Question

I'm trying to setup a twiki that uses transparent Windows authentication and auto-populates the registration screen with a few basic fields through and LDAP query off of an Active Directory server.

I have the transparent authentication working using the Apache mod_ntlm 1.3 module and have % REMOTE_USER % showing up as domain\username. Great!

I have the LdapPlugin installed and showing up as an activated plugin but when I put a command in my personal test page such as %LDAP{host="corp-dc01.xxxxxxxxxx.yyy" base="DC=xxxxxxxxxx,DC=yyy" filter="sn=Woerth" format="$fullName"}% it keeps returing "LDAP Query Returned Zero Records [Filter=sn=Woerth]". My first guess is that you can't do anonymous queries against AD so if that's my problem, where do I set the DN to connect with?

I have these errors in the Apache log file: [Wed Nov 30 16:20:30 2005] [notice] cannot use a full URL in a 401 ErrorDocument directive --- ignoring!

[Wed Nov 30 16:20:30 2005] [notice] cannot use a full URL in a 401 ErrorDocument directive --- ignoring!

[Wed Nov 30 16:20:30 2005] [notice] cannot use a full URL in a 401 ErrorDocument directive --- ignoring!

[Wed Nov 30 16:20:32 2005] [error] [client 10.122.21.147] [Wed Nov 30 16:20:32 2005] c:\\twiki\\bin\\view: Use of uninitialized value in substitution (s///) at ../lib/TWiki/Plugins/LdapPlugin.pm line 50.\n

[Wed Nov 30 16:20:32 2005] [error] [client 10.122.21.147] [Wed Nov 30 16:20:32 2005] c:\\twiki\\bin\\view: Use of uninitialized value in substitution (s///) at ../lib/TWiki/Plugins/LdapPlugin.pm line 51.\n

[Wed Nov 30 16:20:32 2005] [error] [client 10.122.21.147] [Wed Nov 30 16:20:32 2005] c:\\twiki\\bin\\view: Use of uninitialized value in substitution (s///) at ../lib/TWiki/Plugins/LdapPlugin.pm line 52.\n

Thanks!

Environment

-- RyanWoerth - 30 Nov 2005

Answer

The LDAP plugin doesn't do bind - if your AD requires authentication you need to add a bit of code.

To check whether your AD does allow anonymous binding you can use ldapsearch from the openldap package for cygwin. Try the same query as with the plugin, and then add -D yourDN -w yourPassword.

BTW: If you have authenticated users but possibly more than one with the same surnames, you might want to filter on samAccountName, which is the windows username. AD has quite a couple of values derived from the username...

-- HaraldJoerg - 30 Nov 2005

Try LdapContrib

-- SibiJoseph - 20 Mar 2007