Moodle on IIS7.5 SSO fails

[OverWorked]

Hello,

 

I've got LDAP authentication working. Now I'm stuck on NTLM SSO. I've worked through NTLM authentication - MoodleDocs.

 

Now SSO fails every time.

 

With IE fast path disabled, users see:-

Attempting Single Sign On via NTLM...

Auto-login failed, try the normal login page...

then Moodle goes to the normal login screen, and they can log in with their LDAP credentials

 

 

With IE fat path enabled, it's worse. User just see a blank white screen with:-

Fatal error: $CFG->dataroot is not writable, admin has to fix directory permissions! Exiting.

Then it's impossible to log on.

 

Any ideas?

 

Thanks.

[iceman85]

Is this still happening? Have you got a screen shot of your LDAP settings in moodle you can post?

[OverWorked]

Thanks for replying and sorry for my late response.

 

I think I've found the reqason for the problem - LDAP is only partially working. I've had a lot of trouble getting accounts to log on - some would and some wouldn't.

 

It appears that Moodle LDAP auth checks the user's cn attribute, not the Windows logon name.

 

Most of our AD accounts have a cn attribute like "Fred Smith", but a user login name like "09fblogg".

 

They can log on to Moodle with Fred Smith + password, but not 09fblogg.

 

I think this is why SSO fails.

 

How do I make Moodle check against the Windows logon name, instead of the cn attribute?

 

I've just spent nearly a whole day experimenting to find this!

[Butters]

Thanks for replying and sorry for my late response.

 

I think I've found the reqason for the problem - LDAP is only partially working. I've had a lot of trouble getting accounts to log on - some would and some wouldn't.

 

It appears that Moodle LDAP auth checks the user's cn attribute, not the Windows logon name.

 

Most of our AD accounts have a cn attribute like "Fred Smith", but a user login name like "09fblogg".

 

They can log on to Moodle with Fred Smith + password, but not 09fblogg.

 

I think this is why SSO fails.

 

How do I make Moodle check against the Windows logon name, instead of the cn attribute?

 

I've just spent nearly a whole day experimenting to find this!

 

You can set the user attribute to sAMAccountName in the Moodle LDAP settings to use the windows logon name.

 

The document says CN by default but in nearly all cases this should be sAMAccountName.

Edited February 1, 2012 by Butters

[OverWorked]

You can set the user attribute to sAMAccountName in the Moodle LDAP settings to use the windows logon name.

 

The document says CN by default but in nearly all cases this should be sAMAccountName.

 

Thank you. Thank you. Thank you!

 

LDAP is working properly now for Windows logon names, not the common names.

 

Now I've just got to get SSO set up again.

[Butters]

NTLM is harder to diagnose as it largely is based on the setup locally. Could your printscreen your NTLM settings in Moodle and PM me with them and I'll take a look.

[OverWorked]

I've fixed SSO.

 

Fatal error: $CFG->dataroot is not writable, admin has to fix directory permissions! Exiting.

 

I changed the permissions on \moodledata\ to give the relevant users modify permission. Because SSO uses Windows authentication, instead of anonymous, the NTFS directory permisions have to be changed.

 

Thanks very much.