1 Topic by [HellR]

  • Registered: 2009-03-31
  • Posts: 8

Topic: [Extension] LDAP Authentication

README :

LDAP Authentication - Add LDAP auth and groups sync to FluxBB.

Copyright (C) 2009 Benoît Lelevé - www.hellr.org


Installation instructions :

  1. Unzip this package into your FluxBB extensions directory,

  2. If you are using PostgreSQL, copy the corrected pgsql.php file to the dblayer direcroty,

  3. Install ldap_auth from the Extensions menu in the admin panel and enjoy!

You should apply the Apache directive AllowOverride FileInfo to the FluxBB directory.


Additional informations :

  • This extension was developed for FluxBB v1.3-legacy. Be carefull, it has not been tested on others versions,

  • The LDAP configuration form is accessible through a new Authenticate submenu in the Admin Settings section,

  • The database auth is not disabled. The LDAP auth starts after the database auth failed,

  • The modification of the password or the e-mail address is not allowed in FluxBB for LDAP accounts,

  • The bind user needs to have read access on the LDAP directory and the userPassword attribute,

  • BE CAREFULL! All imported LDAP accounts will be deleted during uninstallation.

The next version of this extension will introduce multigroups and LDAP groups synchronization.


CHANGELOG :

LDAP Authentication - Add LDAP auth and groups sync to FluxBB.

Copyright (C) 2009 Benoît Lelevé - www.hellr.org


2009-05-03 : LDAP Authentication v0.5.1

  • Bug correction that prevent users from login.

 
2009-04-09 : LDAP Authentication v0.5.0

  • Some texts have been modified in English and French language files,

  • The email is updated during the logon process of LDAP accounts,

  • The email modification is not allowed for LDAP accounts.


2009-03-31 : LDAP Authentication v0.4.0

  • First public release.


DOWNLOAD :

Last edited by [HellR] (2009-05-04 09:02:02)

My FluxBB Extensions

2 Reply by Franz

  • Franz
  • aka lie2815 (Developer)
  • Offline
  • Registered: 2008-05-13
  • Posts: 1,731

Re: [Extension] LDAP Authentication

Looks very nice.

http://www.fluxbb.de - Deutschsprachiges FluxBB-Supportforum

Franz's Website

3 Reply by [HellR]

  • Registered: 2009-03-31
  • Posts: 8

Re: [Extension] LDAP Authentication

Thanks wink

I hope I will have enought time to start the next version...

My FluxBB Extensions

4 Reply by [HellR]

  • Registered: 2009-03-31
  • Posts: 8

Re: [Extension] LDAP Authentication

Little update to v0.5.

I am also working on a multigroups extension which will be release with the next ldap_auth version.

My FluxBB Extensions

5 Reply by [HellR]

  • Registered: 2009-03-31
  • Posts: 8

Re: [Extension] LDAP Authentication

v0.5.1 released with major bug correction.

EDIT : This extension works with v1.3-legacy.

Last edited by [HellR] (2009-05-04 08:55:53)

My FluxBB Extensions

6 Reply by Amelotti

  • Registered: 2008-10-28
  • Posts: 31

Re: [Extension] LDAP Authentication

When trying to Logout:

"Parse error: syntax error, unexpected T_STRING, expecting T_OLD_FUNCTION or T_FUNCTION or T_VAR or '}' in /home/www/.../extensions/ldap_auth/includes/class_ldapconn.php on line 11"

7 Reply by [HellR]

  • Registered: 2009-03-31
  • Posts: 8

Re: [Extension] LDAP Authentication

I think you are still in PHP4 ? No ?

PHP5 is required... Sorry I didn't write it anywhere!

Last edited by [HellR] (2009-05-26 14:47:25)

My FluxBB Extensions

8 Reply by OJM

  • OJM
  • Member
  • Offline
  • Registered: 2009-07-29
  • Posts: 7

Re: [Extension] LDAP Authentication

Just what I was after!

However, having troubles getting it to bind.

Could you advise on what settings need to be entered into:

LDAP Accounts Context
LDAP Groups Context

Cheers!

Oli

9 Reply by [HellR]

  • Registered: 2009-03-31
  • Posts: 8

Re: [Extension] LDAP Authentication

You have to enter the base distinguished name where users and groups are located, for exemple ou=accounts,dc=exemple,dc=com and ou=groups,dc=exemple,dc=com.

A few words about the next version and my new extension MultiGroups, they will be released in 2 or 3 months... I am so so busy sad

Last edited by [HellR] (2009-07-29 09:46:25)

My FluxBB Extensions

10 Reply by anilj

  • Registered: 2009-09-19
  • Posts: 2

Re: [Extension] LDAP Authentication

I am using PunBB now but require LDAP support so I am planning the move to FluxBB. How does this extension work? What I can make out of the above thread is that all the users and groups are copied (synced) into the FluxBB database. It copies the user plus the password information.

Which type of passwords are supported? (My LDAP server uses SSHA).

Also this note: "BE CAREFULL! All imported LDAP accounts will be deleted during uninstallation.". Is it talking about deleting the accounts from the SQL database? (and not the LDAP server). Just wanted to get clarification. What's the reasoning for deleting the user information, during install, this might be a good thing to leave things as they were.

If the server is acting like some kind of a syncer, at what interval does it do the sync?

OR is this a sync only when the user logs in, and then that user's account is synced up? If so, why does the extension need userPassword access? I would prefer to not give out read access to the userPassword attribute to the Forum.

Last edited by anilj (2009-09-19 14:12:37)

11 Reply by [HellR]

  • Registered: 2009-03-31
  • Posts: 8

Re: [Extension] LDAP Authentication

Hi anilj,

This extension only sync users into the FluxBB SQL Database. The groups sync will be done in the next version which will be released simultaneous with my MultiGroups extension... But I have about 40 hooks to debug and 10 to finalize and too much work since 6 months sad

All LDAP password hash algorithms are supported because it calls the bind function. Once you are logged, your LDAP password hash, and not your clear password, is copied into the FluxBB SQL Database because this hash is needed for the cookie creation. But this is something I would like to modify in the next version, I have to think about it.

LDAP imported accounts are deleted from the FluxBB SQL Database because FluxBB uses a SSHA algorithm and the LDAP hash password stored could be of any type, so those accounts can't work without an LDAP connexion. But maybe I should put this as an option during the uninstallation.

Last edited by [HellR] (2009-09-20 09:47:55)

My FluxBB Extensions

12 Reply by anilj

  • Registered: 2009-09-19
  • Posts: 2

Re: [Extension] LDAP Authentication

Most directory servers generally now support different hash formats, the one I use is SSHA. So, if it is SSHA based, it shouldn't delete it? Also, why use the password hash in the cookie? Does it just need a unique cookie, so why not the DN of the user?

So, from what you say, when a user logs in, the userPassword value (hashed) is then stored in the FluxBB DB. That seems very wrong. Just some feedback here, I don't know of any other application that does this. Directory servers generally have password policy (too many login failures etc...) features which protect the users in the directory server. If FluxBB then takes these passwords and stores them elsewhere, it bypasses all the security settings that one can have in the directory server. If I also change the password, then the hash does not match, so you would have to re-sync the data. All of this seems like a lot of overhead.

Why not just have it so FluxBB just authenticates against the directory server, like almost all other LDAP clients do?

LDAP is after all a standards based *centralized* authentication database. Of course, all this is nicely said and done, but I bet maybe the reason this has to be implemented this way is because FluxBB/PunBB architecture doesn't make this easy.

13 Reply by Smartys

  • Registered: 2008-04-27
  • Posts: 2,663

Re: [Extension] LDAP Authentication

anilj wrote:

LDAP is after all a standards based *centralized* authentication database. Of course, all this is nicely said and done, but I bet maybe the reason this has to be implemented this way is because FluxBB/PunBB architecture doesn't make this easy.

To be fair, it's probably because it's easier to do things that way, not because FluxBB/PunBB makes it easier. wink
A password is required for FluxBB's cookie to work, it's true. However, there's nothing preventing an extension from creating a new column, say, ldap_account, and assigning random passwords for accounts with ldap_account set to 1. Then, if the extension is uninstalled, users could request a new password and log in using it.

Smartys's Website

14 Reply by [HellR]

  • Registered: 2009-03-31
  • Posts: 8

Re: [Extension] LDAP Authentication

anilj wrote:

Why not just have it so FluxBB just authenticates against the directory server, like almost all other LDAP clients do?

Passwords hashes are only stored in the DB for FluxBB's cookies and are sync each time a user login. The authentication is done throught the centralized LDAP server.

Smartys wrote:

there's nothing preventing an extension from creating a new column, say, ldap_account, and assigning random passwords for accounts with ldap_account set to 1. Then, if the extension is uninstalled, users could request a new password and log in using it.

This is a good option. I didn't have enough time to analyse the FluxBB's mechanics so I did something fast, but as I said I have to change the way my extension works.

Last edited by [HellR] (2009-10-02 08:23:27)

My FluxBB Extensions