I have everything setup and all users can login and the accounts are created in the local WordPress database but no other fields come over frrom LDAP.

Here is my debug info

[INFO] method authenticate() called
[INFO] ——————————————
PHP version: 5.4.24
WP version: 3.9.1
ADI version: 1.1.4
OS Info : Windows NT “serverName” 6.1 build 7601 (Windows Server 2008 R2 Enterprise Edition Service Pack 1) i586
Web Server : cgi-fcgi
adLDAP ver.: 3.3.2 Extended (201104081456)
——————————————
[NOTICE] username: “Username”
[NOTICE] password: **not shown**
[INFO] Options for adLDAP connection:
– account_suffix: @Sitename.com
– base_dn: Dc=SiteName,dc=com
– domain_controllers: DC.Sitename.com
– ad_port: 389
– use_tls: 0
– network timeout: 60
[NOTICE] adLDAP object created.
[INFO] max_login_attempts: 3
[INFO] users failed logins: 0
[NOTICE] trying account suffix “@Sitename.com”
[NOTICE] Authentication successfull for “[email protected]”
[NOTICE] cleaning up failed logins for user “Username”
[DEBUG] ATTRIBUTES TO LOAD: Array
(
[0] => cn
[1] => givenname
[2] => sn
[3] => displayname
[4] => description
[5] => mail
[6] => samaccountname
[7] => userprincipalname
[8] => useraccountcontrol
[9] => lastlogon
[10] => whencreated
[11] => homephone
[12] => otherhomephone
)

[DEBUG] USERINFO[0]:

[NOTICE] Updating user “Username” with following data:
– email :
– first name :
– last name :
– display name : Username
– account suffix:
– role :
[NOTICE] – user_id : 2
[NOTICE] Setting local password to the one used for this login.
[DEBUG] cn = / type = string / meta key = adi_cn
[DEBUG] givenname = / type = string / meta key = adi_givenname
[DEBUG] sn = / type = string / meta key = adi_sn
[DEBUG] displayname = / type = string / meta key = adi_displayname
[DEBUG] description = / type = string / meta key = adi_description
[DEBUG] mail = / type = string / meta key = adi_mail
[DEBUG] samaccountname = / type = string / meta key = adi_samaccountname
[DEBUG] userprincipalname = / type = string / meta key = adi_userprincipalname
[DEBUG] useraccountcontrol = / type = string / meta key = adi_useraccountcontrol
[DEBUG] lastlogon = April 22, 2009 / 7:24 pm / type = timestamp / meta key = last_logon_time
[DEBUG] whencreated = November 30, 1999 / 12:00 am / type = time / meta key = user_created_on
[DEBUG] homephone = / type = string / meta key = adi_homephone
[DEBUG] otherhomephone = / type = list / meta key = adi_otherhomephone
[NOTICE] FINISHED

User logged on.

https://www.ads-software.com/plugins/active-directory-authentication-integration/

Hi Curtiss,

After many installations/uninstallations of your plugin, followed by a lot of different configurations, the plugin now refuses to load its default configurations. Example:

– The link “settings” in the network plugins list disappeared
– The plugin behaves as if it was not inside a multisite installation, showing all configuration options (example: domain controllers settings) in all sites, and not only in network

I guess this caused by the garbage inside the database.
So, could you tell me where can I find, inside the database, the entries related to your plugin, so I could manually delete all of them?

Regards,
Aldemar

https://www.ads-software.com/plugins/active-directory-authentication-integration/

Firstly, I will like to say thanks you for the plugin. Fantastic!

But I noticed a glitch that I am not sure how to solve. Anytime a user is login in for the first time, the login is not successful. Until I use that same login details in the test tool in the setting page. After which login is then successful on the site login.

Of course I can’t always login on test tool for every new user before that can login, so I am guessing there is something i am missing.

Basically, I want any user that is on AD to be able to login to the site even if they are not on wp user list and get created after their first login to the site.

Cool stuff guys!

https://www.ads-software.com/plugins/active-directory-authentication-integration/

I created 3 AD groups to use with this plugin so when a user logs in they are assigned the appropriate role within WordPress. For example under the Authorization tab I have the Users are authorized for login only when they are members of a specific AD group. Then in the Groups I have the 3 AD group names listed in the Role Equivalent Groups with the corresponding WordPress user role. For example: sitename-WordPress-administrator=administrator, sitename-WordPress-editor=editor, and sitename-WordPress-author=author. User are able to login and from what I can tell get the appropriate role assigned. The issue I am seeing is when a user who is an administrator role is unable to paste YouTube videos into posts or even post or update posts or templates that when normally the site administrator can do. If I make this user a Global administrator for the entire WordPress MU instance they are able to perform these tasks. Am I missing something? From the instructions which are simple to follow this should work but something is just not right with the AD groups to WordPress roles and wondering how I can fix or correct.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I Need a Help for a trouble with the Active Directory Authentication Integration plugin and NT domain users. we have a Active Directory Authentication Integration plugin working properly with Active Directory in an environment with many users. Only we had the need to authenticate users who are in NT domains that have a trust relationship with AD. Users who are registered in the NT domain can not authenticate to WordPress MU, even those areas having a relationship of trust with the AD. In the process of setting up AD, create a group where we put domain users NT, NT Domain Groups and yet the NT Domain users can not log into WordPress.

Has anyone had a problem like this or have been through something similar?

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

Good morning all –

Just a note of caution about a couple things I noticed yesterday:

The plugin can in some cases store configuration information in more than one table, leading to some head scratching when things don’t work. I was updating the user/password/Domain controller information in the Active Directory Settings interface, but things just didn’t work. Changes never seemed to take effect even though they appeared to. Combing through the database, I found that there were settings stored in both the _sitemeta table and the _options table. The settings interface was showing what was entered in the _sitemeta table, but the settings in the _options table was taking precedence. After deleting the information from _options leaving them in _sitemeta, all was good.

Also, when troubleshooting the above problem, I enabled debugging output per the documentation. Just a warning that this ends up exposing the username and password of the AD account you’re using to authenticate with to your domain controllers. If you enable debugging, you can assume that your active directory username/password has been compromised, and should be changed immediately.

– Brent

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I’m using AD-AI along with Networks for WordPress. AD logins work just fine for the main site. They fail for the other sites. (Local logins work fine.) I get a message “error creating account” even though the account already exists. I turned on debugging to see if provided any additional information. Testing if the account is a member of an AD group is failing even though the same groups are set on the primary site.

I’m getting Warning: “ldap_search() [function.ldap-search]: Search: Operations error in D:\inetpub\wwwblogs\wp-content\plugins\active-directory-authentication-integration\inc\adLDAP.php on line 978” which is in
public function user_info()
The line reads
$sr=ldap_search($this->_conn,$this->_base_dn,$filter,$fields);

Any help is appreciated. Thanks.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

We are running php 5.3 in windows server 08 and IIS 7.5 and we had to add this line to the php.ini to get it to work.

extension=php_ldap.dll

just add it to the extensions section near the bottom.
otherwise the ldap_*() functions are not accessible.

I wanted to post this here as it took me a bit to figure out and I was hoping I could save someone else that trouble.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I am not sure I have this set up correctly. My bind username is username and my bind password is blank. I set the debug mode and my password is showing up as “password: c11a183327ff26a07cd8adc020705da8” instead of the simple text password for this test user.

My network admin says we don’t need suffixes and I am using an address I can ping as my domain controller. My base domains are dc=sod,dc=washington,dc=edu. I don’t want any special OUs or groups. My failure message is just: Authentication failed [3] Storing failed login for “tuser”.

This is IIS 2008 with ldap installed and that is working.

Any ideas? Thanks.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I am cross-posting this to the Active Directory Authentication Integration support and the Network Privacy support, as the problem exists only when both are active.

I have a multisite installation of WordPress 3.4.2 with the Active Directory Authentication Integration plugin (v0.6) and the Network Privacy plugin (v0.1.3).

The main site (which basically houses a list of sub-sites) (i.e. mysite.com) is set with ADAI to allow any AD user to login. The Network Privacy plugin is set to only show the site to site subscribers (or above). This works well to allow all faculty/staff/students to access the list of available sites.

Each sub-site is locked down to a particular AD group (department, class, etc.). For example, site mysite.com/test1 is set to only allow logins from the group “ITsupport” (and maps that group to “editors” for the test1 sub-site) and Network Privacy is set to allow site subscribers (and above) to access the site.

AD login works well, but I am having the following problem when I have Network Privacy installed:

UserA is a member of ITSupport in AD. He has never logged in to mysite.com or the mysite.com/test1 sub-site. When he goes to mysite.com, Network Privacy kicks him to the login screen, where he is able to successfully login with his AD credentials, because he is a member of the “Domain Users” group that is allowed to mysite.com via ADAI. So now he is logged into the WordPress Network. However, if he now goes to mysite.com/test1, Network Privacy does not let him in. Looking at the back end, this attempt to access mysite.com/test1 has not triggered ADAI’s function to create the user/role for this sub-site.

If UserA logs out of mysite.com and goes directly to mysite.com/test, he is able to login (ADAI creates the user/role on the sub-site) and he doesn’t have a problem with mysite.com/test1 in the future. He still has the same problem with any other sub-site that he has not DIRECTLY logged in to.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

Backslash added to Passwords that contain an apostrophe.

I’m using version 0.6 of this plugin and this plugin was the best ldap integration for a multisite that I had tested. However, one issue that came up was that for passwords in Active Directory that have an apostrophe in it, the user is unable to login because it creates a backslash before the apostrophe for WordPress. I confirmed this by trying to login with a wrong password with an apostrophe and noticed the backslash appear.

I was able to update a password for a user using the WordPress database with an apostrophe and that works without any problems. Should a stripslashes be placed somewhere and if so where should I be looking?

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I’m setting up a new WordPress MS with Active Directory Authentication Integration and was hoping to use this plugin. After installing the plugin and setting it up on the base site without issue, I created and attempted to log into a new MultiSite sub-site, but the AD authentication failed. After logging in using a local account, I discovered that none of the AD settings that had been entered into the base site propogated to the other sites in the network (either new or pre-existing). The plugin is there, and the Network Activation has forced it to activate in all subsites, but the settings are empty and nothing authenticates until the AD server and other settings are entered.

Is this by design, or has something gone wrong with my installation? We’re putting together a network that will have 100+ blogs and about 225 users, all utilizing Active Directory, so having to manually configure the AD settings for each blog (the settings are identical) would be a bit of a setback. I could put together an external script to go straight to the DB and automate it, but I’d rather avoid a database workaround if possible.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

Is possible to integrate a SSO feature for Users with a logged in account in Windows?

I’m thinking on the variable REMOTE_USER from Apache

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I noticed some 404 errors in my console when I activated this. For some reason, wp_register_script’s plugin URL returned /inc/scripts instead of just /scripts. I replaced the ADAUTHINT_PLUGIN_BASENAME constant with __FILE__ and the scripts loaded correctly.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

Does this plugin support multiple domains?

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I changed my password in AD recently and now I can not get authenticated to WP. Other people can log in so I’m thinking it is either the password length or a special character that I am using “[]\”. How can I figure this out?

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I’m having a weird problem. When new first time user authenticates using AD credentials, the WP account is created and user is forwarded to the profile screen. If the wrong AD password is provided on first time login user is denied access to the site. After logout, for any subsequent login attempt user can type any random password string and the WP allows to login. User is again forwarded to the user profile screen.
Does anyone have any ideas what may be wrong?

Environment
WP – version 3.3.1
active-directory-authentication-integration – tried both official 0.6 and development 0.7.
Server – Win2k8
Web Server – IIS7

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

NOTE: This appears to only be in the 0.7 devel version, not in the current (as of now) 0.6 release.

Just activated “Active Directory Authentication Integration” plugin (devel version 0.7) and two things have happened:

1) Page load times have gone through the roof
2) PHP Error logs filling up with the following message(s)

[16-Jan-2012 22:57:06] WordPress database error Table 'MyDatabaseName.wp_adauthint' doesn't exist for query SELECT 1 res FROM wp_adauthint LIMIT 1 made by require, require_once, require_once, require_once, do_action, call_user_func_array, instantiate_adai_plugin, ADAuthInt_Plugin->__construct

[16-Jan-2012 22:57:24] WordPress database error Table 'MyDatabaseName.wp_adauthint' doesn't exist for query SELECT 1 res FROM wp_adauthint LIMIT 1 made by require, require_once, require_once, do_action, call_user_func_array, instantiate_adai_plugin, ADAuthInt_Plugin->__construct

[16-Jan-2012 22:57:28] WordPress database error Table 'MyDatabaseName.wp_adauthint' doesn't exist for query SELECT 1 res FROM wp_adauthint LIMIT 1 made by require_once, require_once, require_once, require_once, do_action, call_user_func_array, instantiate_adai_plugin, ADAuthInt_Plugin->__construct

When I disable the plugin, page load times go back to normal and the error log is clean.

I’m using version 0.7 due to sorting out a previous issue.

The same issue does not seem to be present in the current 0.6 version.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

Brand new install of WordPress 3.3.1, with default Twenty Eleven theme. No plugins except for version 0.6 of Active Directory Authentication Integration.

Native WordPress users can log in fine, but and Active Directory users can not login at all. I am pretty certain that I have the plugin setup right. I’ve done run the plugin with…

$ADAuthIntObj->setLogLevel(ADAI_LOG_DEBUG);

…enabled, as well as used the test.php file in the devel version.

If I use the correct credentials etc, it appears everything succeeds except the user creation / authentication. If I purposely screw up the BIND user credentials, DC, or any of the basic setup options, debug and test.php show a failure to bind to Active Directory.

I have successfully tested AdLdap connection and authorizing users via PHP from this server to the DC’s independently of the Active Directory Authentication Integration plugin.

Here is the output from test.php, with sensitive detail sanitized:

AD Integration Logon Test
openLDAP installed
[INFO] method authenticate() called
[INFO] WP version: 3.3.1
[NOTICE] username: USERNAME
[DEBUG] password: PASSWORDHASHEDALLTOSIMITHEREENS
[DEBUG] The domain_controllers key exists in our options array.
[DEBUG] The randomize_dc key exists in our options array.
[DEBUG] The port key exists in our options array.
[DEBUG] The use_ssl key exists in our options array.
[DEBUG] The secure_connection key exists in our options array.
[DEBUG] The bind_user key exists in our options array.
[DEBUG] The bind_user_password key exists in our options array.
[DEBUG] The base_dn key exists in our options array.
[DEBUG] The auto_user_create key exists in our options array.
[DEBUG] The auto_user_update key exists in our options array.
[DEBUG] The default_email_domain key exists in our options array.
[DEBUG] The dup_account_handling key exists in our options array.
[DEBUG] The append_user_suffix key exists in our options array.
[DEBUG] The user_account_suffix key exists in our options array.
[DEBUG] The append_ad_user_suffix key exists in our options array.
[DEBUG] The prepend_ad_user_prefix key exists in our options array.
[DEBUG] The ad_account_suffix key exists in our options array.
[DEBUG] The display_name key exists in our options array.
[DEBUG] The allow_local_password key exists in our options array.
[DEBUG] The _lost_password_message key exists in our options array.
[DEBUG] The randomize_password key exists in our options array.
[DEBUG] The auth_from_ad_grp key exists in our options array.
[DEBUG] The auth_groups key exists in our options array.
[DEBUG] The use_role_equiv key exists in our options array.
[DEBUG] The role_equiv_groups key exists in our options array.
[DEBUG] The auto_update_user_group key exists in our options array.
[DEBUG] The max_login_attempts key exists in our options array.
[DEBUG] The blocking_time key exists in our options array.
[DEBUG] The notify_user key exists in our options array.
[DEBUG] The notify_admin key exists in our options array.
[DEBUG] The admin_email key exists in our options array.
[NOTICE] adLDAP object created.
[INFO] array(1) {
	[0]=>
	object(adLDAPE)#175 (14) {
		["_last_query"]=>
		NULL
		["_ad_port"]=>
		int(389)
		["_account_prefix":protected]=>
		string(0) ""
		["_account_suffix":protected]=>
		string(0) ""
		["_base_dn":protected]=>
		string(18) "DC=domain,DC=local"
		["_domain_controllers":protected]=>
		array(1) {
			[0]=>
			string(20) "dc1.domain.local"
		}
		["_ad_username":protected]=>
		string(24) "[email protected]"
		["_ad_password":protected]=>
		string(8) "BINDPASSWORD"
		["_real_primarygroup":protected]=>
		bool(true)
		["_use_ssl":protected]=>
		bool(false)
		["_use_tls":protected]=>
		bool(false)
		["_recursive_groups":protected]=>
		bool(true)
		["_conn":protected]=>
		resource(100) of type (ldap link)
		["_bind":protected]=>
		bool(true)
	}
}

[INFO] max_login_attempts: 0
[ERROR] Authentication failed
[WARN] Storing failed login for "USERNAME"
[ADAI][0] Log Level set to 6
Logon failed

The only thing I can think of is that Active Directory Authentication Integration is trying to authenticate against AD using a hashed version of the password instead of plaintext.

What am I missing? Any help, please?

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I can’t login with AD accounts if the “Only allow members of the following groups to login through Active Directory?” option is enabled.
Enabling the log, i receive these messages:

[5] users failed logins: [4] Authentication successful [3] Authorization by group failed. User is not authorized.

The previuous version works fine, and the setting are the same.

What I can do to fix this problem?

Thanks.

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

Thanks for the new update to AD to work better with multisite. Still, even after installing, I’m having the exact same problem as the last plugin I used (ADI 1.1.1), where I can authenticate & create user ok, and even get the roles mapped right, but when i open the all users page on the site admin, only my super admin shows. The counts actually do increment at the top (all users=2 administrators=2) but the new username doesn’t show up as an editable link or anything.

Probably related, I get a “You do not have sufficient permissions to access this page.” once i do login, even though it appears that I’m an administrator. The debug mode output appears to accept everything (firstname, last name, email, display name), plus the user appears correctly in the network admin panel.

Any ideas?

Thanks

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I have just implemented this plug-in and having no issues with authentication. But what I can’t figure out is how to get the information to update from AD to WP.

IE: First Name, Last Name (SN), Nickname, email address.

Is there any documentation on this?

Thanks in advance

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

For our multisite environment, the 0.6 version of the ADAI plugin came at just the right time. We are getting ready for a fall launch of our WordPress environment at Princeton, and as soon as I upgraded to 0.6, everything worked like a charm, including SSL.

We do have a fringe issue. This issue won’t prevent us from using the plugin. This might be too unique of a problem to justify a change to the plugin, but I thought that I would explain the issue we are having to see if a workaround was possible.

We have an organizational unit within our directory, in which all of the uid values are email addresses. These are part of our guest account system for provisioned users outside of our university. All Princeton users have a normal uid, for example, mdmuzzie (me). An example guest account user might log in as [email protected] (also me).

For our normal AD accounts, the uid is the same as the sAMAccountName. For my example guest account, the uid is [email protected] but the sAMAccountName is guest100000000002032.

I already added a filter to the wpmu_validate_user_signup function in ms-functions.php to allow the period and the @ sign, so I was able to manually add my test guest user to the system. However, that user cannot authenticate, and gets the debug message “…[2] Authentication failed [3] Storing failed login for “[email protected]”

For all users, authentication does not work at all unless I configure ADAI to “Append account suffix to AD usernames before being validated,” using the string “@pu.win.princeton.edu”

So what I suspect is happening is that the test user is being sent to AD as [email protected]@pu.win.princeton.edu

What I think might solve this would be an alternate option to “Prepend account prefix to AD usernames before being validated” (instead of the suffix). Then I could use the string “PRINCETON\”

In our other systems PRINCETON\[email protected] authenticates just fine.

Does this make sense, or is there a simpler workaround? Are we unique in our use of @ signs in guest usernames?

Thanks,
Michael

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/

I was successful in logging in with one of the Active Directory accounts but no one else can log in. We have tried logging into the main wordpress site and sub sites (multisite).

It seems as though Domain Admin accounts can log in although only 1 has arrived at the dashboard. The other gets ‘error creating user’. All non admin accounts just fail when trying to login.

Is there some debugging I can turn on to help figure out what’s going on?

https://www.ads-software.com/extend/plugins/active-directory-authentication-integration/