LDAP authentication, Server connection successful but can't login to moodle

LDAP authentication, Server connection successful but can't login to moodle

av Maddy N -
Antall svar: 15

I'm trying to setup a LDAP authentication to MS AD in Moodle. My database in active directory has more than 2K users and i'm trying pull same users into Moodle db.

Moodle version 3.3.2+, php 7.1.11, Windows server 2012 R2

I've filled host, bind user name (DN), bind user password, context etc everything in the LDAP server settings under site administrator. When I test settings it displays LDAP server connection was successful.

But when I use the same bind user name and password and try to login to the moodle. I gives invalid login error.

What am I missing? Is it necessary to add users to moodle database first (by sync or manual add) before trying to login using LDAP users?

The bind user name in LDAP settings is in the format : cn=elearn,dc=xxx,dc=xxx

And while logging into Moodle user using the same user, I tried username as elearn, xxx.xxx\elearn, xxx\elearn, elearn@xxx.xxx etc but cant get through!

Can some pls guide me.

Gjennomsnittlig vurdering: -
Som svar til Maddy N

Re: LDAP authentication, Server connection successful but can't login to moodle

av Emma Richardson -
Bilde av Documentation writers Bilde av Particularly helpful Moodlers Bilde av Plugin developers

So is the bind user in the OU that you are referencing for users?

Did you use samaccountname for the user attribute?  

If you answered yes to both questions, are you using the samaccountname for the bind user when trying to log in?

Does the user already have an account in moodle under a different authentication method but with the same username?

Som svar til Emma Richardson

Re: LDAP authentication, Server connection successful but can't login to moodle

av Maddy N -

1. Yes, The OU im referring is dc=xxx,dc=xxx i.e at the domain top level and all the users and also bind user (elearn) are under same OU (And this bind user is a domain user not domain admin, hope i.e. fine).

2.Yes, I used ldap.exe the support tool and saw that the attribute against bind user name is sAMAccountname. So I have filled samaccountname under user attribute.

3.Yes, and its elearn.

4.No. The moodle as of now only has one account i.e admin account created upon moodle installation. (username is admin)

Som svar til Maddy N

Re: LDAP authentication, Server connection successful but can't login to moodle

av Leon Stringer -
Bilde av Core developers Bilde av Particularly helpful Moodlers

To answer the question "Is it necessary to add users to moodle database first": no it isn't. If the user doesn't already exist in the Moodle database it will be created on first login if successfully authenticated by AD.

The bind user does not have to be a domain admin.

Some things to check:

  1. Have you got Search subcontexts set to "yes"? This may be the problem if the elearn user isn't in the top of the context specified in Contexts.
  2. Is User type set to MS ActiveDirectory?
  3. Is the LDAP server plugin actually enabled under Site administrationPluginsAuthenticationManage authentication? (You can configure and test LDAP without having actually enabled this).
Som svar til Maddy N

Re: LDAP authentication, Server connection successful but can't login to moodle

av Alain Jeanson -

Hello Maddy N

I have the exact same problem.

Did you ever find a solution ?

Thanks in advance.

Som svar til Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

av Emma Richardson -
Bilde av Documentation writers Bilde av Particularly helpful Moodlers Bilde av Plugin developers

Please post a screenshot of settings?  What is the error message?

Som svar til Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

av Maddy N -

Hey Alain,

If you have set everything properly under LDAP server settings under site administrator. And when you test settings it displays LDAP server connection was successful, like was in my case all you have to do is restart the webserver (apache/iis). That should do it.

Som svar til Maddy N

Re: LDAP authentication, Server connection successful but can't login to moodle

av Alain Jeanson -

Thanks Maddy,


Actually, the problem originates at the CONTEXT used.

In the Moodle documentation :  https://docs.moodle.org/34/en/LDAP_authentication, it cleary states that :

9. All of your Moodle users are in an organizational unit (OU) called moodleusers, which is right under your LDAP root. That OU has a DN of ou=moodleusers,dc=my,dc=organization,dc=domain

This is where it went wrong.

As mentionned by this post:

Re: LDAP - Windows - No sync and no login

You do not specify an OU, but a CN.

Personnally, instead of trying to get specific users in an OU (or CN), I simply went direct to the root (DC=domain, DC=local) and used the Search Subcontext option. I have way more users then I need, but at least its working.

I hope this helps someone, and that the docs get a bit clearer about it.

Thanks again


Som svar til Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

av Emma Richardson -
Bilde av Documentation writers Bilde av Particularly helpful Moodlers Bilde av Plugin developers

The docs are a wiki so feel free to see if you can make it clearer.  However, the docs are presuming that you have created an OU specifically for your moodle users and, as such, the context would be correct.  You used the users group already in your domain which apparently is structured slightly different in MSAD.

Gjennomsnittlig vurdering:Useful (1)
Som svar til Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

av Iñaki Arenaza -
Bilde av Core developers Bilde av Documentation writers Bilde av Particularly helpful Moodlers Bilde av Peer reviewers Bilde av Plugin developers

Hi Alain,

I've added a couple of sentences stating that the LDAP settings used in the documentation are only examples of an hypothetical setup, And that one should adjust the example settings to reflect their own environment.

Would that be clear enough?

Saludos.

Iñaki.

Som svar til Iñaki Arenaza

Re: LDAP authentication, Server connection successful but can't login to moodle

av Alain Jeanson -

Hello Iñaki,

Thanks for your kind responses. You have been a great help.

Actually. Does adding an OU works or not ?

As mentionned before, my users ARE in a OU, lets call it Utilisateurs (yes I am french smiler)

So, OU=Utilisateurs,DC=Domain,DC=Local should work, right  or should it be CN=Utilisateurs,DC=Domain,DC=Local ?

For me to make it work, I simply entered C=Domain,DC=Local, with the Search Subcontext at ON.


According to the documentation, OU=Utilisateurs should work. You mentionned CN. Which one is best/ok/suggested ?

Thanks again!

Alain


Som svar til Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

av Iñaki Arenaza -
Bilde av Core developers Bilde av Documentation writers Bilde av Particularly helpful Moodlers Bilde av Peer reviewers Bilde av Plugin developers

Hi Alain,

Je dirais que, comme presque tout dans la vie, ça dépend smiler Now, seriously, it completely depends on your LDAP directory structure and how you manage your LDAP users. If you look at the following image, you can see theLDAP directory structure of the Windows 2012R2 Server I use to develop and test the LDAP authentication plugin. On the left side you see the familiar look of the "Active Directory Users and Computers" tool. On the right side, the same LDAP directory is browsed using the "AD Explorer" tool (that I mentioned in the other forum thread).

NOTICE: I've scaled the images down a bit so the fit in the forum, so they may look a bit blurry. If you right click on them and select "View image..." you'll get the full resolution image with more detail.

 

 

In addition to the standard AD containers (folders), I've created the "moodle" organizational unit hanging from the root of the directory tree (marked with (1) and (2) in the image). And inside it I've created several other organizational units (cursos, usuarios, estudiantes, profesores -yep, those are Spanish names-).

I could put my users inside the "Users" container (marked as (3) and (4) in the image), which is the default place for users in a newly setup Active Directory instance.

Or I could decide to create some additional container(s) (e.g., additional organizational units like "moodle", "cursos", "usuarios", etc) and put my users there. For this example, I've decided to put all my Moodle users in the "usuarios" container, inside the "moodle" container (marked (3) and (4) in the following image):

 

 

Now the question is, what do I need to use in Moodle LDAP authentication configuration as the "Context" setting in each case?

To answer that question, the easiest way is to use the "AD Explorer" tool. Launch the tool in one or your AD domain controllers, click on the "Connect" button (no need to fill any of the connections fields to connect to the controller you are running the tool on) and expand the branch named after your AD domain (DC=whatever,DC=local). There you'll find all the elements you've seen in "Active Directory Users and Computers" tool, plus a few others.

Now if you've put all your Moodle users in the "Users" container, click on that element. You should see something like the following image:

 

 

(1) Is your Moodle users container ("Users"), (2) is the Distinguished Name attribute of the object (the "path" for this particular object in your LDAP directory tree), and (3) and (4) are the value of the Distinguished Name for this object. This value is what you should use in the "Contexts" setting in Moodle. As you see in this particular case, the value starts with "CN=....".

In my case I've put all my Moodle users in "usuarios" container, inside "moodle" container. So I get something like the following image:

 

 

Again, (1) is my Moodle users container ("usuarios"), (2) is the Distinguished Name attribute and (3) and (4) are the value of the Distinguished Name for this object. As you see in my case (because I decided to put my users in a different container, that happens to be an Organizational Unit), the value starts with "OU=....".

So, to sum it up, it can be either "CN=...", or "OU=...", or even other things!!! (if you use LDAP servers that are not Active Directory).

Hope this clears it up a bit smiler

Saludos.

Iñaki.

 

 

Gjennomsnittlig vurdering:Useful (1)
Som svar til Iñaki Arenaza

Re: LDAP authentication, Server connection successful but can't login to moodle

av Alain Jeanson -

Muchos gracias Iñaki.

C'est le seul espagnol que je connaisse. Ton français est très bon!

Back to our story.....

I did check with Active Directory Explorer and here is the result

As you will see, my users ARE in a OU.  it's called  1- Utilisateurs. This input in the Context will not work, I had to get to the root.

Maybe, just maybe it's because there is a space in the OU name ?   I tried with "" and '' but to no avail.

It works fine with the root. All this is for newbies and helping others smiler


Merci encore Iñaki.

Vedlegg moodle.png
Som svar til Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

av Iñaki Arenaza -
Bilde av Core developers Bilde av Documentation writers Bilde av Particularly helpful Moodlers Bilde av Peer reviewers Bilde av Plugin developers

Salut Alain!

I have just renamed my "moodle" OU to "1 -Utilisateurs" (just like the OU name shown in your screen shot), and it still works as expected. I'm using Moodle 3.3.3+ (Build: 20171208), PHP 7.0.19-1, Postgresql 9.4, running on Debian Linux Stretch.

Could it be that your OU is actually named:

OU=1 -Utilisateurs,DC=...

and that you are using

OU=1- Utilisateurs,DC=...

in your "Contexts" setting? Notice that according to your "AD Explorer" screenshot, the space is between the '1' and the '-' characters. But when you referred to your OU in the message I'm responding to, you wrote the space between the '-' and the 'U' characters. Just a shot in the dark...

P.S. Mon français n'est pas si bon. Il fait déjà beaucoup de temps que je parle pas le français (plus de 20 ans), et j'ai complètement perdu ma maîtrise trist

Saludos.

Iñaki.

Som svar til Alain Jeanson

Re: LDAP authentication, Server connection successful but can't login to moodle

av Dave Perry -
Bilde av Testers

For reference, we are using the OU approach on our installation: OU=Accounts,DC=ourdomain,DC=local is what we put in the Context (with search sub-contexts ticked).

(I'm not based in IT, so not sure why it's named differently to the default of Users)