How do I set up LDAP Authetication on phpBB 3.0.5?

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

I keep getting an error saying that the user account to authenticate is invalid.

My user account is called 2701. It's in the "Users" folder on AD.

We only have the basic containers, no sub groups or organization units... none of that stuff.

Is that the one you're using for the LDAP User DN?

If so, you'd use this value:

CN=2701,CN=Users,DC=domain,DC=com

Chris

ASKER

Still says:

"Binding to LDAP server failed with specified user/password."

I know for a fact my username and password are correct. What could I be doing wrong?

This is before it presents a logon screen? Or during logon?

The 2701 value above, that's what you see in AD Users and Computers (in the main view, not in the accounts properties)?

Chris

ASKER

Yes, 2701 is my user ID. Same login I use across our Windows Network.

And no, phpBB is not prompting me to log in. The second I click Submit to try and save the settings you gave me it immediately gives me that error.

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Ok, I get it.

Now we're making progress, but now am getting a new error:

"Could not connect to LDAP server."

All of my settings are correct. I changed my CN to Ryan Conard, not 2701 and that got me past the first error that said "unknown user" or whatever.

Any thoughts?

Odd wonder how it managed to check the username and password without talking to the server.

What did you put in the LDAP server box? If you put a name lets change it to an IP address (for one of your DCs). That takes any potential problems in DNS out of the loop.

CHris

ASKER

Ok, I made some changes.

1) Removed the port number.
2) Removed the filter.

Now I get this error:

"Could not find a login identity for Ryan Conard."

Rather an obscure message.

I'm not very good with PHP, but it kind of looks like it's trying to find the user. Is this when you're saving the LDAP settings?

Chris

ASKER

Yes, it happens when I try to save the settings.

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Ok, did that. I created a user called "ldapauth" and set the first name to "ldapauth" as well, with no last name. So the name should be the same no matter what method it's trying to use.

I still get the same error:

"Could not find a login identity for Ryan Conard."

Even though I changed the CN thing to ldapauth.

Now I'm completely confused. You're more than welcome to see for yourself, if you'd like I can hook you up with admin access to the forums. PM me for the login info.

Hmm perhaps it's trying to match up existing users (in phpBB) to accounts in AD?

Chris

ASKER

It could be. Let me change my phpBB name from Ryan Conard to 2701, maybe then it will find me. Hold on.

ASKER

Well, seems like I just screwed myself.

I changed my admin name from Ryan Conard to 2701. Once I did that I was successfully able to save the LDAP settings. Then I logged out of everything and logged into the board using my AD username and password and it worked perfectly.

Then I went to go log back into the Admin Panel and it says I don't have access. Why... I don't know? Only thing I can think of is that my forum password and AD password are different. It will not accept the password I originally set for my admin login on the forums, only my AD password.

Using my AD password it lets me login, but only as a regular user.

I can easily reload phpBB, I'm not worried about that. But I foresee a problem in the near future every time I do this.

That's not too helpful. There must be a way around that.

Can you log in with any other account from AD? Or can you edit the phpBB database? I would imagine it's possible to give your account it's administrative rights back again with direct access to the data behind.

Chris

ASKER

Nevermind, I fixed.

I simply reset my AD password to match my phpBB password... (duh?)

Thank you all your help, Chris. I have one final question though.

The way I want the phpBB forums set up is to show a persons username as their actual name. For example, my company employee Id # is 2701. That's my Windows Network log in name, my actual name in the Active Directory is Ryan Conard.

When I sign into phpBB using 2701 and my AD password, it works fine which exactly how we want it. But phpBB is then showing my username as 2701 and NOT Ryan Conard.

How can I change this? Is is a matter of changing LDAP to look for different information off of the AD?

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

How would I set phpBB to authenticate using the employee ID (like it is), but to display the displayName property?

That I don't know I'm afraid. I've never actually used phpBB, only dug into the source code earlier to try and see what it was up to with that error message.

AD and LDAP are more my thing, when you've seen a few hundred of these LDAP settings you've seen them all :)

Chris

ASKER

I got it!

I changed sAMAccountName to displayName and it works! I can log in using my full name and password from the AD, so can other users.

Thanks for all your help Chris!

-Ryan

You're welcome :)

Chris