LDAP authentication, Server connection successful but can't login to moodle

LDAP authentication, Server connection successful but can't login to moodle

by Maddy N -
Number of replies: 15

I'm trying to setup a LDAP authentication to MS AD in Moodle. My database in active directory has more than 2K users and i'm trying pull same users into Moodle db.

Moodle version 3.3.2+, php 7.1.11, Windows server 2012 R2

I've filled host, bind user name (DN), bind user password, context etc everything in the LDAP server settings under site administrator. When I test settings it displays LDAP server connection was successful.

But when I use the same bind user name and password and try to login to the moodle. I gives invalid login error.

What am I missing? Is it necessary to add users to moodle database first (by sync or manual add) before trying to login using LDAP users?

The bind user name in LDAP settings is in the format : cn=elearn,dc=xxx,dc=xxx

And while logging into Moodle user using the same user, I tried username as elearn, xxx.xxx\elearn, xxx\elearn, elearn@xxx.xxx etc but cant get through!

Can some pls guide me.

Average of ratings: -
In reply to Maddy N

Re: LDAP authentication, Server connection successful but can't login to moodle

by Emma Richardson -
Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Plugin developers

So is the bind user in the OU that you are referencing for users?

Did you use samaccountname for the user attribute?  

If you answered yes to both questions, are you using the samaccountname for the bind user when trying to log in?

Does the user already have an account in moodle under a different authentication method but with the same username?

In reply to Emma Richardson

Re: LDAP authentication, Server connection successful but can't login to moodle

by Maddy N -

1. Yes, The OU im referring is dc=xxx,dc=xxx i.e at the domain top level and all the users and also bind user (elearn) are under same OU (And this bind user is a domain user not domain admin, hope i.e. fine).

2.Yes, I used ldap.exe the support tool and saw that the attribute against bind user name is sAMAccountname. So I have filled samaccountname under user attribute.

3.Yes, and its elearn.

4.No. The moodle as of now only has one account i.e admin account created upon moodle installation. (username is admin)

In reply to Maddy N

Re: LDAP authentication, Server connection successful but can't login to moodle

by Leon Stringer -
Picture of Core developers Picture of Particularly helpful Moodlers

To answer the question "Is it necessary to add users to moodle database first": no it isn't. If the user doesn't already exist in the Moodle database it will be created on first login if successfully authenticated by AD.

The bind user does not have to be a domain admin.

Some things to check:

  1. Have you got Search subcontexts set to "yes"? This may be the problem if the elearn user isn't in the top of the context specified in Contexts.
  2. Is User type set to MS ActiveDirectory?
  3. Is the LDAP server plugin actually enabled under Site administrationPluginsAuthenticationManage authentication? (You can configure and test LDAP without having actually enabled this).
In reply to Maddy N

Re: LDAP authentication, Server connection successful but can't login to moodle

by Alain Jeanson -

Hello Maddy N

I have the exact same problem.

Did you ever find a solution ?

Thanks in advance.

In reply to Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

by Emma Richardson -
Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Plugin developers

Please post a screenshot of settings?  What is the error message?

In reply to Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

by Maddy N -

Hey Alain,

If you have set everything properly under LDAP server settings under site administrator. And when you test settings it displays LDAP server connection was successful, like was in my case all you have to do is restart the webserver (apache/iis). That should do it.

In reply to Maddy N

Re: LDAP authentication, Server connection successful but can't login to moodle

by Alain Jeanson -

Thanks Maddy,


Actually, the problem originates at the CONTEXT used.

In the Moodle documentation :  https://docs.moodle.org/34/en/LDAP_authentication, it cleary states that :

9. All of your Moodle users are in an organizational unit (OU) called moodleusers, which is right under your LDAP root. That OU has a DN of ou=moodleusers,dc=my,dc=organization,dc=domain

This is where it went wrong.

As mentionned by this post:

Re: LDAP - Windows - No sync and no login

You do not specify an OU, but a CN.

Personnally, instead of trying to get specific users in an OU (or CN), I simply went direct to the root (DC=domain, DC=local) and used the Search Subcontext option. I have way more users then I need, but at least its working.

I hope this helps someone, and that the docs get a bit clearer about it.

Thanks again


In reply to Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

by Emma Richardson -
Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Plugin developers

The docs are a wiki so feel free to see if you can make it clearer.  However, the docs are presuming that you have created an OU specifically for your moodle users and, as such, the context would be correct.  You used the users group already in your domain which apparently is structured slightly different in MSAD.

Average of ratings: Useful (1)
In reply to Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

by Iñaki Arenaza -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

Hi Alain,

I've added a couple of sentences stating that the LDAP settings used in the documentation are only examples of an hypothetical setup, And that one should adjust the example settings to reflect their own environment.

Would that be clear enough?

Saludos.

Iñaki.

In reply to Iñaki Arenaza

Re: LDAP authentication, Server connection successful but can't login to moodle

by Emma Richardson -
Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Plugin developers

Thanks Iñaki!  I would think that should help.

In reply to Iñaki Arenaza

Re: LDAP authentication, Server connection successful but can't login to moodle

by Alain Jeanson -

Hello Iñaki,

Thanks for your kind responses. You have been a great help.

Actually. Does adding an OU works or not ?

As mentionned before, my users ARE in a OU, lets call it Utilisateurs (yes I am french smile)

So, OU=Utilisateurs,DC=Domain,DC=Local should work, right  or should it be CN=Utilisateurs,DC=Domain,DC=Local ?

For me to make it work, I simply entered C=Domain,DC=Local, with the Search Subcontext at ON.


According to the documentation, OU=Utilisateurs should work. You mentionned CN. Which one is best/ok/suggested ?

Thanks again!

Alain


In reply to Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

by Iñaki Arenaza -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

Hi Alain,

Je dirais que, comme presque tout dans la vie, ça dépend smile Now, seriously, it completely depends on your LDAP directory structure and how you manage your LDAP users. If you look at the following image, you can see theLDAP directory structure of the Windows 2012R2 Server I use to develop and test the LDAP authentication plugin. On the left side you see the familiar look of the "Active Directory Users and Computers" tool. On the right side, the same LDAP directory is browsed using the "AD Explorer" tool (that I mentioned in the other forum thread).

NOTICE: I've scaled the images down a bit so the fit in the forum, so they may look a bit blurry. If you right click on them and select "View image..." you'll get the full resolution image with more detail.

 

 

In addition to the standard AD containers (folders), I've created the "moodle" organizational unit hanging from the root of the directory tree (marked with (1) and (2) in the image). And inside it I've created several other organizational units (cursos, usuarios, estudiantes, profesores -yep, those are Spanish names-).

I could put my users inside the "Users" container (marked as (3) and (4) in the image), which is the default place for users in a newly setup Active Directory instance.

Or I could decide to create some additional container(s) (e.g., additional organizational units like "moodle", "cursos", "usuarios", etc) and put my users there. For this example, I've decided to put all my Moodle users in the "usuarios" container, inside the "moodle" container (marked (3) and (4) in the following image):

 

 

Now the question is, what do I need to use in Moodle LDAP authentication configuration as the "Context" setting in each case?

To answer that question, the easiest way is to use the "AD Explorer" tool. Launch the tool in one or your AD domain controllers, click on the "Connect" button (no need to fill any of the connections fields to connect to the controller you are running the tool on) and expand the branch named after your AD domain (DC=whatever,DC=local). There you'll find all the elements you've seen in "Active Directory Users and Computers" tool, plus a few others.

Now if you've put all your Moodle users in the "Users" container, click on that element. You should see something like the following image:

 

 

(1) Is your Moodle users container ("Users"), (2) is the Distinguished Name attribute of the object (the "path" for this particular object in your LDAP directory tree), and (3) and (4) are the value of the Distinguished Name for this object. This value is what you should use in the "Contexts" setting in Moodle. As you see in this particular case, the value starts with "CN=....".

In my case I've put all my Moodle users in "usuarios" container, inside "moodle" container. So I get something like the following image:

 

 

Again, (1) is my Moodle users container ("usuarios"), (2) is the Distinguished Name attribute and (3) and (4) are the value of the Distinguished Name for this object. As you see in my case (because I decided to put my users in a different container, that happens to be an Organizational Unit), the value starts with "OU=....".

So, to sum it up, it can be either "CN=...", or "OU=...", or even other things!!! (if you use LDAP servers that are not Active Directory).

Hope this clears it up a bit smile

Saludos.

Iñaki.

 

 

Average of ratings: Useful (1)
In reply to Iñaki Arenaza

Re: LDAP authentication, Server connection successful but can't login to moodle

by Alain Jeanson -

Muchos gracias Iñaki.

C'est le seul espagnol que je connaisse. Ton français est très bon!

Back to our story.....

I did check with Active Directory Explorer and here is the result

As you will see, my users ARE in a OU.  it's called  1- Utilisateurs. This input in the Context will not work, I had to get to the root.

Maybe, just maybe it's because there is a space in the OU name ?   I tried with "" and '' but to no avail.

It works fine with the root. All this is for newbies and helping others smile


Merci encore Iñaki.

Attachment moodle.png
In reply to Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

by Iñaki Arenaza -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

Salut Alain!

I have just renamed my "moodle" OU to "1 -Utilisateurs" (just like the OU name shown in your screen shot), and it still works as expected. I'm using Moodle 3.3.3+ (Build: 20171208), PHP 7.0.19-1, Postgresql 9.4, running on Debian Linux Stretch.

Could it be that your OU is actually named:

OU=1 -Utilisateurs,DC=...

and that you are using

OU=1- Utilisateurs,DC=...

in your "Contexts" setting? Notice that according to your "AD Explorer" screenshot, the space is between the '1' and the '-' characters. But when you referred to your OU in the message I'm responding to, you wrote the space between the '-' and the 'U' characters. Just a shot in the dark...

P.S. Mon français n'est pas si bon. Il fait déjà beaucoup de temps que je parle pas le français (plus de 20 ans), et j'ai complètement perdu ma maîtrise sad

Saludos.

Iñaki.

In reply to Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

by Dave Perry -
Picture of Testers

For reference, we are using the OU approach on our installation: OU=Accounts,DC=ourdomain,DC=local is what we put in the Context (with search sub-contexts ticked).

(I'm not based in IT, so not sure why it's named differently to the default of Users)