooo!

[cobra]

noooooooo itl be alive again soon! just gota give the server a round house kick to the face rex kwondo style http://profile.ak.fbcdn.net/hprofile-ak-snc4/50552_56338071914_1686037_n.jpg

[cobra]

Im nearly there now, i am now getting the attempting sso via ntlm message when i click the log in button on moodle. The log in is failing at the moment though

[danbuntu]

Check your DC log for errors. Yuo could be that your sso settings in moodle are wrong (wrong context etc)

[cobra]

I cant see anything in the dc logs, so my sso settings must still be off. I read on the moodle forum that it could be to do with folder permissions. When you set up your sso with iis did you have to set any extra folder permissions?

[danbuntu]

when you set up your sso with iis did you have to set any extra folder permissions?

 

Personnally I use apache in Windows. I've a lot of stories of people hitting problems when they try to scale IIS and Moodle

[cobra]

My current moodle is in apache, i wanted my new one to be all windows though because I understand it better so I can configure it more

 

Do you know which file it is in moodle where I can set these settings (they are in the ntlm documentation but it does not tell you where it is that you set them) I assumed that they were part of the ntlm setting I set via the interface in moodle, but now I am thinking that they must be in an ini file somewhere.

 

you've ldap->ntlmsso_enabled

you've ldap->ntlmsso_subnet

 

?

 

Thank you

[danbuntu]

how about I don't know much apache therefore I will try to learn more?

From talking to other Moodle admins and personal experience you'll going to find that you hit a brick wall with support. SSO being a prime example, I used docs on moodle.org with relates to windows and apache and got it working without a hitch.

[cobra]

Got it working!!!! for some reason my annoymous authentication had gone back to enabled, i must not have changed it by mistake at some point. all working now though