Hello,

Does anyone have this module working with multiple AD/LDAPs (domains, forests), where the sAMAccountName may be the same?

For instance, imagine two AD/LDAP configurations configured, the first for DomainA and the second for DomainB, but each domain has a user "jsmith":

"jsmith"; DomainA\jsmith; jsmith@DomainA.com
"jsmith"; DomainB\jsmith; jsmith@DomainB.com

As far as I can tell the current ldapauth.module does not accept the domain or email logins.

Ultimately, one would expect:

- if no domain is supplied then it should authenticate against the default domain (1st configured, domainA, maybe),
- else use the LDAP/AD for the corresponding supplied domain.

For domain logins the portion before the forward slash could be matched against the base-dn to find the right ldap server. Similarly for email logins. If none supplied, use the default (in this case domainA).

For simplicity, I am thinking new users would need their usernames stored as the full domain\username to keep them distinct. Any existing usernames would either need to be converted or assumed under the default domain, in this case domainA. The latter choice would require watching out for ambiguity between the potential case where jsmith & domainA\jsmith both exist in the drupal database. It would also be nice to have a "domain dropdown" on the login screen to aid users; typical for a windows/ad environment

Anyone working on or interested in something like this?

Comments

Hitmrrr’s picture

Hitmrrr commented

UP!

verta’s picture

verta commented
Version: 5.x-1.3 » 6.x-1.x-dev

changed to v6, more likely to get new features there, I think.

Jean Gionet’s picture

Jean Gionet commented

does this work? or is there a workaround to make this work?
I'm on a large network with multiple Active Directories setup.
I'm only on 1 of the "DOMAINS" so I can't test to see if the others would work or not just yet.

Jean Gionet’s picture

Jean Gionet commented

I guess you can't have users from multiple domains login?

If I configure multiple servers, I'd like to maybe see a small drop-down menu show up the user can pick which one to authenticate from.
DomainA or DomainB

allanak’s picture

allanak commented

Over 2 1/2 years and nobody's figured this out yet? We're running into the exact same problem.

zeezhao’s picture

zeezhao commented

- You can configure lpdapauth for the servers to use mail as login instead of sAMAccountName. via:
admin/settings/ldap/ldapauth/edit/x - where x is the number of your server in drupal

- There is also a section "PHP to transform login name: " which can be used to manipulate login, if you choose a specific format for these situations.

Also see this thread - http://drupal.org/node/488248

jrp’s picture

jrp commented

I have. I put a drop down box on the login page with the different domains, and then added the ldap resouces with the same name as the domain and did a compare. I also got user sync working with it, which is a bigger pain. The domain gets appended to the end of the username to seperate the users (user@domain). I changed the sync part a lot because AD LDAP has a limitation on how many results can be returned on a single query, so I have it loop through every letter on the LDAP attribute SN. That way the import result will be more accurate (users won't be left out from AD restrictions). The code isn't really user-friendly because one part is hard coded, but let me know if you want the code.

jrp’s picture

jrp commented

I also had to change sync to ignore accounts that don't have email address through ldap (mail=*) and I made a patch that makes sync twice as fast http://drupal.org/node/867356.

This is important for when you have multiple domains. I have 4 and it takes over 7 minutes to import all of the users and sync their attributes with content_profile.

antgiant’s picture

antgiant commented
Status: Active » Closed (works as designed)

@jrp More info on the AD result limitation over here #1433162: LDAP Sync limited to 1,000 AD users per server. Add user warning for admins.

I am currently using multi-domain logins without any problems or modifications. (Sync on the other hand I'm up to 4 tickets on.)

How to setup Multi-Domain Logins

  1. Setup a new server for each Domain

That's it. This works because of how the LDAP Integration module processes a login. It tries the username/password combination on the first server. If that fails it tries the username/password combination on the second server. And so on until it runs out of servers.

Big Caveat

  • If the username & the password are identical on multiple domains the "earliest" domain will always be the one that is logged into.

In my case I can guarantee that the username/password combination is unique between domains so this works for me.

If you can't live with that Caveat I recommend as did @zeezhao just change the UserName attribute from sAMAccountName to mail, or use the "PHP to transform login name:" to perform your own custom logic per server.

Marking closed because there are at least three ways to solve this problem already in the module.

Jean Gionet’s picture

Jean Gionet commented

it would be nice if a drop-down menu could show up once you add multiple domains.

dungtv2026’s picture

dungtv2026 commented

Hello jrp!

I am very interested in your solution. Please share to me about your solution and source code about put a drop down box on the login page with the different domains.
Please send me detail about your solution by email.

Thanks very much!
Tran Dung
Email: trandung2026@gmail.com