By betolley on

I was unable to get the ldap working with the latest version of drupal. I have been creating my own. I have ldap working and the ability to return if a user exists and verify the password. The problem I have is how do I create a user in drupal in PHP? I looked at several other modules and the code looks like below:

$user = user_save('', array('name' => "$name$at$server", 'pass' => $pass, 'mail' => $mail, 'init' => $mail, 'status' => 1, "authname_$module" => "$name$at$server", 'roles' => array(_user_authenticated_id()), 'ldap_authentified' => TRUE));
      watchdog('user', t('New external user: %user using module %module.', array('%user' => theme('placeholder', $name .'@'. $server), '%module' => theme('placeholder', $module))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));

i don't under stand it. I have $user, $password. If the bind is successfull I have $name with the $user name in it. Any help would be appreciated.

Comments

betolley’s picture

betolley commented

I got it worked out. I can authenticate and add the user if they are not already in the DB but how do I send the authenticated user into drupal?

betolley’s picture

betolley commented

I can now login with my login.module . AD Windows 2k3 server. 4 Child domains and 1 root domain all can login. WOOT!

keschrich’s picture

keschrich commented

I'm trying to set up Drupal to hook in with AD on a W2k3 server as well, but havn't had much luck with it (and quite honestly I don't know a whole heck of a lot about LDAP or AD).

Any chance you could post up a quick howto describing how you did it?

Thanks!

ajmorris’s picture

ajmorris commented

I am also trying to get Drupal to auth to AD. It's installed on a RedHat FC1 server. Does the server need to be in AD? Do I need to turn on anonymous logon for LDAP in AD? I am not sure what to do next.
PLLLLLLLLLLLLEEEEEEEEEEAAAAAASSSSSSSSSSEEEEEE post a how to.

Andy

gnapse’s picture

gnapse commented

I would love to see that HOW-TO. I need it so much. Can anyone help on how to setup drupal authentication against active directory, for peopl who doesn't know a lot about LDAP?

Kieg Khan’s picture

Kieg Khan commented

Hello betolley,
Sounds like you have achieved something pretty good there. Did you ever have a chance to write a how-to? or were you just bragging about success?
Thanks.

kreaper’s picture

kreaper commented

Some tips to use ldap_integration to get AD authentication working.

1) Most AD (Active Directory) implementations do NOT allow anonymous logins. So in order to do even BIND to the LDAP directory, you will need to have a valid user account. I have created a basic account with stripped down ACLs (for e.g. CN=drupalread,OU=Service Accounts, CN=Users,dc=example,dc=com). This needs to be set in the conf.php file of ldap_integration module

2) I personally was unable to get any SSL connections going. PHP seems to have deprecated SSL and have started using TLS. I was not even able to get that.

3) In /admin/settings/ldap_integration/login_procedure, make sure to select "Active Directory" for the System Type.

4) Make sure you set the UserName attribute to "sAMAccountName"

That should get you going. (That's how I got mine going)

Kieg Khan’s picture

Kieg Khan commented

Hello,

I will give it a try and see what happens.

Thanks.

kpm’s picture

kpm commented

I have had no luck so far. I read your step number three above though, and when I browse to /admin/settings/ldap_integration/login_procedure I do not have any choice displayed to select 'Active Directory'. What I see for that section is:
"The process of authentication starts by establishing an anonymous connection to the LDAP directory and looking up for the user on it. Once this user is found, LDAP authentication is performed on them.
However, some LDAP configurations (specially common in Active Directory setups) restrict anonymous searches.
If your LDAP setup does not allow anonymous searches, or these are restricted in such a way that login names for users cannot be retrieved as a result of them, then you have to specify here a DN//password pair that will be used for these searches.
For security reasons, this pair should belong to an LDAP account with stripped down permissions."

And then their is a space to enter the DN and password for the connection user.
I have entered the full DN in this spot, I have entered domain\userName, I have entered 'userName@lanName.domain.com', and many other permutations. I know I am entering the proper values as we use the same DN to connect a Bugzilla install to our LDAP. I don't have much hair left, so if anyone can help, not only will you help me make it so our users have single sign on and we won't waste money on Sharpoint, you will also help put off any further premature balding! ;)
Thanks!

alexe’s picture

alexe commented

I'm having similar difficulties integrating AD using settings that I know work for other LDAP enable services.

When I try to authenticate Druple to AD I get errors like:

Fatal error: Call to a member function setOption() on a non-object in /var/data/drupal/modules/ldap_integration/ldapauth.module on line 662

for users who exist in both Drupal and AD

and

Fatal error: Call to undefined function ldap_connect() in /var/data/drupal/modules/ldap_integration/ldap_integration/LDAPInterface.php on line 108

for users who exist only in AD.

Any help would be greatly appreciated.

Thank you,

razzaque’s picture

razzaque commented

The errors you are getting are two separate issues:

Fatal error: Call to undefined function ldap_connect() in /var/data/drupal/modules/ldap_integration/ldap_integration/LDAPInterface.php on line 108 - this is because you don't have PHP installed with LDAP support.

Fatal error: Call to a member function setOption() on a non-object in /var/data/drupal/modules/ldap_integration/ldapauth.module on line 662 - this is because you have a user with the same login name that exists in both Drupal and AD, as you've indicated. To resolve it, look for the code around line 877 in modules/ldap_integration/ldapauth.module as follows:

       if ($local_user_count > 0 && (!isset($data['ldap_authentified']) || $data['ldap_authentified']==0)) {
        // a local user with same name exists -- authenticate that user
        // nullify global ldap resource for good measure
         $ldapauth_ldap = "";
         $user = user_authenticate($name, $pass);
       }
       else {

and delete the line $ldapauth_ldap = "";. (Thanks to alienbrain, see http://drupal.org/node/179924 .)

gstokes’s picture

gstokes commented

First of great work this will be so handy when I get it up and running.

Have setup the LDAP Module in Drupal on Win2K3, with apache and using Active directory as the LDAP server, the Authentication with the LDAP server succeeded after trying the test in the admin but can not login to the drupal site using an active directory user name and password.

Im not using TLS as it throws up major bind errors when on and the Admin Authentication test fails.

The active directory administrator has given us all the advice she can but even she seems at a loss as to what’s going wrong

Finding this quite frustrating as there seems to be a lot of differing opinions on how to go about setting it up

mlowkwai’s picture

mlowkwai commented

Hi gstokes, may i check if your problem has been solved. I have the same problem here. Any hero can help me out here. I configured drupal in XAMPP, WinXP OS.

gstokes’s picture

gstokes commented

Module works fine, a joy to use, its the LDAP details thats confusing, thanks a lot great work.

kha_206’s picture

kha_206 commented

Hi gstokes ,
can you please write down the steps to integrate AD,i am facing problem to integrate with Active directory

mymumbai’s picture

mymumbai commented

Enter below in Base DN:
dc=[Your domain name e.g. yahoo],dc=com

UserName attribute:
sAMAccountName

DN for non-anonymous search:
[Valid Active Directory User Name e.g. mymumbai@yahoo.com]

Password:
[Password of the Valid Active Directory User Name]

jpamental’s picture

jpamental commented

Just wanted to post a recent note letting people know that it was the addition of the '@domain.com' to the username that allowed me to connect successfully to an Active Directory LDAP server. Thanks!

princemanjee’s picture

princemanjee commented

I see that you post for help often, but not when you find the solution.

I imagine if you do not post when you have a solution too, less people will be wiling to help.

If you aren't willing to share your knowledge, why would we want to share with you?