Moodle in English: Merging AD NTLM SSO into auth/ldap

Hi all, Dan, Iñaki,

I'm doing a bit of work with auth/ldap on IIS in the next 2 weeks, (while also finishign up the perf stuff for 1.9) and I am thinking that what I'd want to do is merge auth/ntlm into auth/ldap so that it works "transparently" once you have setup the magic IIS thingy (or Apache's mod/ntlm) to force NTLM auth on a specific page.

The scenarios I need to support are

On LAN with AD, as self
On LAN with AD, needing to login as 'admin'
On LAN, without AD logon
From Intarwebs, needing to login, no HTTP Digest
From Intarwebs, using AD login with HTTP Digest

What I am considering doing is

Let auth plugins register a handler when login/form.php loads... auth/ldap could bounce the user off the NTLM-magic page which will auto-login if they are blessed with AD magic, or just set a session cookie indicating they aren't.
Merge all the good bits that Dan's been working on into auth/ldap
Add the relevant options to the config page, with bold blinking links to the relevant docs.moodle.org pages ...

So I am kind of interested in feedback from Dan, Iñaki and others using/patching this. We might even get it into 1.9!

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Dan Marsden - Saturday, 15 September 2007, 6:22 PM

I've now got a working patch for LDAP/AUTH to merge NTLM into LDAP....

the biggest part is an extension on the current "alternatelogin" page. - I've moved the IP address handling into an "advanced alternate login" page to allow all the AUTH modules to make use of it. - I need to tidy up the code a bit, (hacking code in Notepad on the server, I'm bound to have missed a couple of things!, let alone all those tabs and windows CR's! argh!)

When I get back into work on monday morning, I'll clean it up and make it available for everyone to have a look!

The forms still need a bit of tidying, and appropriate fields blanked out when needed etc.... probably needs conversion to use the new formslib too.

Thanks for the encouragement to get this done!

Dan

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Sunday, 16 September 2007, 6:20 AM

By the way, Eloy sent me the attached file a couple of days ago.

It implements a webserver based authentication schema as a subclass of the LDAP plugin, by using the pre-authentication hooks in a clever way.

He told me the code is 100% GPL (it was developed by some moodle partner, if I'm not mistaken).

Even if this is not exactly what MartinL needs, that could be a good start to build upon.

Saludos. Iñaki.

webserverldap_v1.1.zip

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Dan Marsden - Monday, 17 September 2007, 4:15 AM

here's my first hack at it - still needs a lot of tidy up work, but it seems to work!

not sure on the best location for the functions so in the meantime, there's a lib_altlogin.php in the Auth folder.

The ip configuration page probably needs to be converted to use formslib with appropriate hiding of fields when needed:
if altloginadv is set to "advanced" on admin/auth.php, then the field to enter an alternate login should be "frozen", and on the admin/altloginadv.php page, if altlogin_forcenormal is set to "yes" then the altlogin_loc should be frozen.

I also need to update all the text for the lang file.

One shortcoming (easily solved) with the current code is that it doesn't handle "On LAN with AD, needing to login as 'admin' " - the old code did this by having 2 login pages - an oncampus and an offcampus one, - so an admin would "bypass" the IP check by just entering the URL for the offcampus page.

I'd prefer not to have a "duplicate" login\index.php file just for this purpose, what about adding a var so that an admin can type in an address like this to bypass the IP check: http://example.com/moodle/login/index.php?ipcheck=bypass

I think there's a few other things that I was thinking about late sunday morning, but I can't remember them right now! - I'll post them if I remember!

keen to hear feedback!

Dan

LDAP_ntlm_patch.zip

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Monday, 17 September 2007, 7:28 AM

Dan.

This is great! I've read through your zipfile, but got a bit confused, as it's more of a set of files to replace, so it's abit tricky to suss out what's "new". I'll look at it in more depth later today and try to generate a diff of it.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Dan Marsden - Monday, 17 September 2007, 10:11 AM

sorry, my bad - knew you'd ask for a diff! - will post one later unless you beat me to it! (might have to be tomorrow morning, I'm just off to pick my son up from school!)

Dan

*edit* diffs attached for the files that have changed.

ldap_ntlm.zip

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Monday, 17 September 2007, 11:56 AM

Thanks! So this is the "advanced login form" handler... what if we don't need and advanced form handler...? Is that too subversive to ask?

Right now, even if I am logged in I can still go to the /login/ page and relogin with different credentials. We can take advantage of that -- the only knowledge we require from "real" admins is to type /login/ and re-login.

So we can make it work like this

When /login/index.php is loading, it calls loginpage_hook() in all enabled plugins to give them a chance to do something...
In auth/ldap, loginpage_hook() should say... if (NTLM-magic is enabled and the user IP addr matches and the user is not logged-in and no "authldapskipntlm" GET param is set) then redirect to auth/ldap/magicntlm.php
magicntlm.php checks for NTML magic, if it doesn't work, redirects to login/index.php?authldapskipntlm=1 to force a normal form display
If the NTLM magic worked, we do the ntlm autologin dance

This means we don't need any special form, just careful handling of what we have.

I'll be drafting this in the next few hs -- but bear in mind that I don't have IIS/AD to test it against!

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Tuesday, 18 September 2007, 4:30 AM

magicntlm.php checks for NTML magic, if it doesn't work, redirects to login/index.php?authldapskipntlm=1 to force a normal form display

I like the general plan, but this is where things can go wrong or at least tricky (if I'm not mistaken, Dan can be more authoritative than me in this area). In order to do the NTLM magic, you need to mark the page as 'needs authentication to access' in the web server configuration.

But once you do that, you completely loose control of the authentication process and result, until it's completely done. I mean, in the NTLM case, if you don't have the right credentials, the server refuses to serve the page. Which means our code doesn't execute. So we can't check the result of the 'NTLM magic'.

The only way I see to overcome this is by playing some tricks with the web server, like for example redirecting 401 error codes (Authentication Required) to a URL you choose, but I'm not sure this can be done easily with IIS (and have never tried with Apache; I'll try in a few minutes).

If we can jump over this hurdle, the rest of the plan seems quite sensible.

By the way, I have the feeling this would be easier if we have a PAM-like authentication schema

but bear in mind that I don't have IIS/AD to test it against!

Grab VmWare Player and I'll send you a couple gigabyte image of a W2003 machine fully setup (in fact, this is how I do all the testing).

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Tuesday, 18 September 2007, 5:03 AM

The only way I see to overcome this is by playing some tricks with the web server, like for example redirecting 401 error codes (Authentication Required) to a URL you choose, but I'm not sure this can be done easily with IIS (and have never tried with Apache; I'll try in a few minutes).

OK, it's rather easy with Apache. Just add a

ErrorDocument 401 http://the.url/you/want/to.php

inside the <Directory> </Directory> tags, and when you click on 'Cancel' on the browser authentication dialog box, you are redirected there.

I'm not an IIS expert by any means, so I haven't found how to do it. I see I can define the file I want to serve when I get a 401;2 error code (this is what I get when I cancel the authentication request), but IIS just lets me choose a plain html file on the disk (even if the text above the error list says I can type absolute URLs). If I choose a .PHP file, it just sends the file as plain text, instead of executing it.

If there is any IIS guru in the room, please stand up and show us the light

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Tuesday, 18 September 2007, 6:02 AM

in the NTLM case, if you don't have the right credentials, the server refuses to serve the page

Ouch! I never thought of that. Good catch. I just don't know what I don't know about IIS trickery and magic...

... thinks ...

Would a scheme like this work? If the user is in the appropriate IP subnet...

Redirect to ntlm_stage_1.php which will print a nice "trying to SSO" message and an img tag (1px by 1px) that points to ntlmsso_magic.php. This page waits 3 seconds and then redirects to ntml_stage_2.php
ntlmsso_magic.php is blessed with "Integrated Windows Authentication" and (if IIS lets us) sets a lightweight cookie in config_plugin and delivers a 1x1 invisible gif to the end user.
ntml_stage_2.php checks whether the cookie was set and completes the user authentication... or shows a msg saying "could not SSO with you" and redirects to the login page with the "don't try sso" parameter.

If the user does not have the NTLM credentials, the image will be denied, but the user won't see the broken image thingy on a 1x1 gif...

Hah, if we wanted to make it fancy we could display a smily face on success, and a sad face on the 403 document for it but that will require additional configuration at the IIS server, so it might be too hard for admins to setup...

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Tuesday, 18 September 2007, 8:47 AM

Based on the plan above, I've worked a bit more on this... you can see it in the 2 top patches here: http://repo.or.cz/w/moodle-pu.git?a=log;h=mdl19-authldap (click on the "commitdiff" links to see the patches)

Consider this code very draft and in need of testing by someone who actually has AD, but I think it mostly shows the right "logic flow". I've used slightly different names:

ntlmsso_attempt.php is "stage 1"
ntlmsso_magic.php serves the spacer gif under the auspices of Integrated Windows Authentication
ntlmsso_finish.php is "stage 2", it completes the process or handles the failure cases...

My main concern at the moment is the "default" session handling that happens when we call config.php (which calls lib/setup.php). Not sure if that breaks what we are trying to do here. If it does, we need to be able to set a flag that says "don't even try do do any session handling" before config.php is called.

No smily/sad face though

Edit: latest code snapshot at http://repo.or.cz/w/moodle-pu.git?a=snapshot;h=mdl19-authldap;sf=tgz

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Tuesday, 18 September 2007, 9:36 AM

Actually, using $nomoodlecookie should fix our session problems in ntlmsso_magic.php . Committed. Needs testers!

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Tuesday, 18 September 2007, 10:14 PM

Just a couple of comments before actually testing the code:

Right now we are not using the sesskey() in the 'ntlm session cookie' key at all. Is this the intended behaviour or did you just forget about it? (I suspect the former, due to the comment in ntlmsso_magic(). I'd vote +1 for using the sesskey too, just in case the users are behind a proxy (yes, there are proxies that let NTLM authentication get through ).
In ntlmsso_magic(), I'd use moodle_strtolower() instead of strtolower() with the username. We can have non-ascii characters in usernames (we have quite a bit of them in-house), and I'm not really sure strtolower() does the right thing.
IMHO, hardcoding the time window for the process in ntlmsso_finish() is not very good idea . Either define a constant at the top of the file (so one can find it easily) or provide a configuration value so the admin can tune it (+1 for this). This should help debug time-dependent login problems

Other than that, a not-so-deep inspection of the code looks good to me. I'll put it in my test box and see how it goes

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Wednesday, 19 September 2007, 6:06 AM

It's a bit late here (and have to wake up early tomorrow), but just a quick note to say that I have it 'working'. With several quick and dirty (very dirty) hacks (tested only with IIS, but I'd say the problems are not dependent on the web server type).

There are a couple of tricky issues that we'll need to discuss to see what's the cleanest/least-intrusive way of doing it, but I'll leave it for tomorrow, as I want to explain them in detail.

In addition to that, I have a patch fixing several errors in the current git code, that I'm attaching here. This doesn't make the whole thing work, but at least allows the code to execute

Saludos. Iñaki.

mdl19_authldap_sso_1.diff

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Wednesday, 19 September 2007, 6:23 AM

And at MartinL's request, here is a bigger patch (with the very dirty things I mention in my other post). Just to be used as inspiration to a real solution

Saludos. Iñaki.

mdl19_authldap_sso_dirty_hack.diff

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Wednesday, 19 September 2007, 7:26 AM

Great patches, notes and feedback! Gracias!

Based on those 2 patches and the IRC chat, I've pushed out 4 patches:

* your small "fixes" patch
* a patch that redirects only for GET requests (which means that we don't have to add the skipsso flag in the form, ever)
* a refactor of login/index.php (inspired by your dirty hack)
* an improved ntlmsso_finish()

Maybe Dan can help me test/debug while Iñaki sleeps?

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Wednesday, 19 September 2007, 10:53 PM

After playing with the new set of patches, here are my results so far:

On LAN with AD, as self

Tested, working as expected. Both with IE 7.0 and FF 2.0.0.x (both from Windows and from Linux). With FF you get an authentication popup dialog (unless you set 'network.automatic-ntlm-auth.trusted-uris'), but once you fill it things just hum along

By the way, I've tested both with IIS 6.0 and Apache 2.2.4 (from XAMPP lite 1.6.2), running on W2003 (with neither SP1 nor SR2), running in W2003 Domain Functional Level, in a single domain configuration (not that that should make a difference, but just to make sure anyone can replicate the tests wink

On LAN with AD, needing to login as 'admin'

Tested, working as expected. You can do it both using the 'skipntlm_sso=1' parameter to login.php, or by going to the login page once you are authenticated by the NTLM magic.

On LAN, without AD logon

I guess you say 'without AD credentials automatically sent by the browser'. In this case, I just click 'Cancel' in Firefox's auth popup dialog (IE sends them by default), and after the redirection period I land on the login page with the 'skipntlm_sso' parameter, where I can login normally.

From Intarwebs, needing to login, no HTTP Digest
From Intarwebs, using AD login with HTTP Digest

I haven't tested any of these scenarios, as I don't understand what they really mean surprise

. What's 'Intarwebs' and what kind of HTTP Digest configuration are you talking about?

In a related question, if we are using 'AD login' (I assume you mean Integrated Windows Authentication, aka NTLM), what does it mean AD login with HTTP Digest? As far as I know, they are independent, and the browser and the server negotiate using one or the other (but not both), depending on you server settings.

Which in the case of IIS, it means you use NTLM instead of HTTP Digest, in case the client supports it (or more precisely, is configured to negotiate it for that site/URL). I'm not really sure what Apache does in this respect (I have never used more than one authentication schema for the same resource), but I suspect we'll get a similar behaviour (one of the schemas being preferred over the other).

Anyway, even if we use HTTP Digest authentication instead of NTLM, as long as the user authenticates correctly, the code should behave exactly the same under both schemas. As far as Moodle is concerned, the user is already authenticated by the web server and we get the credentials from exactly the same place ($_SERVER['REMOTE_USER']). So from Moodle's point of view, everything stays the same.

There is one missing point in the latest patches that I'd like to address: using the remote IP address as the temporary NTLM session key. As I've said before, there are proxies that can handle NTLM (MS-Proxy/ISA Server, for example), so using $_SERVER['REMOTE_ADDR'] as the key could break havoc in this scenario. I propose to use sesskey() as the NTLM session key (unless there are any gotchas that I don't know about).

I'd like Dan to test it all in a wider environment before blessing the code, but apart from the missing language strings, and a few more things that should be 'translatable' (they are hardcoded in English right now), I'd say we could push the code as is (plus the proposed sesskey() change big grin

).

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Thursday, 20 September 2007, 3:05 AM

I'd say we could push the code as is (plus the proposed sesskey() change).

I've been thinking a little bit on the way back home (driving 35 Kms through mountain roads gives me plenty of time to do it ), and there is a least one thing the current code misses.

Right now, if someone logs in via NTLM magic, we don't check if that user is inside the contexts specified in the LDAP settings. I mean, if I want to restrict my Moodle site to those users inside a given OU or subtree of my LDAP directory, with the current code any valid user in my whole AD domain (and if we are using a GC as the LDAP server, the whole forest) can log in. We should check that the user is inside one of the configured contexts before allowing his/her to log in.

Something along the lines of the attached patch could do it.

Saludos. Iñaki.

ntlmsso_check_valid_user.diff

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Thursday, 20 September 2007, 5:55 AM

We should check that the user is inside one of the configured contexts before allowing his/her to log in.

Something along the lines of the attached patch could do it.

Great stuff! Will merge it in.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Thursday, 20 September 2007, 2:26 PM

Some new patches on the branch - including your patch, and some cleanup. Needs a fresh round of testing, I'd say

And some strings!

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 21 September 2007, 5:39 AM

It's been quite a busy day here today (incidentally, fixing and polishing some Moodle code we expect to release in a few weeks), so I haven't had a chance to test it until now.

And I have to say that commit 16ff165e93510401f05b0094ecd43df1d48ed373 breaks the NTLM sso login. I get this PHP notice:

Undefined variable: sesskey in C:\Inetpub\wwwroot\moodle-pu\auth\ldap\auth.php on line 1842

which prevents the login from finishing. When I said we should use the sesskey() value as the 'cookie' key, I just wanted so say that we should replace:

$key = $_SERVER['REMOTE_ADDR'];

with

$key = sesskey();

but otherwise leave the 'cookie' value untouched. We need to store $sesskey in the 'cookie' to be able to check it later inside ntlmsso_finish().

In addition to that, I forgot to put the textlib conversion call before the block of code that uses $extusername, so it completely breaks the user validation process. My bad

As I can't attach multiple files to this post, I'm sending a .tar.gz file with both patches, so we can have a nice/clean patch history.

With these patches in place, things start to work again. I'll give it a more thorough testing in the following hours though.

Btw, I can confirm that session deletion is performed as expected once we log in (but I still need to check that cron does its things too). [Edit: Yep, cron wipes the sessions without trouble ]

Saludos. Iñaki.

patches-20070921.tgz

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 21 September 2007, 5:45 AM

The 'user inside configured contexts' check is working all right. Even if I login as a valid NTLM user, I'm not SSO loged in, but redirected to the normal login page

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Friday, 21 September 2007, 6:46 AM

Great! Only odd thing is that...

leave the 'cookie' value untouched. We need to store $sesskey in the 'cookie' to be able to check it later inside ntlmsso_finish()

I don't understand this. We don't need the sesskey twice in config_plugins. It is

In $SESSION
In config_plugins in the 'name' field
Passed around as the fake password during logon - during logon we match the key from $SESSION with config_plugins and with $password...

Why another copy? What am I missing?

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 21 September 2007, 7:00 AM

Why another copy? What am I missing?

Probably nothing. Now that you talk about it, if get_config() is able to retrive the 'cookie', then the sessky must be good. So there is no need to check the value inside the cookie: the cookie name is already the key.

Feel free to drop that patch, but fix ntlmsso_finish() not to use $sesskey any more (as the variable was not defined at all after you applied 16ff165e93510401f05b0094ecd43df1d48ed373).

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 21 September 2007, 6:31 AM

And here is a little patch with the last remaining non-traslated strings (unless I missed something).

Saludos. Iñaki.

03_i18n.diff

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Thursday, 20 September 2007, 5:55 AM

Great! I'll be busy fixing upgrade issues in HEAD this morning, and back on this ASAP.

When I talk about people connecting from the internet, meaning not-on-the-LAN, what I understand is that IIS may be configured to implement IWA as HTTP Digest "challenges" to the browser. In that case...

IWA HTTP Digest may be disabled,
The user may be preauthenticated because they've visited another page prviously in the same domain that required an HTTP Digest
If they are not pre-authenticated they'll see the webbrowser popup the form as you mention. I think it's nice that it'll do against a backdrop of the html page saying "trying to sso".

I propose to use sesskey() as the NTLM session key

Agreed, and also use constants for the delays and other niceties.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 21 September 2007, 6:06 AM

When I talk about people connecting from the internet, meaning not-on-the-LAN, what I understand is that IIS may be configured to implement IWA as HTTP Digest "challenges" to the browser.

The problem is, we don't try any sort of IWA/HTTP-Digest authentication unless the client is coming from the specified subnets. Thus, connecting from the internet gives you the good old login page.

So in addition to the client IP, we need to take something else into account to decide when the user should be authenticated by the web server (either by IWA or HTTP-Digest, that's up to the web server configuration).

I just don't know what that 'something else' could be right now.

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Friday, 21 September 2007, 6:53 AM

The problem is, we don't try any sort of IWA/HTTP-Digest authentication unless the client is coming from the specified subnets.

Yes - that's what I was thinking too. And there's no way to "detect" it without triggering a challenge (or is there? can you "soft-require" IWA?)

Maybe we can offer a link to the user from the Login page: "Click here if you are logged in to our interwebs Portal already"...

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Thursday, 27 March 2008, 4:17 AM

a patch that redirects only for GET requests (which means that we don't have to add the skipsso flag in the form, ever)

Well, it seems the login page gets POSTed from other places, for example when we use notice_yesno() to ask for a full user account login (see http://moodle.org/mod/forum/discuss.php?d=93390).

So we need to check that the redirects are for GET requests, or POST requests coming from other pages (but not self).

In addition to that, we were not storing the referer in $SESSION->wantsurl if there was one, so we never returned to the right place in those cases.

I've opened a bug in the tracker (MDL-14071) and attached a patch there for review before commiting it to CVS.

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Friday, 28 March 2008, 10:06 AM

What are those 'other' places? If it's just the login block... well, it's not designed to play well with this - (maybe it should be subnet-aware?)

What other place POSTs to login/index?

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 28 March 2008, 10:59 AM

At least these ones:

mod/chat/view.php:58
mod/choice/view.php:136
mod/forum/markposts.php:37
mod/forum/post.php:62
mod/forum/settracking.php:35
mod/forum/subscribe.php:57
mod/quiz/view.php:142

All of them use notice_yesno() with the URL of the login page for the 'Yes' answer. And notice_yesno() uses POST forms for the Yes/No buttons. So we end up POSTing to login/index.php from all those places.

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Monday, 17 September 2007, 12:41 PM

Dan,

I've just read auth/ntlm/auth.php, diffing it against auth/ldap/auth.php, and I am hoping that this can be quite simple... I can only see that the plugin name has changed (this affects lots of lines) and there are a couple extra config options. Other than that, I can only see auth/ldap/auth.php having some small changes that seem to be bugfixes/enhancements. So to my eyes, all we need is a couple of additional config options...?

I also found "address_in_subnet()" in moodlelib, which means we can use that instead of bringing in isIPIn(). Also - address_in_subnet() lets you define the subnets in a single comma-delimited string, which simplifies the config form and code.

So between this and the trick I posted separately to avoid a duplicate login form, I think we can get away with

New config value - ntlm_sso_enabled
New config value - ntlm_sso_subnets
New method loginpage_hook()
New method attempt_ntlm_sso() that checks $_SERVER[REMOTE_USER] and does the required magic...
New page auth/ldap/attempt_ntlm_sso.php that calls the method with the same name, and if it fails, issues a redirect with the "don't try again" parameter.

What do you think?...

Another thing I've been mulling about is that the requirement to use DB-sessions bothers me a bit. We can get around it trivially using some very lightweight session handling using short-lived temporary entries in config_plugins. It would go like this:

auth/ldap/attempt_ntlm_sso.php should make sure it does not touch the session data at all. Maybe a session_write_close() really early or something like that. Instead, it should redirect (on success) to a "finish_ntlm_sso.php"
attempt_ntlm_sso(), if it succeeds, should set an entry in config/plugins. We can use "auth/ldap/ntlmsess" for the plugin name, a random session id (or the sesskey for the user) plus the IP addr as the "key". The value is whatever data we get from AD - apparently just $server_user.
finish_ntlm_sso.php should call finish_ntlm_sso() which completes the user setup and clears the entry from config/plugins. This page should refuse to run if it looks like it's running with the NTLM magic (if $_SERVER[REMOTE_USER] is set, for example), as that will cause session troubles...

So we'd end up with a very small patch with just 2 new settings, DB sessions no longer required, and the unavoidable need to set a single PHP file to have NTLM "Integrated Windows Authentication".

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Monday, 17 September 2007, 1:58 PM

Hi Dan,

I have some draft work-in-progress code that shows the concept a bit better. I've pushed it to http://repo.or.cz/w/moodle-pu.git?a=shortlog;h=mdl19-authldap , click on the "commitdiff" links on the right of my 2 commits.

The code right now doesn't do a thing. It's still missing the actual NTLM smarts you added to it -- I think those go split up between ntlmsso_attempt() and ntlmsso_finish() -- , and 2 files. Off home now so I'll get back on this tomorrow morning...

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Tuesday, 18 September 2007, 2:30 AM

I've been really busy today (grading exams and attending a couple of meetings), but I'll have a look at your proposal and Dan's one tomorrow, and try to provide some feedback.

saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Monday, 17 September 2007, 11:35 AM

I have a git repo in http://repo.or.cz/ called "moodle-pu" for previewing "proposed updates" (hence the -pu suffix). I've created a new branch called mdl19-authldap, and I'm going to start "drafting" a few commits there. Then if we like them we can merge them into HEAD -- and if we miss the merge window for 1.9 we can rebase them for later.

To get a checkout, you'll need a recent version of git (1.5.x), and then do

  git clone git://repo.or.cz/moodle-pu.git
  git branch mdl19-authldap origin/mdl19-authldap
  git checkout mdl19-authldap

And start hacking away A good web-view if the branch is visible at http://repo.or.cz/w/moodle-pu.git

As things progress, there will be updates on the repo and you'll want to "pull" down so you can work with the latest code. The incantation is

  git pull origin

For commit access, self-register in http://repo.or.cz/ , upload your SSH keys, and ping me so I can "join" you to the project (I'll pass on the "project password" to any core dev interested). And then go to your working copy and edit .git/config , replacing git://repo.or.cz/moodle-pu.git with git+ssh://@repo.or.cz/srv/git/moodle-pu.git

Once that's done, you can push your changes with

  git push origin mdl19-authldap

Note! This is an experimental playground, a drafting space. I find it incredibly useful, but that is IMHO. I will share my draft changes here, noone else has to unless they want...

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Dan Marsden - Tuesday, 18 September 2007, 9:41 AM

Brain but fuzzy, - and busy day so hopefully I understand this... (haven't looked at your patch yet - will do tomorrow sometime...)

Iñaki is right NTLM completely hijacks the browser - the error code redirects will "almost" work, except users with Firefox/IE that have NTLM turned on or "available" for all sites, will get a nice ugly pop-up authentication dialog asking for authentication which will most likely fail 3 times before being directed to an "error" page (unless they fluke it and enter a correct combination of domain\usercode with the right slash and the right domain, and the right password, in which case, they'll only get one pop-up before the "error" occurs)

so - the IP check stuff is vital to make it work - unless you want to educate your off-site users how to deal with NTLM dialogues and your domain.... (not a nice "fun" thing to do!) - we had years of issues with this in our old in-house system where we just relied on NTLM - you won't believe the amount of work that our support centre had to deal with due to off-site use of NTLM!

I'm not worried where the IP check stuff is located - I presumed it would be better to write a "globally" available optional extension to the altlogin stuff than keep it in the ldap stuff.

you're right - the diff between LDAP/NTLM is mainly around changing the name of the plugin - there's not really anything fancy in there. - the core part is the IP redirection.

Dan

*edit* don't think I answered Iñaki's redirect question....
it's relatively easy to add a redirect based on an error page (especially as the admin has to go to the same screen to enable NTLM for the actual page) - but it doesn't "stop" the stupid pop-up dialogues.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Friday, 21 September 2007, 7:33 AM

Cool - pushed out a few patches to moodle-pu with the latest stuff. Fixed the uninitialised $session in ntlmsso_finish() while keeping only one copy of the session around (sorry about that!) and applied all of Iñaki's fixes.

What's left to do?

testing!
strings!
figure out if we can do something smart with http digest
...?
profit!

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 21 September 2007, 4:06 PM

I will give it a try as soon as possible and give you some feedback here

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Saturday, 22 September 2007, 8:32 AM

I've just re-tested it, and it keeps working as expected.

Now to think a little bit about the HTTP digest issue...

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Saturday, 22 September 2007, 11:18 AM

Great! I'll make some noise about landing this in HEAD

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Lea Anthony - Friday, 19 October 2007, 10:37 PM

Hi all,

We've got a central LDAP server acting as our main authentication server. I got NTLM authentication working with DansGuardian using winbind. Will this module allow me to do the same thing for moodle? I'd really like for those who have accounts in this LDAP directory to go straight in to the front page.

Many Thanks,

-Lea.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 19 October 2007, 11:09 PM

Yes, as long as that LDAP directory is Microsoft Active Directory (and the Moodle site is configured accordingly).

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Lea Anthony - Saturday, 20 October 2007, 12:33 AM

Ah ok. Is there a plugin to do this with a standard LDAP server (not AD)?

Thanks,

-Lea.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Monday, 12 November 2007, 2:28 PM

Hey - I'm merging this in the next 24hs into 19 and HEAD. In a bout of irresponsibility I've taken http://tracker.moodle.org/browse/MDL-9399 over refer to the process.

In preparation, I've rebased the code on top of 19_STABLE - you can see (and test it!) at http://repo.or.cz/w/moodle-pu.git?a=shortlog;h=mdl19-authldap-3

We still need someone to write a nice howto. Luckily, it's much much simpler now...

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Thursday, 15 November 2007, 8:48 AM

In HEAD and MOODLE_19_STABLE now... testers?

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 16 November 2007, 12:09 AM

I'll give it a go over the weekend and report anything back in the tracker

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Saturday, 17 November 2007, 11:15 PM

Woops! It didn't work! But fear not, I've sent patches to the tracker to fix it

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Monday, 19 November 2007, 12:35 PM

Reviewed, merged. Great! v1.9, here we come!

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Tuesday, 20 November 2007, 6:47 AM

I have even (partly) updated Moodle Docs to reflect the differences between pre-19 and post-19 installation and system configuration.

I still have to write how to configure the subnets and so on, which has changed in the new (post-1.9) version, but that should be fairly trivial.

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Rod Ward - Tuesday, 27 November 2007, 11:10 PM

Guys,

I've installed Moodle 1.9 (downloaded today 27th November) and I've configured the LDAP authentication as per your updated documentation in the wiki.

However, it doesn't appear to be working as expected. I get a message saying "Attempting single-sign-on via NTLM" and then it changes to "Auto-login failed, try the normal login page..." and takes me to:
login/index.php?authldap_skipntlmsso=1

However, the odd part is that the message in the top right corner of screen claims that I'm actually logged in! How can that be?

Another thing I notice is that the new LDAP authentication only allows you to specify one IP subnet when you set NTLM SSO to Yes. Yet the old NTLM allowed us to specify 8 or more subnets, which is what I need to do. If I don't put in an IP subnet of some description, the LDAP SSO doesn't work at all. So how do I cater for all the different IP subnets in my organisation with this new LDAP SSO?

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Rod Ward - Tuesday, 27 November 2007, 11:21 PM

Iñaki,

Yes please tell us how to configure these subnets in the new 1.9 Moodle.

My organisation has at least 13 different subnets and I need to set up SSO so that all of them are catered for.

Can the new AD NTML SSO magic do this?

Rod

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Thursday, 29 November 2007, 5:48 PM

Can the new AD NTML SSO magic do this?

Sure it can

The new way of specifiying subnets is even easier/more flexible than before. Just type them one after the other, separated by commas. You can use several syntaxes:

Type the network-number/prefix-length combination. E.g. 192.168.1.0/24
Type the network 'prefix', ending in a period character. E.g. 192.168.1.
Type the network address range (this only works for the last address octect). E.g. 192.168.1.1-254

All the three examples refer to the same subnetwork. So assuming you need to specify the following subnetworks:

10.1.0/255.255.0.0
10.2.0.0/255.255.0.0
172.16.0.0/255.255.0.0
192.168.100.0/255.255.255.240

You can type:

10.1.0.0/16, 10.2.0.0/16, 172.16.0.0/16, 192.168.100.0/28

or:

10.1.0.0/16, 10.2.0.0/16, 172.16.0.0/16, 192.168.100.240-255

or even:

10.1., 10.2., 172.16., 192.168.100.0/28

(the last one cannot be expressed as a network 'prefix' as the netmask doesn't fall in an octect boundary).

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Janne Mikkonen - Thursday, 29 November 2007, 6:38 PM

Question for all off you whos working with this: Would you be willing to consider adding mod_auth_kerb support in this?
Basically you just need to identify that if kerberos headers are present and small changes to cleaning $_SERVER['REMOTE_USER'] which in this case is <username>@<realm>.

Or is this already done???

- Janne -

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 30 November 2007, 7:33 AM

What are the specific kerberos headers we should identify? Which scenarios use Kerberos as the SSO protocol? How are the credentials asked/presented? I mean, what does the web server have to do to start the SSO negotiation?

I've never used kerberos myself, so all I know is from security text books

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Thursday, 27 March 2008, 7:10 PM

I hacked an old version of auth/ntlm to work with kerberos on a linux setup we were testing - mod_auth_kerb is so much more reliable than mod_auth_ntlm. (And mod_auth_sspi is a winner on Windows for ntlm, I digress)

Essentially the only difference is the final format of the domain/realm and username i.e. <user@realm> or <user@domain> rather than <domain\user>

Perhaps there could simply be a config switch to choose between NTLM and Kerberos, or even look for '@'s in REMOTE_USER which I believe would be reliable enough?

However if one must rely on HTTP headers I believe that the following is used:
"WWW-Authenticate: Negotiate"
As opposed to NTLM's "WWW-Authenticate: NTLM"

Hope that's of some use

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Rod Ward - Thursday, 29 November 2007, 7:07 PM

OK. Thanks for this.

I did not realise this was the way the new LDAP SSO worked since there was only one field for inputting the IP addresses. Perhaps we could add a link to a Moodledoc to this field with your explanation?

I must say that I find IP addresses and subnet masks a bit confusing. I'll have to study up on them.

Regards,

Rod

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 30 November 2007, 7:37 AM

Perhaps we could add a link to a Moodledoc to this field with your explanation?

This thread is referenced from MoodleDocs, from the NTLM authentication page, so anyone should be able to find the explanation.

Anyway, I intended to write it at the MoodleDoc page itself, but feel free to copy & paste it if you like

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Chad Outten - Monday, 11 February 2008, 10:12 AM

Firstly, thanks guys for your great work on this!

I've followed the moodle docs instructions for ntlm auth. all seems ok with SSO, but just wanted to confirm with you if users should be required to click the 'Login' link on site page (see attached) to trigger SSO via NTLM? is there something obvious that i've overlooked in moodle admin settings or is this actually how the new auth works?

with a previous version of NTLM plugin, AD users were automatically authenticated on the moodle site page (without having to click the 'Login' link).

moodle 1.9 IE 7 win2k3 IIS6 mysql 5.0.45 php 5.2.0

Cheers, Chad

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Dan Marsden - Monday, 11 February 2008, 12:44 PM

you need to set your moodle install to forcelogin

under admin > security > site polices

tick the box!

Dan

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Chad Outten - Tuesday, 12 February 2008, 7:17 AM

thanks all sorted! big grin

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Thursday, 27 March 2008, 7:30 PM

The old module had the concept of On Campus and Off Campus subnets, i.e. white AND blacklists for NTLM authentication.

This was perfect for us as we have only one subnet we wish to not be NTLM'd (you guessed it, the Apple Mac subnet ;) )

Is this no longer possible?

Cheers

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Martín Langhoff - Friday, 28 March 2008, 10:00 AM

The 1.9 implementation definitely has a subnet setting to differentiate on-campus and off-campus. Check the config page for the plugin

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Friday, 28 March 2008, 8:42 PM

Thanks for your reply
I mean the new integration with the ldap module (it makes sense to me to ditch the custom auth plugin and move to the new ldap built-in version)

All I see is:

NTLM SSO
Enable: Yes/No
Subnet: ........

I can't see anyway of telling it that the subnet is actually off-campus rather than on-campus.
Am I missing something?
Cheers

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 28 March 2008, 9:13 PM

Am I missing something?

No you aren't. You can only use white lists with the current code. But adding black lists should be trivial.

I'll have a look at it and post a patch.

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Friday, 28 March 2008, 9:36 PM

Perfect, thanks for your quick reply

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Saturday, 29 March 2008, 5:27 AM

Here is the patch against a clean 1.9 system (current as of today). There is a new field to specify the subnet blacklist.

Saludos Iñaki.

ntlm-subnet-blacklist.diff

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Monday, 31 March 2008, 4:28 PM

Excellent, will try and get this installed today
Many thanks

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Monday, 31 March 2008, 11:27 PM

If a network is not on the blacklist, must it still be on the whitelist to be accepted for SSO?
Ideally anything not on the blacklist should be accepted and anything on the whitelist should be accepted.

I must do some more extensive testing in our dev environment.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Tuesday, 1 April 2008, 12:03 AM

The usual logic when you have both white and black lists is:

* don't do SSO if in the black list.
* do SSO if in the white list.
* dont' do SSO if not in either list.

So to answer your question: yes, it still has to be in the whitelist to be accepted for SSO. If we'd follow your line of reasoning, just having a blacklist would be enough (as the other combinations are all the same: do SSO).

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Tuesday, 1 April 2008, 4:56 PM

Hmm, thought...

Would it be possible to whitelist everything (would '0.0.0.0' work to match everything?)

And then blacklist the non SSO subnets individually?

Seems like this should replicate the functionality of the ntlm module.
Please let me know what you think
Cheers

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by voodoo voodoo - Tuesday, 1 April 2008, 5:56 PM

Hello,
Sorry to double post here, but I am stucked with my brand new installation (1.9)
Original post is here:
http://moodle.org/mod/forum/discuss.php?d=93426

If someone running a original 1.9 working with AD and NTLM could post his configuration that would be great!!
Thanks

VooDoo

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Tuesday, 1 April 2008, 8:32 PM

> Would it be possible to whitelist everything (would '0.0.0.0' work to match everything?)

I'd say it would, as long as you write it as 0.0.0.0/0. Otherwise 0.0.0.0 is interpreted as a specific IP address (i.e., 0.0.0.0/32) instead of a network address.

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Tuesday, 1 April 2008, 9:31 PM

Excellent, I think that should solve our problems I'll give it a try
Thanks for your help on this

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Michael Harrison - Friday, 4 April 2008, 2:07 AM

Hi all,

Can't wait to get this working.

I have followed all the documentation for setting this up on an IIS 6 website using MS Active Directory.

I have turned off Anonymous Access and activated Integrated Authentication on the ntlmsso_magic.php file, but I am getting a windows box appear asking for username and password.

If I enter the password, the SSO works, but If i don't i get an 401.2 message

Unauthorized: Access is denied due to server configuration.
Internet Information Services (IIS).

What am I missing out!!

Thanks in advance for any help with this.

Harri

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Sunday, 6 April 2008, 7:34 AM

Are you sure the Moodle server is part of the 'trusted zone' or the 'intranet zone' in your browser security settings? Otherwise, I think IE doesn't send the user credentials to the server.

Saludos. Iñaki.

Average of ratings: Useful (1)

Re: Merging AD NTLM SSO into auth/ldap

by Michael Harrison - Friday, 11 April 2008, 6:51 PM

Thank you very much that was indeed the solution!!! Don't know why I missed that out!

Excellent!!!!

Thanks

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Monday, 15 June 2009, 9:38 PM

0.0.0.0/0 doesn't work for some reason, does anyone have any thoughts on enabling sso for ALL addresses?

Also does anyone know what the deal is with NTLM SSO fast path? With the old NTLM module this seemed to happen in all browsers...

Cheers

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Tuesday, 16 June 2009, 7:15 AM

0.0.0.0/0 doesn't work for some reason, does anyone have any thoughts on enabling sso for ALL addresses?

Do you still have the black list patch applied? If so, that could be the reason 0.0.0.0/0 doesn't work (i.e., you are blacklisting some subnets).

If you haven't then 0.0.0.0/0 should work, as far as I know (judging from what the code does). Hummmm, after a lot of tests I've found that PHP integer arithmetic plays on us when using a mask of 0. So we need to modify address_in_subnet() in lib/moodlelib.php to deal with that case. Look for the piece of code that reads:

if ($mask === '' || $mask > 32) { $mask = 32; } $mask = 0xffffffff << (32 - $mask); $found = ((ip2long($addr) & $mask) == (ip2long($ip) & $mask));

and modify it to read:

if ($mask === '' || $mask > 32) { $mask = 32; } // When $mask is zero, PHP's integer arithmetic gives us a mask // of 255.255.255.255 instead of 0.0.0.0, so special case it if ($mask != 0) { $mask = 0xffffffff << (32 - $mask); } $found = ((ip2long($addr) & $mask) == (ip2long($ip) & $mask));

That should do the trick.

Also does anyone know what the deal is with NTLM SSO fast path? With the old NTLM module this seemed to happen in all browsers...

The fast path checks that the client browser is IE and skips the 'Trying NTLM SSO...' screen and a couple of waits of about 3 seconds each, jumping to the NTLM challenge page, making the login faster. For non-IE browsers, it doesn't try the NTLM challenge at all and sends the client directly to the plain login screen, again avoiding the 2 x 3 seconds delay and a nasty authentication popup.

The drawback is that clients using IE but not having domain logon credentials don't see the 'NTLM SSO trying...' so they don't know what's going on when they are asked for the user credentials in the browser authentication popup.

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Friday, 19 June 2009, 2:55 AM

Thanks for your reply i'll try that version of address_in_subnet. I was trying to fix the binary arithmetic and got extremely confused, i didn't think to just test to see if the subnet was 0!

This now fixes MDL-19509

On a side note, you may be interested to know that this module works great with mod_auth_kerb with a slight modification:

http://docs.moodle.org/en/NTLM_authentication#Using_the_Kerberos_Auth_Module_for_Apache_on_Linux.2FUNIX_.28mod_auth_kerb.29

So 'NTLM' sso magic is really more generic sso magic as long as the web server does the authentication on ntlmsso_magic.php in a sensible way.

P.S. I submitted this as a possible improvement MDL-19509

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Friday, 19 June 2009, 4:17 AM

You mean MDL-19510, don't you?

Saludos. Iñaki.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Alastair Hole - Friday, 19 June 2009, 4:32 AM

That I do, well spotted.
Copy & paste fail!

Cheers

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Lei Zhang - Friday, 12 September 2008, 7:51 AM

Hi Martín, Dan, Iñaki,

I'm trying to merging AD NTLM SSO into auth/ldap under Apache/2.2.9 (Win32) PHP/5.2.6 mod_auth_sspi/1.0.4 with Moodle 1.9.2

Start page will always redirect me to login/index.php?authldap_skipntlmsso=1 after warning "Auto-login failed, try the normal login page...". If I try to put the credential in login page, it works.

I have changed the auth type from ntlm to ldap in mdl_config table, as well as changed auth field to ldap in mdl_user for my testing users.

Any ideas?

Thanks.

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Daniel Müller - Friday, 24 October 2008, 6:57 PM

Hi,

i have the same problem with linux (Debian/testing) and Apache2 (2.2.9) +php 5.2.6-5, Samba (3.2.3), winbind (3.2.3), kerberos5 heimdal (1.6.4) and Moodle 1.9.2 (Build 20081001)

The LDAP connection is working with a Win 2k3 AD but the SSO part not. i followed these instructions
http://docs.moodle.org/en/NTLM_authentication#Installation_on_1.9
http://adldap.sourceforge.net/wiki/doku.php?id=seamless_authentication#mod_auth_ntlm_winbind

wbinfo -t and wbinfo -u and wbinfo -g are working correct in the console

i tried to find a information in some log file, but didn't find a bit.

some hint would be great

thanks

Average of ratings: -

Re: Merging AD NTLM SSO into auth/ldap

by Iñaki Arenaza - Monday, 15 December 2008, 7:57 AM

Hi Daniel,

sorry to be so late, but I've been distracted by other issues. The only thing I can think of is that Apache can't read the winbind pipe and thus can't authenticate the client.

Did you run the 'adduser www-data winbindd_priv' command and then stopped and started the Apache daemon? Do you see any errors in winbindd's log files (under /var/log/samba/log.winbindd)?

Saludos. Iñaki.

Average of ratings: -

Merging AD NTLM SSO into auth/ldap

NTLM SSOEnable: Yes/NoSubnet: ........

NTLM SSO
Enable: Yes/No
Subnet: ........