LDAP Authentication and NTLM SSO is working!!! But....

LDAP Authentication and NTLM SSO is working!!! But....

by Brian Bennett -
Number of replies: 13

I was able to successfully setup my Moodle install to authenticate users against our company's MS Active Directory server. This is good.

I also enabled NTLM SSO. Here are my settings: Enable=Yes, Subnet=10/255.255.0.0, MS IE fast Path?=No

And finally, I also enabled 'forcelogin' under Administration >> Security >> Site Policies.

When I go to http://myserver.com/moodle/ I am presented with the standard Moddle login prompt. I am not automatically signed in.

However, if I go directly to http://myserver.com/moodle/auth/ldap/ntlmsso_attempt.php, I get an “Attempting Single Sign On via NTLM...” message and then I am successfully automatically logged into Moodle with the correct AD account. This is good.

My question is this, shouldn’t I be able to go directly to to http://myserver.com/moodle/ and be logged in automatically via NTLM SSO?

It appears that I am 95% of the way there and just missing a small piece seeing how the AD authentication is working and the SSO is as well if I go to the ntlmsso_attempt.php page.

Any advice and guidance is very much appreciated. Thanks.

My Moodle Environment is as follows:

  • Moodle 1.9.5+ (Build: 20091021)
  • PHP Version 5.2.11
  • MySQL 5.1
  • IIS 7
Average of ratings: -
In reply to Brian Bennett

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Iñaki Arenaza -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

The only thing that comes to mind is checking that you are actually coming from 10.0.0.0/255.255.0.0. Are there any proxies or routers doing NAT between your client machine and the Moodle server? Any reverse-proxy in from of it? (this may incluso ISA Server boxes and so on)

If Moodle thinks that you are coming from a different subnet, then it won't try NTLM SSO at all.

Saludos, Iñaki.

Average of ratings: -
In reply to Iñaki Arenaza

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Brian Bennett -

Fantastic! It is working now. Turns out I was using the wrong rang of ip/subnet listings in my configuration.

Unfortunately it now logs me in automatically using my WIndows account name and I cannot login as an administrator which is a separate internal account in Moodle…

How can I login as an administrator via the login window using the admin account credentials and not be automatically logged via my Windows account? I have no way to login to Moodle now as an administrator… Any help is appreciated. Take care.

-brian

Average of ratings: -
In reply to Brian Bennett

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Iñaki Arenaza -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

You can access the plain login page by going to http://your.moodle.site/login/index.php?authldap_skipntlmsso=1

That will skip the NTLM SSO automatic login.

Saludos, Iñaki.

Average of ratings: Useful (1)
In reply to Iñaki Arenaza

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Michael Woods -
Picture of Core developers
We actually added a manual login link to our front page to make it easier. In the footer.html of your theme, add something like:

<?php if ($home) { ?>
<div class="manuallogin"><a href="<?php echo $CFG->wwwroot ?>/login/index.php?authldap_skipntlmsso=1">Manual login</a></div>
<?php } ?>


Then in your style sheet, something like:

.manuallogin {
float:right;
font-size:0.8em;
}


We run several moodle instances for different purposes and this code is generic enough to copy from instance to instance.

Cheers,
Michael
Average of ratings: -
In reply to Brian Bennett

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Heather P -
We got that far too and had the same problem. Then somebody asked if we were going through a fire wall. Our Moodle sits in a DMZ, it is the DMZ that stopped it working as you anticipated.
At the time I was trying to make ours work it was suggested that to put that many holes in the firewall was not a good thing so we abandoned it. That might have changed by now I don't know. But if you are going into a DMZ then that might be your issue, you would have to make sure appropriate ports were open for it.
Regards
Average of ratings: -
In reply to Brian Bennett

回复: LDAP Authentication and NTLM SSO is working!!! But....

by ikangta tsai -
I have the same problem with you.

My Moodle Environment is as follows:

  • Moodle 1.9.7+
  • PHP Version 5.3
  • MySQL 5.1.37
  • Apache 2.2.12
  • windows 2003 server IP:10.165.1.63 DNS:10.165.1.12

DNS and LDAP(windows AD) server :10.165.1.12





Average of ratings: -
In reply to Brian Bennett

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Dean Lewis -

I have the exact same problem as listed by Brian.  I am using moodle 1.9.7+ with Apache and have successfully configured LDAP authentication.

In the same way as above, I have LDAP SSO working if I visit ntlmsso_attempt.php directly but when I visit any page that requires authentication, Moodle does not attempt single sign-on.  I must then login manually.

I have heard suggestions that this could be caused by incorrectly set subnet mask settings.  We have three subnets in the ranges 10.0.0.x, 10.0.1.x, 10.0.2.x and I have set the settings accordingly.  The settings currently are:

Subnet: 10.0.0.0/255.0.0.0, 10.0.1.0/255.0.0.0, 10.0.2.0/255.0.0.0

...but I have also tried many permutations of the syntax (such as 10.0.0.0/8 or 10.0.0/8 and many others).

I am attempting this test from client 10.0.0.135.  As suggested in a post by Iñaki Arenaza, I have added the following line to auth.php to determine that Moodle is definitely receiving the authentication request from 10.0.0.135:

error_log ('Client IP address as seen by NTLM SSO hook: ' . getremoteaddr());

When I check the Apache logs, I can see the request is received from the correct client so I don't think this is the issue.

(As a side issue, I am using IE8 for the test and if I enable MS IE Fastpath, NTLM SSO doesn't work at all; I receive an authentication failed error from ntlmsso_attempt.php.  I have also tried this with IE6 with the same results)

Any help on this would be appreciated.

Cheers, Dean.

Average of ratings: -
In reply to Dean Lewis

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Bertold Altaner -
Hi,
I'm not really familiar with NTLM SSO...
but if you have subnets as you described in your post, your subnetmask is wrong - it should be 255.255.255.0 or /24
Do you have dhcp working in your network? Check your networkmask on your client with ipconfig /all of ifconfig on command-line (dos-box).

I hope this helps

Bertold
Average of ratings: -
In reply to Bertold Altaner

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Dean Lewis -

Bertold,

Thanks for the reply.  I have tried various permutations of the subnet mask without success.  I have checked the subnet mask that is assigned to the client machine via DHCP and it is the default class A mask of 255.0.0.0.  Trying a mask of 255.255.255.0 as you suggested unfortunately failed the NTLM authentication.

I have managed to get this working now by changing the mask back from 10.0.0.0/255.0.0.0 to 10.0.0.0/8 (strange because /8 didn't work before).  This doesn't seem to make sense as http://docs.moodle.org/en/NTLM_authentication#Configuring_IP.2FSubnet_Mask documentation seems to suggest (and I may be wrong) that 10.0.0.0/255.0.0.0 would be a valid ip/mask combination.

Anyway, I have this working now so am happy.  Thanks for the help.

Regards, Dean.

Average of ratings: -
In reply to Brian Bennett

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Dean Lewis -

I spoke too soon.  While this has fixed the problem partially and now NTLM SSO is working to log users in automatically, I require the login process to be seemless and as we use IE the only way to achieve this is to use the MS IE Fastpath option.

The problem is that when I enable MS IE Fastpath I receive a 'Server error 500... server is overloaded or there was an error in a CGI script'.  This occurs everytime ntlmsso_magic.php is called.  I have checked the Apache logs and no errors are recorded.

Have been trying to get this functioning for a couple of days now.  Any help much appreciated.

Cheers, Dean.

Average of ratings: -
In reply to Dean Lewis

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Andrew Morris -

Did you resolve this Dean?

Average of ratings: -
In reply to Andrew Morris

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Calvin Bu -

Hello All,

I also need help to properly configure "Subnet" for my SSO Moodle instance. 

My agency has office all over the state. The list of subnet number is around 300 of them. Is there a wild card that I can use to SSO all the computers in my agency network?

Thanks,

Cal 

Average of ratings: -
In reply to Calvin Bu

Re: LDAP Authentication and NTLM SSO is working!!! But....

by Calvin Bu -

It looks like that the subnet value 0.0.0.0/0 is key to allow all computers to authenticate via NTLM SSO.

Thanks,
Cal
 

Average of ratings: Useful (1)