Intranet page based on group membership

[MK-2]

I have two intranet pages (index-staff.php and index-student.php) and then an index.php which I want to check the currently logged on users group membership and redirect them to one of the relevant pages.

I know if I turn on authentication it will pick up the username and do the relevant checks OK, but as this is an intranet page i dont really want a login box showing. is there anyway to have PHP (or any other language i can google help for) check the currently logged in user name and if they are a member of group x, show page x, group y show page y, etc without it asking for a username and password in IE.

 

ive seen some php examples but in that you have to specify the username as a variable, which i wont know, it would have to get that variable from somewhere else.

 

any help would be great, thanks

[jamesreedersmith]

Could you not use a login script to set a marker file that a shortcut points to that loads the relevant page?

[MK-2]

well, the thing is, if i named it staff-index.php then students would be able to change theirs to that and see the page. i wanted something that was doing group membership so even if they typed it in it would deny access. i know its possible to get the logged in username, but only after you have authenticated in the IE logon box. thats all im trying to bypass

[Marci]

Depends on your webserver software... if using Apache then you need to set it up for NTLM SSO: Apache :: seamless authentication

[MK-2]

sorry, forgot to mention, this is using IIS7 on server 2008.

[Marci]

How to Enable SSO (Single Sign On) on IIS 7 and IIS 6

 

and User variables: http://msdn.microsoft.com/en-us/library/ms524602(v=vs.90).aspx

Edited June 16, 2011 by Marci

[MK-2]

i did have a quick look at SSO, so ill have a better look tomorrow.

thanks for your help

[MK-2]

hey, i enabled SSO but when i go to http://intranet/index.php i get the IE login box pop up and it will only display once authenticated. I was hoping it would not show that and just use the current logged in user credentials, isn't that what SSO is meant to do?

[localzuk]

Your site needs to be within the trusted or 'local intranet' sites list, with NTLM passthrough enabled and allowed in your browser.

 

Enabling NTLM Authentication in Firefox and Internet Explorer

[MK-2]

i've done the local intranet bit but how do i do the NTLM passthrough as that link shows how you add sites to the intranet but nothing about enabling and allowing ntlm passthrough.

 

sorry if im sounding thick!

[localzuk]

i've done the local intranet bit but how do i do the NTLM passthrough as that link shows how you add sites to the intranet but nothing about enabling and allowing ntlm passthrough.

 

sorry if im sounding thick!

 

What security level have you got 'Local Intranet' set to? On the Security tab, select Local Intranet, and then click 'Custom Level'. Scroll to the bottom and you should see a 'User Authentication' bit, and 'Automatic logon only in Intranet zone' should be selected.

[MK-2]

this is what ive done so far:

 

on IIS7 i've created the intranet folder and set authentication to windows authentication (with provider as NTLM and not negotiate or kerberos)

on the client I've added http://intranet as an intranet site, and have now just done as you said and set custom level and automatic logon in intranet zone

 

i restart IE yet as soon as i go to http://intranet/index.php it pops up the box again

[MK-2]

hmm actually, its working now, my apologies!

[localzuk]

Glad to hear its working. I used the same sort of system here now, a single intranet site that changes what links it shows etc... depending on group membership.

[MK-2]

Glad to hear its working. I used the same sort of system here now, a single intranet site that changes what links it shows etc... depending on group membership.

 

what code did you use to do the group membership bit? i know we had this discussion in another thread on here where you showed me some php but i am having trouble getting it to check multiple memberships to one user. this is what i have based on the one you pasted a few months back (bearing in mind i dont know php so it is probably wrong now):

<?php

$initial = $_SERVER["AUTH_USER"];

$_SESSION['un'] = preg_replace("/.*\\\\/", "", $initial);

 

$ldaphost = "xxxx";

$ldapport = 389;

$basedn = 'dc=server,dc=internal';

$group1 = 'Domain Admins';

$group2 = 'Senior Teaching Staff - Security Group';

$bind_user = "cn=Administrator,cn=Users," . $basedn;

$password = 'xxxx';

 

$ad = ldap_connect($ldaphost, $ldapport)

or die("Could not connect to $ldaphost");

 

// BIND TO LDAP

ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);

ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);

@ldap_bind($ad, $bind_user, $password) or die('Could not bind to AD.');

 

$filter = "(sAMAccountName=" . $_SESSION['un'] . ")";

$attr = array("memberof");

$result = ldap_search($ad, $basedn, $filter, $attr) or exit("Unable to search LDAP server");

$entries = ldap_get_entries($ad,$result);

ldap_unbind($ad);

$access = 0;

 

foreach($entries[0]['memberof'] as $grps)

{

if(strpos($grps,$group)){ $access = 1;}

if(strpos($grps,$group)){ $access = 2;}

}

 

if($access == 1){echo ("redirecting to page 1");}

if($access == 2){echo ("redirecting to page 2");}

 

 

?>

 

i cant remember how you redirect to a page using php, i know there is a way of using "header (location:" but not sure if it applies here

[localzuk]

I have a few functions -

 

<?php

 

 

//Returns a bound LDAP connection

function getldapconnection($host,$user,$password){

$ad = ldap_connect("ldap://" . $host,389) or die('Could not connect to LDAP server.');

ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);

ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);

@ldap_bind($ad, $user, $password) or die('Could not bind to AD.');

return $ad;

}

 

//Checks group membership for a user

function checkldapgroupmembership($ldap,$basedn,$group,$username){

$filter = "(sAMAccountName=" . $username . ")";

$attr = array("memberof");

$result = ldap_search($ldap, $basedn, $filter, $attr) or exit("Unable to search LDAP server");

$entries = ldap_get_entries($ldap,$result);

$access = 0;

foreach($entries[0]['memberof'] as $grps){

if(strpos($grps,$group)){ $access = 1; break;}

}

return $access;

}

 

//Get real name from username

function getldapname($ldap,$basedn,$username){

$filter = "(sAMAccountName=" . $username . ")";

$result = ldap_search($ldap, $basedn, $filter) or exit("Unable to search LDAP server");

$entries = ldap_get_entries($ldap,$result);

return $entries[0]['cn'][0];

}

 

//Get email name from username

function getldapmail($ldap,$basedn,$username){

$filter = "(sAMAccountName=" . $username . ")";

$result = ldap_search($ldap, $basedn, $filter) or exit("Unable to search LDAP server");

$entries = ldap_get_entries($ldap,$result);

return $entries[0]['mail'][0];

}

?>

 

So that lot is in a functions.inc.php file, and then I simply call 'checkldapgroupmembership' wherever i need to.

[MK-2]

so you have that in functions.inc.php, and then in say index.php you call that function and do the if user is in group x do y part?

i know im being silly but if you have to pass the user/pass for searching ldap in the index file, isn't that then visible to anyone viewing the source?

 

also is it the header:location thing to redirect them that you use?

[localzuk]

Yes, that's what I do with it - if the user is in a group do x, else y etc...

 

PHP source is visible only to people on the server. So, the username and password are ones I've set up specifically for that purpose, and only the server and admins can access those files.

 

I don't have 2 separate index files - everything is one file, which has a series of if/else commands to choose what to display.

 

I wouldn't use 'header:location' anyway, as that would simply redirect them to the named index file. I'd include the files instead, so that way the index.php is the only thing they get to see.

[MK-2]

i have a few different things on each index file so prefer having the index-staff and index-student at the mo.

if i were to use header location, would that just be a sort of "if access=2 header location xxxx" sort of thing?

 

cheers for all the help again, really appreciated!

[localzuk]

If you use header:location, the end user simply gets redirected to your index-staff.php and they'll be able to see that in the URL bar.

 

If you embed those files into your index.php instead, they won't see where they're being sent - they'll just see index.php

[Marci]

S'also worth having a look at ADLDAP... it's a precompiled PHP script of functions to handle all AD - LDAP stuff (can also create and modify accounts, reset passwords etc etc) adLDAP - LDAP Authentication with PHP for Active Directory

[MK-2]

S'also worth having a look at ADLDAP... it's a precompiled PHP script of functions to handle all AD - LDAP stuff (can also create and modify accounts, reset passwords etc etc) adLDAP - LDAP Authentication with PHP for Active Directory

 

cool, i might be able to do single user creation through that then! nice one thanks

[Marci]

You can do everything thru it... it's rather nifty. We can upload a Csv to the site and parse it, feed it thru adldap and do bulk user creation. There ain't much you CAN'T do with it really!