LDAP module

Hello

I am trying to find out if authentication via LDAP is possible.

I cannot find any snippets/modules that offer this but cannot believe that I am the first to need this.

Any clues?

Thanks

Lee

Hello.

I am still trying to find a suitable module. I gather I may have posted this question in the wrong forum - if so, please point me in the right direction! :0)

L

No one has published an LDAP module for MODx at this point in time. Someone posted they were researching how to create one last year, but nothing else was ever posted about it.

It’s definitely possible to accomplish, but it’s not trivial and nobody has shared their work if they’ve done so.

The next generation MODx release that is coming this fall will have some needed improvements that should greatly simplify integration of external user systems, and you will see examples available in the component library when that release is made.

Jason

Very many thanks for getting back to me.

Sadly, I cannot wait for the new version and I am no good as a developer so would not know where to start.

I am now looking at working out how to use the IMAP auth module and somehow syncing IMAP users with LDAP users on an LDAP server.....

Ho hum!

Again, thanks for letting me know.

Lee

I need it recently (one month ago) and the only quick solution I found was to change of CMS, because more and more have "base" LDAP support. :s

But I didn’t want to switch to something else than MODx. So that’s what I planned to do to get it work :
1) Make a module for syncing the users in LDAP with Mysql users. That way, I could manage groups within MODx
2) Make a snippet/plugin like above : That way users can connect using LDAP.
3) Make a custom snippet for websignup, adding an "invoke event" to the default one.
4) Making a plugin listening to this event, adding/removing/updating users in LDAP.

But I haven’t got the time to do this. Maybe it could help you to have the whole system working.

PS : If MODx Revolution comes that early, I think I’ll wait for LDAP

Hi Pikachu

Unfortunately my site is fully loaded with content which makes moving CMS a nightmare.

I am now looking into using Foxycart subscriber management as a proxy for LDAP registration....

Lee

Maybe I don’t understand, but there is another solution if you want to bring LDAP from your Mysql Users : penrose
http://docs.safehaus.org/display/PENROSE/Home

It aggregates data from multiples sources (like your modx mysql database) and make it available using your desired LDAP schema.

Considering that the WebLogin snippet was originally an Etomite MODx extension (Etomite did not have web user validation, only manager validation) and that WebLoginPE is a completely different application that just happens to use the same database (with extra tables), I don’t see why it would be so difficult to write a weblogin snippet to connect to an LDAP server instead.

http://www.devshed.com/c/a/PHP/Using-PHP-With-LDAP-part-1/

And a module to manage it would not be any more difficult. Simply ignore the MODx web user system. I’m not refering to the group management system. You would need a way to specify which group the user belongs to, so perhaps some of the MODx web user management structure could be included. But the validation part, the password checking stuff, would go to the LDAP server instead of the the MODx tables. Same with registering a new user, the username and password would go to the LDAP server.

All that happens when a web user is validated is that a bunch of stuff is set up in the SESSION, it doesn’t care where it comes from. The various MODx user functions all refer to the SESSION anyway.

http://www.sottwell.com/article-sessions.html

I would suspect that the same would apply to manager users; the roles and groups would stay with MODx, but the username/password validation would go to the LDAP server instead (onBeforeManagerLogin event).

Actually... looking at the events available to manager user handling and web user handling, it wouldn’t need any changes at all to the existing MODx user management, it just needs a single plugin to use the events to send the user data to the LDAP server, and if all goes well there, continue with the MODx processing; otherwise return to the MODx page with an error message. Hmmm... Interesting.

I did an LDAP authentication a long time ago in ColfdFusion. As you say, it shouldn’t be that bad.

I think for most MODx admins, all they would need is a quick check to verify the user. Most of them would already have user management for the LDAP database in place, so they wouldn’t need registration, new password, etc. as long as MODx sees them as logged on.

@sottwell

Quote from: sottwell at Jul 16, 2008, 02:08 PM

Considering that the WebLogin snippet was originally an Etomite MODx extension (Etomite did not have web user validation, only manager validation) and that WebLoginPE is a completely different application that just happens to use the same database (with extra tables), I don’t see why it would be so difficult to write a weblogin snippet to connect to an LDAP server instead.

http://www.devshed.com/c/a/PHP/Using-PHP-With-LDAP-part-1/

Thanks, I will study this page

Quote from: sottwell at Jul 16, 2008, 02:08 PM

And a module to manage it would not be any more difficult. Simply ignore the MODx web user system. I’m not refering to the group management system. You would need a way to specify which group the user belongs to, so perhaps some of the MODx web user management structure could be included. But the validation part, the password checking stuff, would go to the LDAP server instead of the the MODx tables. Same with registering a new user, the username and password would go to the LDAP server.

All that happens when a web user is validated is that a bunch of stuff is set up in the SESSION, it doesn’t care where it comes from. The various MODx user functions all refer to the SESSION anyway.

http://www.sottwell.com/article-sessions.html

Your page was very interesting - I was not aware that all these session variables were available. Though you might want to know that only the test/testing user works - I could not log in as guest/guestuser (incorrect name or password) (Edit: Having explored your site, I see that I need to do this in the back-end not the form on the page itself. Very nice site, by the way).

Quote from: sottwell at Jul 16, 2008, 02:08 PM

I would suspect that the same would apply to manager users; the roles and groups would stay with MODx, but the username/password validation would go to the LDAP server instead (onBeforeManagerLogin event).

Actually... looking at the events available to manager user handling and web user handling, it wouldn’t need any changes at all to the existing MODx user management, it just needs a single plugin to use the events to send the user data to the LDAP server, and if all goes well there, continue with the MODx processing; otherwise return to the MODx page with an error message. Hmmm... Interesting.

I had a look at the MODx user authentication code but it is wayyyyy beyond me ;-) Beyond that, I would need my other CMS (e.g. Moodle) to see the same groups as well so groups and other fields would have to come via LDAP also.

Thanks for taking the time to look into this, I appreciate the effort.

L