2

I'm hoping someone here can help me out. Joomla's LDAP plugin is driving me crazy. I'm trying to get Joomla to authenticate against my AD server but have been having no luck. I've been searching all around the web and can't really find any info. I have enabled the plugin, installed php7.0-ldap on my ubuntu server, and it's still failing to bind to LDAP. Here is my config:

  1. Host: AD IP
  2. Port: 389
  3. LDAP V3: No
  4. Negotiate TLS: No
  5. Follow Referrals: No
  6. Authorization Method: Bind and Search
  7. Base DN: DC=domainname,DC=local
  8. Search String: uid=[search],OU=SBSUsers,OU=Users,OU=Hospice User's
  9. DN: uid=[username]
  10. Connect Username: domain\user
  11. Connect Password: Password
  12. Map Full Name: fullName
  13. Map Email: mail
  14. Map User ID: sAMAccountName

I'm just not sure what else I could do. Any suggestions? Please and Thank you!

2
  • 1
    What you need is to see what error you're hitting. 1. have you successfully bound with straight php ldap connect and bind? 2. Is your LDAP server really LDAP2? Isn't that from a million years ago? 3. I suggest you don't use the minimal Joomla LDAP plugin - use JMapMyLdap instead [shmanic.com/tools/jmapmyldap] even though it requires more setup it comes with a bunch of cool features like debugging binds, mapping ad security groups to joomla usergroups etc. Commented Mar 28, 2017 at 7:57
  • Hey there! Thank you for responding and I was finally able to figure it out. Turns out my configuration was slightly off. The following config is what fixed it: LDAP V3: Yes, Search String: sAMAccountName=[search], Connect Username: [email protected] I did come across JMapMyLdap but I saw that it's last update was from 2015. I'm a bit worried using extensions which don't provide frequent updates. But from what I could tell, that extension would work wonders as it allows for LDAP grouping which is what I need as well. Commented Mar 28, 2017 at 12:09

1 Answer 1

1

I searched for a while online trying to find the proper settings to get LDAP authentication to work with the built in plugin but couldn't find anything that worked and was up to date. I wanted to post what settings worked for me. I used a PHP debugger to figure out what was being sent and what I needed to change. Here is what I found worked for me.

Host: The ip address or fully qualified domain name. IE. 10.0.0.250 or mydc01.corp.example.com (DO NOT INCLUDE ldap:// or ldaps:// in the value. It is added by the plugin)

Port: 636 (This assumes you have already setup your domain controller with the proper certificate to use SSL secure connections. If not, you can try port 389 but that sends data including passwords in plain text over the network so for security sake, it is better to get the secure 636 working)

LDAP V3: Yes Connection Security: SSL/TLS (This would be set to none if using port 389)

Ignore Certificate: Yes Follow Referrals: No Authorisation Method: Bind and Search (You can use Bind Directly As User if you don't have a separate account to do queries setup)

Base DN: DC=corp,DC=example,DC=com (This will obviously need to be changed to what your domain settings are. You can use Active Directory Users and Computers with Advanced Features checked under the view menu to find this info. Right click on your domain name, click properties and then click the Attribute Editor tab. Scroll down to Distinguished Name and that is the value you need.

Search String: mail=[search] (We use email addresses to log in so we use the mail attribute. You can use just the account name by using "sAMAccountName=[search]")

(The following connect username and password is only needed if you use Bind and Search as the method. Connect Username: [email protected] Connect Password: some secret password you set

Map: Full Name: displayName Map: Email: mail Map: User ID: mail (This value becomes the Login Name (Username) in the Joomla Account Details. Since we use email we set it to "mail". If you wanted just the account name you would set this to "sAMAccountName". If you wanted to have a user id as the login, you would use the uid or uidNumber attribute depending which one contains that info in your ldap.

I hope this helps someone to save time setting this up.

Not the answer you're looking for? Browse other questions tagged or ask your own question.