SimpleLDAP Version about simple-ldap-login

[jpuck]

@SamWantToBe I can confirm it works with multisite 4.7.2

If you really want to troubleshoot, note that errors are silenced by @ldap_bind on line 377 for the AD admin bind, and again during the actual user authentication on line 419. So you can un-squelch that ldap_bind and check your logs. Also, you might be able to get some more useful info from ldap_error

If that's not enough, then with xdebug installed you can set breakpoints in any IDE like Netbeans or PHPStorm and step through the execution line-by-line examining variable values to make sure they're what you expect.

Some common problems:

• php-ldap is not installed on the server
• SSL certificate is not trusted
• firewall
• AD user is not allowed to bind to LDAP server

[clifgriffin]

There weren't any major changes between 4.5.0 and 4.5.2 so you can assume it will work with any 4.5.x release.

[SamWantToBe]

This plug-in in not working at all. I have checked with the linux admin for settings. He insists this has nothing to do with the Admin end. He tells me its a problem with windows authentication. Is that correct? I have completed all the settings with linux Admin verification under the Simple Admin tab. I have selected to use it with Active Directory not Open Directory. I have a pile of users claiming they can't login. How can u help please

[clifgriffin]

Hi Sam,

SLL has over 3000 active installs. If you are having an issue logging in, it's because you have not configured the plugin correctly.

Clif

[SamWantToBe]

Hello Clifton, I still an not able to get the plugin to work on my multi-site for login. This is what I know so far... When I select strictly enforce AD authentication, I get a message that says it can't. Since that option is selected, it can't log me in. There is no log or message telling me why I can't authenticate against AD. I have tried numerous setting combinations in hope that maybe something would trigger it to work, but doesn't. Can you help me to determine how to get it to work? Or, should I post on the WordPress.org forum for the plugin? I would like to confirm that what I see on the plugin page is accurate, that the plugin is compatible with the latest version of WP (4.7.2). Thank you

…

On Mon, Jun 13, 2016 at 3:05 PM, Clifton Griffin ***@***.***> wrote: There weren't any major changes between 4.5.0 and 4.5.2 so you can assume it will work with any 4.5.x release. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#29 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe/AS8LMsdwd4YAZP22i2UiRGHL6KfcY8JFks5qLaoRgaJpZM4IzGUW> .

[SamWantToBe]

Hi Jeff, Thank you for the reply!! I dint think we're using SSL certificates yet. How can I tell for sure. I only manage Wordpress, not the systems that it runs on so I can't see that stuff. I need to be able to do some troubleshooting independently. The sys admin is not always available to answer questions Thanks Lisa Sent from my iPhone

…

On Feb 15, 2017, at 10:53 AM, Jeff Puckett ***@***.***> wrote: @SamWantToBe I can confirm it works with multisite 4.7.2 If you really want to troubleshoot, note that errors are silenced by @ldap_bind on line 377 for the AD admin bind, and again during the actual user authentication on line 419. So you can un-squelch that ldap_bind and check your logs. Also, you might be able to get some more useful info from ldap_error If that's not enough, then with xdebug installed you can set breakpoints in any IDE like Netbeans or PHPStorm and step through the execution line-by-line examining variable values to make sure they're what you expect. Some common problems: php-ldap is not installed on the server SSL certificate is not trusted firewall AD user is not allowed to bind to LDAP server — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[jpuck]

You'd better be using SSL on the wordpress web server, lest your users will be broadcasting their passwords across the internet in plain text for the whole world to see.

https://youtu.be/PdnpNJZVUE0

But my comment was about the certificate on the LDAP server. If it's not trusted by the web server, then the connection will fail to even initiate.

But none of this can be determined without server file system access. I suggest you get your own test server (you can get one from Amazon free for a year), install wordpress, and test it out. Otherwise, it's your sys admin's job to be the one troubleshooting this because all you can do is verify your settings are correct.

[SamWantToBe]

Hi Jeff, I agree about the system admin needing to do this work, but it doesn't work that way in this office. I hAve to figure out how to do it, and I'm not a system admin. It's frustrating for me. I appreciate your help. We do not us SSL. I am sure of it, but we will be doing it. How can I tell whether or not the certificate is trusted by web server? Sent from my iPhone

…

On Feb 15, 2017, at 9:32 PM, Jeff Puckett ***@***.***> wrote: You'd better be using SSL on the wordpress web server, lest your users will be broadcasting their passwords across the internet in plain text for the whole world to see. https://youtu.be/PdnpNJZVUE0 But my comment was about the certificate on the LDAP server. If it's not trusted by the web server, then the connection will fail to even initiate. But none of this can be determined without server file system access. I suggest you get your own test server (you can get one from Amazon free for a year), install wordpress, and test it out. Otherwise, it's your sys admin's job to be the one troubleshooting this because all you can do is verify your settings are correct. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[SamWantToBe]

What is your impression of MAMP as a web server? What web server at Amazon do I get?

…

Sent from my iPhone

On Feb 15, 2017, at 9:32 PM, Jeff Puckett ***@***.***> wrote: You'd better be using SSL on the wordpress web server, lest your users will be broadcasting their passwords across the internet in plain text for the whole world to see. https://youtu.be/PdnpNJZVUE0 But my comment was about the certificate on the LDAP server. If it's not trusted by the web server, then the connection will fail to even initiate. But none of this can be determined without server file system access. I suggest you get your own test server (you can get one from Amazon free for a year), install wordpress, and test it out. Otherwise, it's your sys admin's job to be the one troubleshooting this because all you can do is verify your settings are correct. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[clifgriffin]

MAMP is intended only for local development.

Honestly, Jeff is right. An experienced system administrator is a must.

That doesn't mean you can't figure it out...we all start somewhere. But the questions you are asking indicate that you have a steep learning curve ahead, and without experience it would be very easy for you to break things.

My guess based on your questions is that your website is currently on shared hosting like GoDaddy or Bluehost, in which case your site likely has no ability to communicate with your LDAP server. The proper arrangement would be to have your web server on the same network as your LDAP server, so that they can communicate over the private network.

Web traffic would then be served over the public network.

If I were in your shoes, I would advocate for your company to contract with a sys admin as you will likely need to rearchitect your network a bit to succeed here.

[SamWantToBe]

Hi Cliff Thanks for your help. The business is a university. We have a system admin department. The sentiment is that my assignment is to care for WordPress in all aspects. My department and sys admin dept don't work together that way. So the responsibility of doing the system admin work falls on my shoulders. I don't have access to the Apache stuff, only in a limited capacity. I need to find the problem and tell sys admin to fix it. I know it's crazy, but I need to work in this environment. So be it. I can tell you that your plugin used to work in our environment about 1.5 years ago, but we've had other admins that didn't take care of word press and it arrived to me in a broken condition. Can u suggest how I need to setup a certificate ? I can try to do it myself on our system. Thank u very much Respectfully Lisa Sent from my iPhone

…

On Feb 16, 2017, at 8:20 AM, Clifton Griffin ***@***.***> wrote: MAMP is intended only for local development. Honestly, Jeff is right. An experienced system administrator is a must. That doesn't mean you can't figure it out...we all start somewhere. But the questions you are asking indicate that you have a steep learning curve ahead, and without experience it would be very easy for you to break things. My guess based on your questions is that your website is currently on shared hosting like GoDaddy or Bluehost, in which case your site likely has no ability to communicate with your LDAP server. The proper arrangement would be to have your web server on the same network as your LDAP server, so that they can communicate over the private network. Web traffic would then be served over the public network. If I were in your shoes, I would advocate for your company to contract with a sys admin as you will likely need to rearchitect your network a bit to succeed here. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[clifgriffin]

@SamWantToBe I've actually never used TLS with SLL personally. I added in the feature based on requests, but I wouldn't be the right person to ask.

[SamWantToBe]

Hi Cliff, If I send pics of the way I setup simple ldap plugin, would you be able to review them to see if there is something not set correctly? (Not expecting you to verify domain servers,etc) We have users with different suffix login so we leave suffix blank. Thanks

…

Sent from my iPhone

[SamWantToBe]

Hi Cliff, What is the difference on the simple tab for the LDAP setting between Active Directory and Open LDAP. How do I choose between the two? I need to authenticate against AD through LDAP. What am I not understanding please? Thank u

…

Sent from my iPhone Begin forwarded message:

From: Lisa Digregorio ***@***.***> Date: February 27, 2017 at 10:50:04 AM EST To: ***@***.*** Subject: Verify settings Hi Cliff, If I send pics of the way I setup simple ldap plugin, would you be able to review them to see if there is something not set correctly? (Not expecting you to verify domain servers,etc) We have users with different suffix login so we leave suffix blank. Thanks Sent from my iPhone

[SamWantToBe]

Hello I tried squelching the '@' at lines 377 and 419. There was nothing in the Apache error or access log files. There was nothing in Wordpress debug file. When I login using simple ldap, I get error message on main site login page that says username, password or email address is incorrect. That's it Where am I to look for the errors messages please?

…

Sent from my iPhone

On Feb 15, 2017, at 10:53 AM, Jeff Puckett ***@***.***> wrote: @SamWantToBe I can confirm it works with multisite 4.7.2 If you really want to troubleshoot, note that errors are silenced by @ldap_bind on line 377 for the AD admin bind, and again during the actual user authentication on line 419. So you can un-squelch that ldap_bind and check your logs. Also, you might be able to get some more useful info from ldap_error If that's not enough, then with xdebug installed you can set breakpoints in any IDE like Netbeans or PHPStorm and step through the execution line-by-line examining variable values to make sure they're what you expect. Some common problems: php-ldap is not installed on the server SSL certificate is not trusted firewall AD user is not allowed to bind to LDAP server — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[SamWantToBe]

Hi Cliff, Just thought of something else. On the main ws.gc.cuny.edu page there is a sidebar login into which Id/pw gets entered. That's a widget. You can see what was installed here: HTTPS://Wordpress.org/plugins/sidebar-logins/screenshots/ How does your program get the info from the widget? What do I look for to see if your program is picking up the Id/pw? Thanks

[SamWantToBe]

Hi Cliff. I have a question. It seems simple ldap login is not meant to function as a plugin where users enter their Id/pw to login. There's no front end for that. Right? So we used a widget(simple sidebar login) for users to enter login credentials and click the button login. Does your program provide code to collect credentials from a front end widget to authenticate them? There's no documentation on your site in how to "hook up" your plugin to a front end. So how does your plugin collect the info it needs to authenticate against? Thanks for all your help. It's very much appreciated!!!

…

Sent from my iPhone

On Feb 15, 2017, at 10:53 AM, Jeff Puckett ***@***.***> wrote: @SamWantToBe I can confirm it works with multisite 4.7.2 If you really want to troubleshoot, note that errors are silenced by @ldap_bind on line 377 for the AD admin bind, and again during the actual user authentication on line 419. So you can un-squelch that ldap_bind and check your logs. Also, you might be able to get some more useful info from ldap_error If that's not enough, then with xdebug installed you can set breakpoints in any IDE like Netbeans or PHPStorm and step through the execution line-by-line examining variable values to make sure they're what you expect. Some common problems: php-ldap is not installed on the server SSL certificate is not trusted firewall AD user is not allowed to bind to LDAP server — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[SamWantToBe]

Sorry Widget is called sidebar login

…

Sent from my iPhone Begin forwarded message:

From: Lisa Digregorio ***@***.***> Date: February 28, 2017 at 4:46:31 AM EST To: clifgriffin/simple-ldap-login ***@***.***> Subject: Re: [clifgriffin/simple-ldap-login] SimpleLDAP Version (#29) Hi Cliff. I have a question. It seems simple ldap login is not meant to function as a plugin where users enter their Id/pw to login. There's no front end for that. Right? So we used a widget(simple sidebar login) for users to enter login credentials and click the button login. Does your program provide code to collect credentials from a front end widget to authenticate them? There's no documentation on your site in how to "hook up" your plugin to a front end. So how does your plugin collect the info it needs to authenticate against? Thanks for all your help. It's very much appreciated!!! Sent from my iPhone > On Feb 15, 2017, at 10:53 AM, Jeff Puckett ***@***.***> wrote: > > @SamWantToBe I can confirm it works with multisite 4.7.2 > > If you really want to troubleshoot, note that errors are silenced by @ldap_bind on line 377 for the AD admin bind, and again during the actual user authentication on line 419. So you can un-squelch that ldap_bind and check your logs. Also, you might be able to get some more useful info from ldap_error > > If that's not enough, then with xdebug installed you can set breakpoints in any IDE like Netbeans or PHPStorm and step through the execution line-by-line examining variable values to make sure they're what you expect. > > Some common problems: > > php-ldap is not installed on the server > SSL certificate is not trusted > firewall > AD user is not allowed to bind to LDAP server > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub, or mute the thread. >

[jpuck]

@SamWantToBe the plugin uses wordpress's native login screen. there is no additional front-end component.

[SamWantToBe]

Hello I know u guys help me a lot!!! I am grateful for that!!! It's a big help. Do u think u could answer this one as I'm new to all this and need some guidance from experts please Where does your code write the error messages? I will look there. Thanks for all

…

Sent from my iPhone Begin forwarded message:

From: Lisa Digregorio ***@***.***> Date: February 27, 2017 at 12:47:20 PM EST To: clifgriffin/simple-ldap-login ***@***.***> Subject: Re: [clifgriffin/simple-ldap-login] SimpleLDAP Version (#29) Hello I tried squelching the '@' at lines 377 and 419. There was nothing in the Apache error or access log files. There was nothing in Wordpress debug file. When I login using simple ldap, I get error message on main site login page that says username, password or email address is incorrect. That's it Where am I to look for the errors messages please? Sent from my iPhone > On Feb 15, 2017, at 10:53 AM, Jeff Puckett ***@***.***> wrote: > > @SamWantToBe I can confirm it works with multisite 4.7.2 > > If you really want to troubleshoot, note that errors are silenced by @ldap_bind on line 377 for the AD admin bind, and again during the actual user authentication on line 419. So you can un-squelch that ldap_bind and check your logs. Also, you might be able to get some more useful info from ldap_error > > If that's not enough, then with xdebug installed you can set breakpoints in any IDE like Netbeans or PHPStorm and step through the execution line-by-line examining variable values to make sure they're what you expect. > > Some common problems: > > php-ldap is not installed on the server > SSL certificate is not trusted > firewall > AD user is not allowed to bind to LDAP server > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub, or mute the thread. >

[jpuck]

@SamWantToBe I'm not really familiar with the code base, but as far as I know it doesn't have any special logging capabilities. so all logging defers to the server's php.ini settings - which could be different for everyone. for example, on an Ubuntu server running the default Apache virtual host installed through Canonical's official package repositories, you could find the logs under /var/log/apache2/error.log and /var/log/apache2/access.log but by default these files require either sudo or membership in the adm group to access. you mentioned earlier that you removed the @ which should have allowed any errors to be logged, so I'm not sure what logs you checked considering you mentioned that you didn't have shell access to the host machine. in general, server logs are sensitive, so this is something to which your system administrator will have to grant you access.

[SamWantToBe]

Thank u so much

…

Sent from my iPhone

On Mar 2, 2017, at 12:06 PM, Jeff Puckett ***@***.***> wrote: @SamWantToBe I'm not really familiar with the code base, but as far as I know it doesn't have any special logging capabilities. so all logging defers to the server's php.ini settings - which could be different for everyone. for example, on an Ubuntu server running the default Apache virtual host installed through Canonical's official package repositories, you could find the logs under /var/log/apache2/error.log and /var/log/apache2/access.log but by default these files require either sudo or membership in the adm group to access. you mentioned earlier that you removed the @ which should have allowed any errors to be logged, so I'm not sure what logs you checked considering you mentioned that you didn't have shell access to the host machine. in general, server logs are sensitive, so this is something to which your system administrator will have to grant you access. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[jpuck]

@SamWantToBe I was just thinking about you as I was updating some of our documentation for using this plugin. If you're still having problems, then maybe this could help.

[SamWantToBe]

Hi Jeff Thank u!! Can I take a look at my boss' question? It would be a big help! My boss wants to know: In addition, I do have one question about the field under Advanced tab labeled: “LDAP Exclusive” … since we do have both GC and non-GC people logging in, if LDAP is being forced, what happens to non-LDAP authenticated users? I can only assume that this really means… “Users will be forced to authenticate against LDAP FIRST and if that fails they will be authenticated locally SECOND”. Can you confirm this is accuate?

…

Sent from my iPhone

On Mar 9, 2017, at 11:22 AM, Jeff Puckett ***@***.***> wrote: @SamWantToBe I was just thinking about you as I was updating some of our documentation for using this plugin. If you're still having problems, then maybe this could help. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[jpuck]

@SamWantToBe leave the box unchecked. If you check that box, then non-ldap users will not be able to login.

[SamWantToBe]

Hi Jeff I just want to be clear. When I chose exclusive ldap, the plugin will check against AD and will NOT check against the WP database ever. The check is against ldap and only ldap. Correct? Thanks, Lisa

…

Sent from my iPhone

On Mar 9, 2017, at 2:12 PM, Jeff Puckett ***@***.***> wrote: @SamWantToBe leave the box unchecked. If you check that box, then non-ldap users will not be able to login. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[clifgriffin]

That is correct! On March 9, 2017 at 3:11:50 PM, SamWantToBe ([email protected]) wrote: Hi Jeff I just want to be clear. When I chose exclusive ldap, the plugin will check against AD and will NOT check against the WP database ever. The check is against ldap and only ldap. Correct? Thanks, Lisa

Sent from my iPhone

On Mar 9, 2017, at 2:12 PM, Jeff Puckett ***@***.***> wrote: @SamWantToBe leave the box unchecked. If you check that box, then

non-ldap users will not be able to login.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

— You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#29 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AApo2fhgznO6fMKuHLoEj_NIzvHxxhsxks5rkF0GgaJpZM4IzGUW> .

[SamWantToBe]

// log php errors @ini_set('log_errors','On'); // enable or disable php error logging (use 'On' or 'Off') @ini_set('display_errors','Off'); // enable or disable public display of errors (use 'On' or 'Off') @ini_set('error_log','/home/path/logs/php-errors.log'); // path to server-writable log file Hi I put the above code in my wp-config file cause I had to keep a custom php log file. I followed #1 on this page: https://digwp.com/2009/07/monitor-php-errors-wordpress/ The server is not logging php errors by the php.ini file I tried to trigger an error using your plugin and I commented the two lines u suggested I uncomment and I don't get any error messAges written to log file Can u tell me how I can to trigger the code in the wp-config so I write to custom php log file please?

[SamWantToBe]

Hi Clifton Our login Is still not working. I installed and configured xdebug and phpstorm. I am going to trace the login variables in simple ldap login. What r those variable that contain the login credentials please? I need to trace them through all the once once credentials entered Thank u

…

Sent from my iPhone

On Mar 9, 2017, at 3:14 PM, Clifton Griffin ***@***.***> wrote: That is correct! On March 9, 2017 at 3:11:50 PM, SamWantToBe ***@***.***) wrote: Hi Jeff I just want to be clear. When I chose exclusive ldap, the plugin will check against AD and will NOT check against the WP database ever. The check is against ldap and only ldap. Correct? Thanks, Lisa Sent from my iPhone > On Mar 9, 2017, at 2:12 PM, Jeff Puckett ***@***.***> wrote: > > @SamWantToBe leave the box unchecked. If you check that box, then non-ldap users will not be able to login. > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub, or mute the thread. > — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#29 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AApo2fhgznO6fMKuHLoEj_NIzvHxxhsxks5rkF0GgaJpZM4IzGUW> . — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[SamWantToBe]

I'm getting this error. Can u please help me?

…

[15-May-2017 20:11:44 UTC] PHP Notice: Undefined variable: version in /var/www/html/ws/wp-content/plugins/simple-ldap-login/Simple-LDAP-Login.php on line 54 [15-May-2017 20:11:44 UTC] PHP Stack trace: [15-May-2017 20:11:44 UTC] PHP 1. {main}() /var/www/html/ws/wp-admin/admin-ajax.php:0 [15-May-2017 20:11:44 UTC] PHP 2. require_once() /var/www/html/ws/wp-admin/admin-ajax.php:22 [15-May-2017 20:11:44 UTC] PHP 3. require_once() /var/www/html/ws/wp-load.php:37 [15-May-2017 20:11:44 UTC] PHP 4. require_once() /var/www/html/ws/wp-config.php:119 [15-May-2017 20:11:44 UTC] PHP 5. include_once() /var/www/html/ws/wp-settings.php:269 [15-May-2017 20:11:44 UTC] PHP 6. SimpleLDAPLogin::getInstance() /var/www/html/ws/wp-content/plugins/simple-ldap-login/Simple-LDAP-Login.php:563 [15-May-2017 20:11:44 UTC] PHP 7. SimpleLDAPLogin->__construct() /var/www/html/ws/wp-content/plugins/simple-ldap-login/Simple-LDAP-Login.php:61

[SamWantToBe]

Finally got some data. Took your suggestion to get xdebug and phpstorm. These r variables as debug the sidebar login plugin that's used as login to your simple ldap login. I have some question. Can u help me answer them? Thank u trying really hard to use this plugin

…

Subject: debugging sidebar-login & simple ldap login There are 7 instances of simple ldap login running . Why? Why is ldap = null? Why is login_domain = “gc.cuny.edu\\\\\\\\”