174 Gedanken zu „AD-Integration für WordPress“

1. Hallo Sascha,
   wir arbeiten immer noch an der vollen Multisite-Fähigkeit. Dazu haben wir uns zu einer komplettem Überarbeitung von ADI entschieden. Ich hoffe sehr, dass wir demnächst eine BETA fertig haben. Bevor wir die endgültige Version 2.0 veröffentlichen können, muss dann aber noch fleißig getestet werden. Wärest Du bereit beim Test mitzuwirken?

2. Hallo,

   dein Plugin ist echt super. Da ich eine Multisite Umgebung habe, warte ich aber dringend auf das neueste Update (1.2 ??) mit welchem ich pro Seite die Einstellungen vornehmen kann. Somit könnte ich auch die Rollenzuteilung pro OU einstellen.
   Was denkst du, wann du die neue Version veröffentlichen kannst?

   Gruss Sascha

3. This problem may be caused by a change to mcrypt in PHP 5.6.x. A fix is on the way.

4. Hi Christian,
   ich denke das Problem liegt in der Fehlermeldung: Warning: mcrypt_decrypt(): Key of size 27 not supported by this algorithm. Only keys of sizes 16, 24 or 32 supported in E:\XAMPP\htdocs\intranet-wp\wp-content\plugins\active-directory-integration\ad-integration.php on line 3258

   ADI hinterlegt das Kennwort für den Bulk Import User verschlüsselt in der Datenbank. Für die Anmeldung wird dieses Kennwort wieder entschlüsselt und dabei geht anscheinend etwas schief.

   Welche PHP Version setzt Du ein?

5. Hello,

   we have some trouble with the BULK import. I always recieve the following error:

   [INFO] ————————————-
   START OF BULK IMPORT
   2015-12-10 / 12:26:33
   ————————————-

   Warning: mcrypt_decrypt(): Key of size 27 not supported by this algorithm. Only keys of sizes 16, 24 or 32 supported in E:\XAMPP\htdocs\intranet-wp\wp-content\plugins\active-directory-integration\ad-integration.php on line 3258

   [INFO] Options for adLDAP connection:
   – base_dn: dc=XXX,dc=local
   – domain_controllers: XXX.XXX.local
   – ad_username:
   – ad_password: **not shown**
   – ad_port: 389
   – use_tls: 0
   – network timeout: 5
   [NOTICE] adLDAP object created.
   [INFO] Domain Controller: XXX.XXX.local
   [ERROR] Error retrieving group members for group „Intranet-AD“.
   [INFO] Number of users to import/update: 3 (list generated in 0 seconds)
   [DEBUG] ATTRIBUTES TO LOAD: Array
   (
   [0] => cn
   [1] => givenname
   [2] => sn
   [3] => displayname
   [4] => description
   [5] => mail
   [6] => samaccountname
   [7] => userprincipalname
   [8] => useraccountcontrol
   )

   [DEBUG] USERINFO[0]:

   [INFO] User „intranet“ not found in Active Directory.

   [INFO] 0 Users added.
   [INFO] 0 Users updated.
   [INFO] In 0 seconds.
   [INFO] ————————————-
   END OF BULK IMPORT
   2015-12-10 / 12:26:33
   ————————————-

   Bulk Import returned no error.

   When I run the TEST TOOL everything looks fine.
   The group we plan to identify the user is listed

   [DEBUG] USER GROUPS:Array
   (
   [0] => Intranet-AD
   [1] => XXX
   [2] => XXX
   [3] => XXX
   [4] => XXX
   [5] => XXX
   )

   I can change WP Role’s about this AD-group with „Role Equivalent Groups“ and also see the location of the user object in the Test Tool report.

   I read a lot here in the forum but can not fix my error.
   I try :
   – multiple baseDN (only dc, and then step by step down to the OU where the group is located)
   – I copy user and group direct under the dc in our AD
   – diffrent user (AD user and admin account and „local“ wp user)
   – diffrent BULK Importuser
   – TLS on and off
   – Check the security tab from the group.
   – and a lot more

   I’m running out of idears. Can anybody help me?

   THX Christian

6. Die Zuordnung einer Rolle auf Basis einer OU? Hmmm… wusste gar nicht, dass das überhaupt geht. Eigentlich muss das über Sicherheitsgruppen gemacht werden. Dann wird aber immer nur die erste gefundene angezogen. Daher ist die Reihenfolge auch so wichtig.

7. Hi Ant,
   this is possible. Go to tab „User Meta“ and add additional user attributes. WooCommerce stores things like billing address or shipping address in the user meta table. An example: Add the following to Addtional User Attributes:
   givenname:string:shipping_first_name
   sn:string:shipping_last_name
   streetaddress:string:shipping_address_1
   postalcode:string:shipping_postcode

   I havn’t tested it. But it should work.

   Here are the user meta keys from WooCommerce that can be used this way:
   billing_first_name
   billing_last_name
   billing_company
   billing_address_1
   billing_address_2
   billing_city
   billing_postcode
   billing_country
   billing_state
   billing_email
   billing_phone
   shipping_first_name
   shipping_last_name
   shipping_company
   shipping_address_1
   shipping_address_2
   shipping_city
   shipping_postcode
   shipping_country
   shipping_state

8. When integrating with WooCommerce to create an internal, intranet compnay store, is there any way to pull AD address attribute and prepopulate in WooCommerce „shipping“ address fields?

9. Hi John,
   that really sounds wierd. I think it’s a problem with the Atelier A5 custom login page. Does this problem also occur if you deactivate the custum login page?

10. We love this plugin, but I’m having a weird problem. On the initial web page, people click on a page and they get a 404, page not found, OR an error message. If they hit ‚refresh‘ however, the login page comes right up. (for some reason I can’t generate the error message right now, I think it’s something like „page not found“ although it’s not a 404, it’s a single text line).

    We’re also using the Atelier A5 custom login page. Do you think your plugin and that plugin are conflicting maybe?

    I can turn on debug if you need.

    The AD integration is working fine, this 404 is just what the issue is.

    == John ==

11. Erst mal danke für das tolle plugin.
    Leider stelle ich fest, dass die Zuordnung einer Rolle aufgrund der OU nur bei der ersten OU im DN funktioniert, bei den nachfolgenden nicht mehr.
    Lässt sich das irgendwie übersteuern oder muss ich alle 100 OUs ein und derselben Rolle zuweisen?

12. Well, I got it working using an account suffix. Strange though. I do not understand why the suffix is needed for ADI, but not for testing LDAP directly with a PHP script (something I found online), and with the wpDirAuth plugin.
    I look forward to using this great plugin now! Thanks!

13. Here is the output. I changed a couple things for privacy (user name and domain controller names). The username and password is definitely correct and works fine with the „wpDirAuth“ plugin. Is there any additional debugging I can turn on?
    Thank you again for your support!

    [INFO] method authenticate() called
    [INFO] ——————————————
    PHP version: 5.6.99-hhvm
    WP version: 4.3
    ADI version: 1.1.8
    OS Info : Linux smg-saacs 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64
    Web Server : srv
    adLDAP ver.: 3.3.2 EXTENDED (201302271401)
    ——————————————
    [INFO] LDAP paging: enabled
    [NOTICE] username: my.name
    [NOTICE] password: **not shown**
    [INFO] Options for adLDAP connection:
    – account_suffix:
    – base_dn: DC=sts,DC=co
    – domain_controllers: DM01.STS.CO;DM03.STS.CO
    – ad_port: 389
    – use_tls: 0
    – network timeout: 10
    [INFO] Checking domain controller ports:
    [INFO] – DM01.STS.CO:389 – OK
    [INFO] – DM03.STS.CO:389 – OK
    [NOTICE] adLDAP object created.
    [INFO] max_login_attempts: 10
    [INFO] users failed logins: 0
    [NOTICE] trying account suffix „“
    [ERROR] Authentication failed
    [WARN] storing failed login for user „my.name“

14. Such a „prebinding“ user shouldn’t be necessary, except for Bulk Import and Sync Back. If a user can authenticate he can read his information from AD. Otherwise your Windows network won’t work as expected. What does the Test Tool say?

15. Ok deKay, I have to make some tests.

16. Hi there,

    Thanks for the plugin. Works great for our intranet! However, I came across a bug today…

    It seems users who have an apostrophe in their AD username can’t log on! For example. „ao’neill“.

17. Hello,
    I am having problems getting this plugin to work on a corporate network. Our AD server requires an authenticated user to browse the directory. I do not see anywhere to add those credentials in your plugin. Using the plugin „wpDirAuth“ I am able to add those credentials and authenticate successfully against AD. They call it a username and password for prebinding to allow profile searches.
    Your plugin looks much nicer and has more functionality, so I would like to get it working with yours.
    Thanks!

18. Love your plugin! Made my life so much easier to keep single sign-on alive and well in my org. I thought my company was unique in that we had multiple business units each with their own AD instances but it seems there’s a bit of demand to be able to auth users to multiple domains and not just have fault tolerance in DC’s. I’ve created a patch that I’d love to share with you for your consideration into head. It shouldn’t impact functionality out of the box, merely extend it if you create DC’s, base DN’s and account suffixes as ordered groups and you then then login as user@domain1 vs user@domain2 and it will auth you to the right place. You can see the patch file on your project’s support pages on the wordpress site. If you want I can email the patch file directly just send me your address.

    Thanks,
    Steve

19. Hello Christoph,

    The way our AD is structured requires the that any integration with AD be able to crawl the OU hierarchy for Users and Groups. We’re noticing that if we „point“ the AD plugin to the root OU, it will not permit anyone to login whose user object is not directly in that OU.

    Are there any plans for this as well as nested-group validation?

    Thanks!

20. hab hier den Fehler : This user exists in Active Directory, but has not been granted access to this installation of WordPress.
    habe aber in den Feldern unter „Authorization“ nix eingetragen. Muss da was rein?
    WP 4.1 auf debian jessie

21. You’ll for certain do not have something to lose with Adiphene, thus for those that actually
    need to slim while not losing their time and power,
    then Adiphene is that the product for you. Adiphene is
    the newest and fastest weight reduction supplement in market.

    Having said that, the study has shown that just about anything
    that can maximize the metabolism, also can raise the weight reduction even if the human being is
    just resting.

    My blog post finance

22. Hello
    I can connect with TLS but no attributes coming from AD (the array is empty).
    While connecting without TLS, all works fine.

    Does someone know how to fix this?

    thanks

23. An offense that had been held to fewer than 37 points only once all year managed just the two touchdowns. Made in the past 15 years!Wounded Warrior Project. 9:59 Rep. ARLINGTON, Wash. The first offer from your insurance company might be less than you feel you deserve and you might think that your insurance company isn’t providing you with what it should be.
    cheap toms shoes,cheap toms,cheap toms shoe,discount toms shoes,discount toms,toms shoes,buy toms,toms shoes for sale,cheap toms shoes for sale,toms shoes outlet,toms shoes for sale,toms shoes,toms shoes outlet,toms shoes for sale,toms shoes cheap,toms shoes online,toms shoes for sale,cheap toms shoes for sale,toms shoes for cheap,pre order toms shoes,pre order cheap toms shoes,cheap toms shoes,buy cheap toms shoes,authentic toms shoes,authentic cheap toms shoes,buy toms shoes,buy cheap toms shoes,order toms shoes,order cheap toms shoes,toms shoes online,buy toms shoes online,toms shoes 2015,cheap toms shoes 2015 http://www.actionwildlife.org/news/preordercheaptomsshoes/index.html

24. I’m running ADI v. 1.1.5 fine on the server config below. When I upgrade to 1.1.17 I get an error and both the admin console and the site go blank.

    Here is the error from the apache2 error.log
    [Thu May 21 16:56:01 2015] [error] [client . . . ] WordPress database error Table ‚wordpress30.wp_14_adintegration‘ doesn’t exist for query SELECT count(*) AS count from wp_14_adintegration WHERE user_login = “ AND failed_login_time >= 1432252531 made by wp_signon, wp_authenticate, apply_filters(‚authenticate‘), call_user_func_array, ADIntegrationPlugin->authenticate, ADIntegrationPlugin->_get_failed_logins_within_block_time
    [Thu May 21 16:56:01 2015] [error] [client . . . ] WordPress database error Table ‚wordpress30.wp_14_adintegration‘ doesn’t exist for query INSERT INTO wp_14_adintegration (user_login, failed_login_time) VALUES (“, 1432252561) made by wp_signon, wp_authenticate, apply_filters(‚authenticate‘), call_user_func_array, ADIntegrationPlugin->authenticate, ADIntegrationPlugin->_store_failed_login

    bash-4.3$ php -v
    PHP 5.2.4-2ubuntu5.27 with Suhosin-Patch 0.9.6.2 (cli) (built: Mar 11 2013 14:14:48)
    Copyright (c) 1997-2007 The PHP Group
    Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies
    with Suhosin v0.9.22, Copyright (c) 2007, by SektionEins GmbH
    bash-4.3$ apache2 -v
    Server version: Apache/2.2.8 (Ubuntu)
    Server built: Mar 8 2013 17:04:27
    bash-4.3$ mysql -v
    Welcome to the MySQL monitor. Commands end with ; or \g.
    Your MySQL connection id is 125753
    Server version: 5.0.87-d10-ourdelta65 (OurDelta – http://ourdelta.org/)

25. I, for the life of me, cannot get the Bulk Import feature to work. It appears that I have everything else configure properly and it seems that the authentication works via the Test Tool, but no matter what I try, I keep getting the same error message in the Bulk Import:

    [ERROR] Error retrieving group members for group „CorporateIT“.

    I have tried many combinations of Base DN settings, and Bulk Import User Accounts, but no matter what I try, I keep getting the same error message above.

    My environment is as follows:
    Windows Server 2012 R2
    Apache 2.4.12 (32-bit)
    PHP 5.6.8 (32-bit)
    Wordpress 3.9.2

    There are various discussions that suggest trying different Base DNs, but I’ve tried virtually every conceivable combination.

    Any ideas?

26. Don’t know what is going on there. What version of ADI do you run on your site where multisite is NOT turned on?

    I’ll send you an email.

27. Hello Cristoph:

    I run a few wordpress installations and we recently upgraded to a new server which is running php 5.4. On two separate worpress websites where multi-site is turned on and AD integration is currently active everything runs just fine.

    However, I have one additional website which also uses AD Integration where multi-site is NOT turned on and I am running into a problem that when I try to add a user, I get the following error message: „ERROR: Please enter your password.“

    I am able to log in to this website just fine with an account that is authenticated through AD I just can’t add users. I came across this post: https://wordpress.org/support/topic/wp-40-error-please-enter-your-password
    which suggested rolling back to PHP 5.3.x do you know why PHP 5.4 would be causing this issue?

    Thanks.

28. Hi Christoph,

    meiner Meinung nach stimmt alles.
    Wie kann ich Dir die Teamviewer Daten zu kommen lassen?
    Vielen Dank für den tollen Support.

29. Hi Mike,
    it’s fixed in 1.1.7.

30. Hi Mike,
    the missing ADI status is already fixed in development version.

    Could you be a little bit more specific about the other problems?

31. Hallo Tobias,
    mehrere Rollen werden derzeit nicht unterstützt, da es keine Standardfunktion von WordPress ist. Ich setze es aber mal auf die ToDo-Liste.

32. Hallo Marco,
    ich kann auch nur raten.
    Bist Du dir mit der BaseDN und dem Account Suffix sicher?
    Gibt es vielleicht Probleme mit TLS? Hast Du mal den Hinweis aus der FAQ dazu gelesen?
    Oder hast Du vielleicht irgendwelche besonderen Zeichen im Kennwort?
    Teste auch mal bitte mit der Version 1.1.6.

    Lass mich wissen, wie es aussieht. Ich kann Dich auch direkt unterstützen (z.B. per TeamViewer).

    Christoph

33. Having an issue with the latest update. Some settings won’t save. Specifically not allowing users to update their email and showing the ADI status. Any word on fixing those?

34. Hi,

    ich bekomme es einfach nicht hin:

    AD Integration Logon Test

    openLDAP installed

    [INFO] method authenticate() called
    [INFO] ——————————————
    PHP version: 5.6.3
    WP version: 4.1.2
    ADI version: 1.1.5dev
    OS Info : Windows NT R1000 6.1 build 7601 (Windows 7 Business Edition Service Pack 1) i586
    Web Server : apache2handler
    adLDAP ver.: 3.3.2 EXTENDED (201302271401)
    ——————————————
    [INFO] LDAP paging: enabled
    [NOTICE] username: jaenisch
    [NOTICE] password: **not shown**
    [INFO] Options for adLDAP connection:
    – account_suffix: @rufin.local
    – base_dn: dc=rufin,dc=local
    – domain_controllers: 172.22.12.15
    – ad_port: 389
    – use_tls: 1
    – network timeout: 5
    [NOTICE] adLDAP object created.
    [INFO] max_login_attempts: 3
    [INFO] users failed logins: 0
    [NOTICE] trying account suffix „@rufin.local“
    [ERROR] Authentication failed
    [WARN] storing failed login for user „jaenisch“

    Logon failed

    Was mache ich falsch, oder wo liegt der Fehler?
    Der Server ist ein Windows Server 2012 R2

    Danke und Gruß
    Marco

35. Hallo Christoph,

    gibt es schon eine Möglichkeit für mehrere User Groups?

    Hier gibt es einen Beitrag dazu aber leider ist der Download nicht mehr verfügbar

    https://wordpress.org/support/topic/multiple-roles-through-ad-groups?replies=12

    vielen Dank für die tolle Arbeit

    Tobias

36. Hi John,
    thanks for your bug report. This is already fixed in development version: https://downloads.wordpress.org/plugin/active-directory-integration.zip

    Christoph

37. Hi Benni,
    in einer der nächsten Versionen wird es die Möglichkeit für eine Single Sign On geben.

    Christoph

38. Hi Florian,
    that sounds wierd. I have no idea, why the plugin behaves like this. Is it true that ADI worked for a longer time and suddenly this problem popped up? Do you have installed another plugin and then the problems began?

    That you can not set the max login attempts to 0 is definitly a bug (Issue #0082). Thanks a lot for your report. You are mentioned in the changelog. It’s fixed in the development version, please give it a try if possible: https://downloads.wordpress.org/plugin/active-directory-integration.zip

    Christoph

39. Hi,

    we encountered a serious error. The users complained that they can not login to our wordpress, the keep getting a a Message „Account blocked for 30 Seconds“. They get this message BEFORE entering any login credentials. They can’t even see the login form in browsers they never used to login to this site.
    It’s further more not possible to disable the Brute-Force Protection by empty the field or setting to 0. It always goes back to 3 login attempts.
    To login we needed to disable the plugin and enable it again after a successful login.

    Do you have any idea what can cause this strange behavior.

    And why is it not possible to disable Brute Force Protection at all?

    Thank you in advance,
    Florian

40. Hi Christoph,

    sehr geiles Plugin! Vielen herzlichen Dank für deine Arbeit. Ich habe es bei uns integriert und habe sauberen Zugriff auf alle AD User etc., leider nur ein Problem …
    Ich habe mein WP auf Windows Server 2008 installiert und nutze IIS7 und alle User nutzen IE, weshalb ich gerne automaisch die Benutzer einloggen würde.
    Geht das mit deinem Plugin? Ich hab auf dem IIS windows authentication und anonymous aktiv.
    Vielen Dank schon im Voraus

    Benni

41. To fix „Invalid Credentials“ error, I had to add this code to the bulkimport.php script:

    $ad_password = trim($ad_password);

    This fix is referenced in this URL:
    https://wordpress.org/support/topic/i-cant-seem-to-get-bulk-importing-working

42. Arbeitet ihr mit self-signed certificates und TLS? Dann muss ggfs. OpenLDAP so konfiguriert werden, dass es das Zertifikat des AD-Servers auch akzeptiert. Das geht in dem Du „TLS_REQCERT never“ in eure ldap.conf oder die Umgebungsvariable LDAPTLS_REQCERT=never setzt. Falls das nicht helfen sollte, kannst Du mir gerne eine E-Mail an christoph@steindorff.de senden und wir können uns etwas vertraulicher austauschen, evtl. auch mal telefonieren.

43. Hi Christoph,

    AD Integration ist mein Lieblings-Plugin für WP. Wir nutzen ein WP Intranet und haben von einem Server zu einem anderen migriert. Der Hostname hat sich geändert und wir nutzen etwas neuere Programm Umgebung (PHP 5.5.19, Apache 2.4.10, mysql 5.6.21, phpmyadmin 4.2.11).

    Leider funzt jetzt der bulk Import nicht mehr. Gleiche Einstellungen wie auf altem Server. Dort läuft es einwandfrei. Auf dem neuen Server bekomme ich immer

    „[ERROR] adLDAP exception: Bind to Active Directory failed. Check the login credentials and/or server details. AD said: Invalid credentials“.

    Credentials sind 100% i. O. – ich habe sowieso mehrere User getestet. Generell sind alle Einstellungen ok, ich kenne mich mit AD ganz gut aus. Leider weiß ich nicht wo ich noch debuggen kann. Außerdem läuft es ja auf dem anderen Server einwandfrei. Der Stand sogar in einem anderen VLAN. Dieser Server ist direkt im VLAN vom DC.

    Hast Du noch einen Tip? Danke

    Gruß aus Frankfurt
    Systembastler

44. Have you set „Import members of security groups“ on the tab „Bulk Import“?

    EDIT: Have heard that it solved the problem.

45. Hi Christoph

    I initially had your plugin working fine on a new intranet I’m testing, with bulk import set up as a cron job, but now it no longer imports. I tried the manual bulk import link when the cron job stopped working, but to no avail. I can though import in users perfectly using the test tool. Nothing changed in our network bar upgrading Exchange so I’m not too sure if the two could be linked. I also reinstalled the plugin from scratch but no luck. Any help appreciated (and thanks for such a great plugin!)

46. Hi Jason,
    that is easy. Information loaded from AD (see tab „User Meta“) is stored as user meta data in WordPress. The key is the attribute name from AD with „adi_“ as prefix. To retrieve these you can use the WordPress function get_user_meta(). An example:

    
    $strFirstname = get_user_meta($user_ID, „adi_givenname“, true);
    echo $strFirstname;
    ?>

47. Hello,

    I’m using the Active Directory Integration for our intranet which is designed for internal use only. I have a question: I have a few forms within our site that I want to pre-populate with some of the active directory fields (such as common name). Is there any short code or php code I can use to pre fill these fields on the forms?

    Thank you,

    Jason

48. Hello Garret,
    do you use the Bulk Import to import the users from AD on regular basis?

    You can send me the output of the Test Tool for a user that is not already created in WordPress to christoph@steindorff.de and I’ll have a look.

    Best Regards
    Christoph

49. Hello Christoph,

    I manage a site that uses your plugin. Everything has been working fine. But all the sudden new users are not being pulled in and created in WordPress. I don’t know anything about Active Directory and I did not set up the plugin initially. What can I do to troubleshoot as to why this is not working. Is there a way to manually add a user?

    Danke
    Garrett

50. Hi Crystal,
    to activate the WordPress debug mode you have to edit your wp-config.php and change the line

    define(‘WP_DEBUG’, false);
    to
    define(‘WP_DEBUG’, true);

    I had a look at your screenshot and found a problem: Please active TLS, since AD requires this if you use port 389. If you use self-signed certificates, you have to tell OpenLDAP to accept them:

    Is it possible to use TLS with a self-signed certificate on the AD server?
    Yes, this works. But you have to add the line TLS_REQCERT never to your ldap.conf on your web server. If you don’t already have one create it. On Windows systems the path should be c:\openldap\sysconf\ldap.conf. Another and even simpler way is to add LDAPTLS_REQCERT=never to your environment settings.

    But there are so many possible other reasons for failed logins… 

    If TLS didn’t work for you:

    • Are you sure you use the right domain and BaseDN ? Often the Windows Domain is different from the Internet domain (e.g. @mydomain.local and dc=mydomain,dc=local).
    • Are you sure your webserver can reach the port 389 of the domain controller (firewall etc.)?
    • Is the user active (not deactivated in AD)?

    Please let me know, if this helped.

Kommentare sind geschlossen.