<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Certainly a blast from the past for me.<div>I spent a year in the U.K. working in Preston and living in Longridge.</div><div>More than a few nights hiked down to the White Bull on Preston Road.</div><div>And I just walked it again now with Google streetview.</div><div>Time for a pint of Bombardier!</div><div><br><br><div><div id="SkyDrivePlaceholder"></div><hr id="stopSpelling">From: lbrophy@myerscough.ac.uk<br>To: xerte@lists.nottingham.ac.uk<br>Date: Tue, 7 May 2013 17:49:33 +0000<br>Subject: [Xerte] Xerte LDAP behaviour (Mis-behaviour!)<br><br>
<style><!--
.ExternalClass p.ecxMsoNormal, .ExternalClass li.ecxMsoNormal, .ExternalClass div.ecxMsoNormal {
font-size:11.0pt;
font-family:"Calibri","sans-serif";
}
.ExternalClass a:link, .ExternalClass span.ecxMsoHyperlink {
color:blue;
text-decoration:underline;
}
.ExternalClass span.ecxMsoHyperlinkFollowed {
color:purple;
text-decoration:underline;
}
.ExternalClass span.ecxEmailStyle17 {
font-family:"Calibri","sans-serif";
color:windowtext;
}
.ExternalClass .ecxMsoChpDefault {
font-family:"Calibri","sans-serif";
}
.ExternalClass div.ecxWordSection1 {
}
--></style>
<div class="ecxWordSection1">
<p class="ecxMsoNormal">Hello all,</p>
<p class="ecxMsoNormal"> </p>
<p class="ecxMsoNormal"> Apologies if this has been brought up before (I certainly couldn’t find it in the archives), but I thought it may be useful to share a simple solution I have come across for those using LDAP authentication in Xerte, specifically
V2.0 in my case but applicable for other versions I suspect. For those who want to skip to the solution (in red below) this fix will allow you to authenticate with AD by specifying the root DN as opposed to a specific OU.</p>
<p class="ecxMsoNormal"> </p>
<p class="ecxMsoNormal"> We are running Xerte 2.0 under XAMPP in Windows 2008 and I have spent days trying to resolve the issue of authenticating against multiple OU’s within AD. Setting up authentication for a single OU worked a treat from the
off, however adding a second “base_dn” to search just would not behave as I thought it should as any users contained within the secondary OU simply couldn’t log in (failed at the last stage with error "Issue connecting to ldap server (#4) : No entries found
"). </p>
<p class="ecxMsoNormal"> </p>
<p class="ecxMsoNormal"> I tried various configurations and edited the database manually, which got me a little further than using the $$$ delimiters in the management interface. I also tried a little code hacking to output the parameters being
pulled from the database by the PHP code and all seemed fine, but still no joy, so I took the plunge and decided to read the LDAP section of the PHP manual!
</p>
<p class="ecxMsoNormal"> </p>
<p class="ecxMsoNormal"> Within about 10 minutes of searching through the PHP manual I came across the following page;</p>
<p class="ecxMsoNormal"> </p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><a href="http://php.net/manual/en/function.ldap-search.php" target="_blank">http://php.net/manual/en/function.ldap-search.php</a>
</p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"> </p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;">If you search the above page for “ldap referrals” you should find a post relating to these ldap referrals, which are what prevent successful AD searches from the root DN of the domain, you will also find the code
to turn these off.</p>
<p class="ecxMsoNormal"> </p>
<p class="ecxMsoNormal"><span style="color:red;">HERE’S THE SOLUTION! </span></p>
<p class="ecxMsoNormal"><span style="color:red;"> </span></p>
<p class="ecxMsoNormal"><span style="color:red;"> For me personally the fix was as follows;</span></p>
<p class="ecxMsoNormal"><span style="color:red;"> </span></p>
<p class="ecxMsoNormal"><span style="color:red;"> Set up ldap through the xerte management page (should be pretty straight forward) or edit the ldap table in phpMyAdmin by following the “ldap” document in “%installdir%\xertetoolkits_2.0\documentation\”</span></p>
<p class="ecxMsoNormal"><span style="color:red;"> </span></p>
<p class="ecxMsoNormal"><span style="color:red;"> For “base_dn” specify your AD root DN e.g. “DN=MyDomain,DN=com”</span></p>
<p class="ecxMsoNormal"><span style="color:red;"> </span></p>
<p class="ecxMsoNormal"><span style="color:red;"> Next you need to edit the “Ldap.php” file contained within “%installdir%\xertetoolkits_2.0\library\Xerte\Authentication\” and add the following line
</span></p>
<p class="ecxMsoNormal"><span style="color:red;"> </span></p>
<p class="ecxMsoNormal"><span style="color:red;"> </span>
<span style="font-size:10.0pt;font-family:Consolas;color:black;background:#F0F0F0;">ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);</span></p>
<p class="ecxMsoNormal"><span style="font-size:10.0pt;font-family:Consolas;color:black;background:#F0F0F0;"> </span></p>
<p class="ecxMsoNormal"><span style="font-size:10.0pt;font-family:Consolas;color:black;background:#F0F0F0;">
</span><span style="color:red;background:#F0F0F0;">I have added it near to the top of the file, but within the php tags so mine looks like this;</span></p>
<p class="ecxMsoNormal"><span style="color:red;background:#F0F0F0;"> </span></p>
<p class="ecxMsoNormal"><span style="color:red;background:#F0F0F0;">
</span><span style="background:#F0F0F0;"><?php</span></p>
<p class="ecxMsoNormal"><span style="background:#F0F0F0;"> </span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">/**</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">* For this to work, you'll need to have at least one entry in the XOT 'ldap' table. Example values (which work for me) are below :</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">*
</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;"> * ldap_host = localhost</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">* ldap_port = 389</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">* ldap_username = cn=admin,dc=blah,dc=com</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">* ldap_password = <plain text password which you can connect to ldap with></span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">* ldap_basedn = ou=xot,dc=blah,dc=com -- this is where in the LDAP tree your XOT stuff lives.
</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;"> * ldap_filter = cn - field we try to do a match for the end user's username on.</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">* ldap_filter_attr = uid
</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;"> *
</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;"> *
</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;"> */</span></p>
<p class="ecxMsoNormal"><span style="background:#F0F0F0;"> </span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);</span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;"> </span></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><span style="background:#F0F0F0;">etc…</span></p>
<p class="ecxMsoNormal"><span style="background:#F0F0F0;"> </span></p>
<p class="ecxMsoNormal"><span style="background:#F0F0F0;"> <span style="color:red;">
Other than this the file stays the same. I am now able to authenticate using LDAP for a user regardless of their account location in AD and there is no need for multiple entries in the LDAP table.
</span></span></p>
<p class="ecxMsoNormal"><span style="color:red;background:#F0F0F0;"> </span></p>
<p class="ecxMsoNormal"><span style="background:#F0F0F0;">Hopefully this will be of use to somebody, I know it has caused me somewhat of a headache!
</span></p>
<p class="ecxMsoNormal"><span style="background:#F0F0F0;">Apologies for the essay!</span></p>
<p class="ecxMsoNormal"><span style="background:#F0F0F0;"> </span></p>
<p class="ecxMsoNormal"><span style="background:#F0F0F0;">Regards<br>
Lee</span></p>
<p class="ecxMsoNormal"> </p>
<p class="ecxMsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#002060;">Lee Brophy</span><span style=""></span></p>
<p class="ecxMsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#002060;">Network Technician</span><span style=""></span></p>
<p class="ecxMsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#002060;"> </span><span style=""></span></p>
<p class="ecxMsoNormal"><span style="font-size:14.0pt;font-family:"Garamond","serif";color:#006633;">Myerscough College</span><span style=""></span></p>
<p class="ecxMsoNormal"><span style="font-family:"Arial","sans-serif";color:#002060;">Bilsborrow, Preston, Lancashire, PR3 0RY</span><span style=""></span></p>
<p class="ecxMsoNormal"><span style="font-family:"Arial","sans-serif";color:#002060;">Tel: 01995 642134 Fax: 01995 642333</span><span style=""></span></p>
<p class="ecxMsoNormal"><span style="font-family:"Arial","sans-serif";color:#002060;">Web:</span><span style="font-family:"Arial","sans-serif";color:#0070C0;">
</span><span style="font-family:"Arial","sans-serif";color:#1F497D;"><a href="http://www.myerscough.ac.uk" target="_blank"><span style="color:#1F497D;">www.myerscough.ac.uk</span></a>
</span><span style=""></span></p>
<p class="ecxMsoNormal" style=""><b><span style="font-size:8.0pt;font-family:Webdings;color:green;">P</span></b><b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black;">
</span></b><b><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:green;">please consider the environment before printing this e-mail</span></b><span style=""></span></p>
<p class="ecxMsoNormal"> </p>
</div>
<br><br>
<br>
<br>_______________________________________________
Xerte mailing list
Xerte@lists.nottingham.ac.uk
http://lists.nottingham.ac.uk/mailman/listinfo/xerte</div></div> </div></body>
</html>