Thursday 20 May 2004 4:25:50 am

Hi,

I couldn't get ldap to work by using an ldap.ini.append.php file. I had to edit the main ldap.ini file in settings:

#?ini charset="iso-8859-1"?
# eZ publish configuration file for connection to LDAP server
#

[LDAPSettings]
# Set to true if use LDAP server
LDAPEnabled=true
# LDAP host
LDAPServer=--our server ip address --
# Port nr for LDAP, default is 389
LDAPPort=389
# Specifies the base DN for the directory
LDAPBaseDn=ou--staff,dc--campus,dc--muc,dc--prv
# Could be sub, one, base.
LDAPSearchScope=sub
# Use the equla sign to replace "=" when specify LDAPBaseDn or LDAPSearchFilters
LDAPEqualSign=--
# Add extra search requirment. Uncomment it if you don't need it.
# Example LDAPSearchFilters[]=objectClass--inetOrgPerson
LDAPSearchFilters[]
# LDAP attribute for login. Normally, uid
LDAPLoginAttribute=cn
# Could be id or name
LDAPUserGroupType=ldap_group
# Default place to store LDAP users. Could be content object id or group name for LDAP user group,
# depends on LDAPUserGroupType.
LDAPUserGroup=ldap_group
# LDAP attribute type for user group. Could be name or id
LDAPUserGroupAttributeType=ldap_group
# LDAP attribute for user group. For example, employeetype. If specified, LDAP users
# will be saved under the same group as in LDAP server.
LDAPUserGroupAttribute=employeetype
# LDAP attribute for First name. Normally, givenname
LDAPFirstNameAttribute=givenname
# LDAP attribute for Last name. Normally, sn
LDAPLastNameAttribute=sn
# LDAP attribute for email. Normally, mail
LDAPEmailAttribute=mail
# extra info from older ldap project page on ez.no
# Username for authentication against LDAP
# LDAPUserUsername=username
# Password for the authentication against LDAP
# LDAPLoginPassword=password

Then I had to add sections of code to kernel/classes/datatypes/ezuser/ezldapuser.php to get it to work with the particular setup of our ldap server.

For example at about line 210 I added the following:

if ( $ds )
{
//ken edit 2 lines
$login2= $login. "@campus.muc.prv";
$r = ldap_bind( $ds, $login2, $password );

Which appends @campus.muc.prv to the login which for some reason is the way that exchange seems to want logins to be formatted.

At around 249 I added the following because we have different "ou="s in our exchange setup and you seem to need to declare the correct ou= for ldap_search to find the person.

//ken edit
$sr = ldap_search( $ds, "ou=staff,dc=campus,dc=muc,dc=prv", "cn=$login" ) ;
$info = ldap_get_entries( $ds, $sr ) ;
if ($info["count"] == 0)
{
// Staff Failed Trying Student

$sr = ldap_search( $ds, "ou=students,dc=campus,dc=muc,dc=prv", "cn=$login" ) ;
$info = ldap_get_entries( $ds, $sr ) ;
}
if ($info["count"] == 0)
{
// Staff and Student Failed Trying Faculty
$faculty_ou = array("fl", "ROTC", "SO", "TH", "ar", "BA", "bi", "CH", "CO", "CSIS", "ed", "FL", "eh", "gy",
"HI", "MU", "ma", "pe", "ph", "ps", "py", "re", );
for ($i = 0; $i <= count($faculty_ou); $i++)
{
$sr = ldap_search( $ds, "ou=$faculty_ou[$i],ou=faculty,dc=campus,dc=muc,dc=prv", "cn=$login" ) ;
$info = ldap_get_entries( $ds, $sr ) ;
// Was Faculty Successful if so stop the loop.

if ($info["count"] != 0)
{
break;
}
}

}
// end ken edit

I hope this helps or at least doesn't make it even more confusing.

Thanks,
Ken Colwell

Wednesday 16 February 2005 1:24:07 am

Hi

Try this

LDAPUserGroupType=id <---- define it as ID

LDAPUserGroup=xx <---- enter NodeID of your users group

LDAPUserGroupAttributeType=id <----- define it as ID

LDAPUserGroupAttribute=xx <----- enter ID of your user class

That should work.

Sinisa

---
If at first you don't succeed, look in the trash for the instructions.