ntoupin

That error throw is custom coded in the php, it's not an actual LDAP error. It's coded to throw that error... if ($info !=1){ } where $info = ldap_count_entries($ldap, $result); when binding the ldap connection. How the form is working is that you enter the details and when you submit it binds to the ldap server, does an ldap search for the username you entered. If it finds an entry, it results a false for $info!=1 because $info would be 1 (matching the username in your LDAP) and goes to the else {} statement which just echo's the error message into the page. It shouldn't create the account if it's throwing that error as the only code in the else {} statement that shows the error is the error, the code that actually creates an account in LDAP is dependent on the if ($info !=1){ } passing as true. The only thing I can think of that would do that would be users submitting the form, it creates the account in the backend while processing the end user's page, then while the page is still loading they hit submit again thus bringing them to the error message (basically double clicking the submit button) vs. submitting once and waiting for a page load. If that's not the case, attach or pm me your index.php code so I can take a look.

Looking for ways people currently get certificates deployed onto end-user personal devices such as BYOD for SSL inspection for web filtering. Do you just have a page where users can download the certificate with instructions on installing? Do you have an onboarding system that installs the certificate as part of the self-enrollment for wireless connection?

Correct, if I do ever update it my plan was to put the configs into a database so no configs would need to be done in the actual code. Those we're just placeholders for future settings / changes. Of course feel free to change/modify to your needs. Not sure that I'll ever update it on git though as I really only made this for my own use and just wanted to share it in working condition for others that could find use for it.

My pleasure, enjoy! It's been very convenient to not have to create guest/temporary accounts for wifi/computer authentication for speakers, events, etc. myself and allow the staff to do this themselves, so hopefully you find the same!

The certificate authentication for LDAPS has been the most common issue people have had when PMing me for help - I usually tell most to just set ldap.conf to "TLS_REQCERT never" right off the bat for testing - if everything works after that then the cert/ldaps is the issue.

Enable ldap debugging, what error is it throwing? ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);

I have it running on a apache webserver on linux. No reason it can't work on IIS/windows though, it's just PHP code. It requires PHP openLDAP to be enabled.

We use the same, haven't had to use any of the backups but it works simply and is free depending on your needs.

Now on GitHub: https://github.com/ntoupin/AD-Guest-Registration Again, it's at the very beginning stags, the code is all over and there's configuration in just about every file you would need to do to make it work with the current code.

Hi, It's still in the development stage - it works but the code and organization needs a big overhaul as I coded it just to get it to work, not be deployable/customizable yet. I'm planning to put it up on github sometime soon.

Yes, the tablets are locked down and the only thing you can do with them is what the teachers set as the current "profile" - basically the apps they choose to be shown on the screen and accessible. When applying the profile from the management, they do push out to the tablets to automatically install. We never really had to make a master tablet - through TabPilot, upon registering them, you can remotely uninstall any of the apps you don't want to start with a blank slate, then go from there. Even if there's 200 apps installed, users will only see the ones set by the profile, so there isn't a big need to change settings and remove specific apps on one and try to clone it over.

I'll contact my state rep just in case, but we don't license anything from Microsoft on a user base, we own the licenses based on device (W7/W8.1 Volume license, Server 2012 R2 Standard licenses) Staff and students all have access to use their own device on wireless so again, it's no different than what they have. The wireless is separated from our internal and has only internet access, it cannot contact the domain at all beyond using AD credentials to authenticate through the radius server. Our AP's (although probably not as successful as they advertise it to be) target rogue SSIDs and contain it. At the very least we become known of any hotspots almost instantly. Partially on our side is the fact there's little to no cell coverage in our buildings (1-2 bars tops).

Certainly could work for something like that. The baseline purpose is to make it more of a self-service or end-user level task for when non-regular staff have a genuine need for authentication access to wifi or AD (computers/etc.) I didn't have one before I was testing with this and testing for our new wireless system we'll be putting in place (Cisco Meraki's). It's actually extremely easy, I had ours up and running and acting as a RADIUS authentication system for testing with Meraki within 15 minutes. Here's their guide on doing it, the general setup can be used with pretty much any system that will take RADIUS auth: https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise

Hi, I completely understand your skepticism at first, and maybe our situation is different than others. This would be more for the teachers or admins use, not a tech departments. The guests are typically guest speakers, presenters, etc. that are presenting in a classroom or auditorium and would need wifi access to use their own device and/or a guest credential to use one of our devices to bring up a presentation or video on for example. It would not be intended for guests in case of people that just entered the building or a short meeting like a salesperson, but strictly for planned guests that have a legitimate need for access. Even if someone (only teachers/admins can create these guest accounts) simply put in "demo user" the staff member that created the user gets attached to it. Right now simply by extra details on the AD account itself, but also I'll be adding logs directly to the script to monitor/track it. The responsibility of that guest ultimately gets attached to the person creating the account, just as someone physically signing in a guest into the school for a reason becomes their responsibility. For licensing, I'm not sure how this is an issue. We don't license our servers via CAL's but by physical cores, so maybe we're different there. I'm not an expert on MS licensing but again, I don't see how this would have any issues for us. It doesn't open it up to hackers any more than giving students and staff AD credentials, and in our experience the students are the ones to worry about. I appreciate the feedback!

Hi All, I put this initially in the edugeek projects ideas forum, not sure if that was right but I found this location afterwards and it looked like a better spot based on other threads located here. I'm working on a system that is mainly for use with our wireless system which uses a Windows RADIUS server to authenticate users onto our SSIDs. Although that's the main purpose it also can be used for general "guest" computer access as well as any system internally that uses AD to authenticate (in our case - helpdesk, booking software, etc.). At its base it's a simple php script that allows any current (or designated - I currently have it set to any "staff" user (in the AD security group "staff")) AD user log in and fill out a php form that will automatically create a new account in active directory. That account will be made with a defined prefix, "guest_" for example, and created in the specified AD OU, "GuestUsers" for example, with an expiration date and time controlled by the form. Also in the form is additional information such as the guests name, location they will be in, what staff member is "sponsoring" the guest. In addition to the script creating the user automatically a separate powershell script is used as a scheduled task on any domain controller which looks at the expired guest users and removes them. This is purely for the fact of "cleaning up" old guests and making the username that was used for them available again. Below are some screenshots of the system. It is currently functional but I will be adding some additional features and cleaning up a lot of the code before actually using it. It works local on a LAN but I also tested it from a remote website and with a little tweaking of the LDAP connection was able to get it successfully working there as well. It also is responsive in its design (uses bootstrap) for mobile devices. A base list of its current features: LDAP/AD login Choose what users can create a guest account Users choose guest account expiration (1 hour, 1 day, 2 day, etc.) Users choose guest username and password for ease of use Additional information gathered for system logging (location, purpose, guest first and last name, staff creating the account) Error catch for duplicate users Printable "ticket" to give to the guest on creation Automated creation of guest account in active directory/ldap with user's inputted information Automatic "cleaning" of old expired guest accounts via scheduled task on domain controller Responsive design (bootstrap) for mobile Some features to add: History for staff users (will show a record of guests they "sponsored" in the past, when those expired, what username/password they gave them, etc.) Log system (for admin/technical use - lookup right in the script user sponsor history, search for guest name, username, etc.) A few more checks to ensure a duplicate is not being created and/or a safe fail that creates a user anyways with a randomly generated number after it. Login screen (uses LDAP/AD credentials) Registration form to fill out guest details Sample form filled, dropdown of account expiration options Successful registration of guest account Duplicate error Printable "ticket" to hand to guest AD user created I honestly don't know if this would ever be useful to others or if it has or hasn't been created before. I search a bit and figured I could just make it myself and customize it to our needs. If it would be useful for others I can share the system once it's cleaned up a bit. I'm also open to suggestions for some improvements or additions to the system. Thanks!