I think these should be optional. In the first release of this code, the optional/required tag on these fields was blank.
$this->addCheck(
new FormValidator(
$this,
'ldapBindUser',
'',
'plugins.generic.ldap.manager.settings.ldapBindUserRequired'
)
);
$this->addCheck(
new FormValidator(
$this,
'ldapBindPassword',
'',
'plugins.generic.ldap.manager.settings.ldapBindPasswordRequired'
)
);
This may lead to unexpected results.
In the update that was just merged in last night, these have more robust checking:
$this->addCheck(
new FormValidatorCustom(
$this,
'ldapBindUser',
FORM_VALIDATOR_OPTIONAL_VALUE,
'plugins.generic.ldap.manager.settings.ldapBindUserRequired',
array(&$this, '_canBindAnonymous')
)
);
$this->addCheck(
new FormValidatorCustom(
$this,
'ldapBindPassword',
FORM_VALIDATOR_REQUIRED_VALUE,
'plugins.generic.ldap.manager.settings.ldapBindPasswordRequired',
array(&$this, '_canBindCredentialed')
)
);
If not provided, we try to confirm an anonymous bind against the server. If provided, we try to perform a bind against the server with these credentials.
Can you try the latest code to see if this resolves your issue?
njn315
July 16, 2019, 1:17pm
43
I pulled down the latest code and now it’s allowing me to leave those fields blank and ldap is working for me. Thanks. One thing I noticed is that if a wrong password is entered, then it doesn’t notify the user that they typed an incorrect password. Instead, it redirects to the home page of the journal without logging the user in.
I agree. This isn’t desirable UX. I’ve opened a new issue here:
opened 01:21PM - 16 Jul 19 UTC
closed 12:40AM - 18 Jul 19 UTC
C.f.: https://forum.pkp.sfu.ca/t/ojs3-ldap-plugin/27915/43?u=ctgraham
> One thi… ng I noticed is that if a wrong password is entered, then it doesn’t notify the user that they typed an incorrect password. Instead, it redirects to the home page of the journal without logging the user in.
@njn315 , can you test the changes in this branch (extend-login-handler)?
https://github.com/ulsdevteam/ojs_ldap_plugin/tree/extend-login-handler
I’ve proposed it as a pull request to the plugin.
njn315
July 16, 2019, 2:34pm
46
Looks good. I’m getting the invalid username or password message when I type an incorrect password and it logs me in when I type a correct password. Thanks!
Would it be possible to make the LDAP Self Service field optional as well? If I set it to our LDAP self-service URL, then users with local non-LDAP accounts won’t be able to reset their passwords.
Yes, I think this should be a part of this issue:
opened 05:38PM - 11 Jul 19 UTC
closed 02:38AM - 24 Jul 19 UTC
Depending on the configuration, we may want to call the local authentication bef… ore the LDAP call (e.g. most accounts are local), after the LDAP call (e.g. most accounts are LDAP), or never (e.g. all accounts must be LDAP).
We can add this as an option in the settings form.
I’m confused, I just updated my plugin with the latest changes made and every time I configure it with my LDAP server data these are not saved. When I click on Settings, everything is blank. What will I be doing wrong? Still have to have more than one magazine to be able to use it?
Another question: Is it possible to have users authenticate against the LDAP server and at the same time have others to authenticate against our own OJS database?
Please help me
In the current master branch of shemgp/ojs_ldap_plugin , the intent is to allow the plugin to be configured either at the site level (for all journals) or at the journal level (if not configured at the site level). You should not need a second journal to complete this configuration. If only one journal is present, the plugin is automatically configured at the site level.
Additionally, in the current master branch, if the username does not match an existing user identifier within LDAP, the credentials are tried against OJS’s internal authentication mechanism. In my latest proposed changes, this goes a step further to try the credentials against LDAP first, and then fallback against OJS’s internal authentication, so if a username exists in LDAP and OJS authentication is possible via either.
Ok, @ctgraham I get it. Now, why when I put the configuration (in Settings) does not save the changes? What will I be doing wrong?
Can you describe more about this scenario? Do you have a single journal install or multijournal install? What is the current version of the plugin (git commit if you can find it, or exactly when downloaded from github)? Do you see any error messages?
OK. I have a single journal, OJS 3.1.2. I downloaded the plugin from:
GitHub - shemgp/ojs_ldap_plugin: LDAP Authorization Plugin for OJS .
I do not see any error
I think I see the problem here. Working on it.
1 Like
ok @ctgraham , I’m going to try it and then I’ll tell you the results
Well @ctgraham , I just tried it and the problem persists, it does not save the changes. Here I leave the errors that appear in php_error.log, they come out when I click on Settings:
[18-Jul-2019 14:56:01 UTC] PHP Warning: Declaration of CustomBlockPlugin::getBlockContext() should be compatible with BlockPlugin::getBlockContext($contextId = NULL) in C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockPlugin.inc.php on line 0
[18-Jul-2019 14:56:01 UTC] PHP Stack trace:
[18-Jul-2019 14:56:01 UTC] PHP 1. {main}() C:\wamp64\www\ojs-3.1.2\index.php:0
[18-Jul-2019 14:56:01 UTC] PHP 2. Application->execute() C:\wamp64\www\ojs-3.1.2\index.php:68
[18-Jul-2019 14:56:01 UTC] PHP 3. Dispatcher->dispatch() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPApplication.inc.php:252
[18-Jul-2019 14:56:01 UTC] PHP 4. PluginRegistry::loadCategory() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\Dispatcher.inc.php:132
[18-Jul-2019 14:56:01 UTC] PHP 5. PluginRegistry::register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:138
[18-Jul-2019 14:56:01 UTC] PHP 6. CustomBlockManagerPlugin->register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:65
[18-Jul-2019 14:56:01 UTC] PHP 7. CustomBlockManagerPlugin->import() C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockManagerPlugin.inc.php:45
[18-Jul-2019 14:56:01 UTC] PHP Warning: Declaration of DatesPlugin::register($category, $path) should be compatible with LazyLoadPlugin::register($category, $path, $mainContextId = NULL) in C:\wamp64\www\ojs-3.1.2\plugins\generic\dates\DatesPlugin.inc.php on line 0
[18-Jul-2019 14:56:01 UTC] PHP Stack trace:
[18-Jul-2019 14:56:01 UTC] PHP 1. {main}() C:\wamp64\www\ojs-3.1.2\index.php:0
[18-Jul-2019 14:56:01 UTC] PHP 2. Application->execute() C:\wamp64\www\ojs-3.1.2\index.php:68
[18-Jul-2019 14:56:01 UTC] PHP 3. Dispatcher->dispatch() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPApplication.inc.php:252
[18-Jul-2019 14:56:01 UTC] PHP 4. PKPComponentRouter->route() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\Dispatcher.inc.php:134
[18-Jul-2019 14:56:01 UTC] PHP 5. PKPComponentRouter->_authorizeInitializeAndCallRequest() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPComponentRouter.inc.php:257
[18-Jul-2019 14:56:01 UTC] PHP 6. SettingsPluginGridHandler->authorize() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPRouter.inc.php:382
[18-Jul-2019 14:56:01 UTC] PHP 7. SettingsPluginGridHandler->authorize() C:\wamp64\www\ojs-3.1.2\controllers\grid\settings\plugins\SettingsPluginGridHandler.inc.php:92
[18-Jul-2019 14:56:01 UTC] PHP 8. SettingsPluginGridHandler->authorize() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\controllers\grid\GridHandler.inc.php:572
[18-Jul-2019 14:56:01 UTC] PHP 9. AuthorizationDecisionManager->decide() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\handler\PKPHandler.inc.php:299
[18-Jul-2019 14:56:01 UTC] PHP 10. AuthorizationDecisionManager->_decidePolicySet() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\security\authorization\AuthorizationDecisionManager.inc.php:125
[18-Jul-2019 14:56:01 UTC] PHP 11. AuthorizationDecisionManager->_decidePolicySet() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\security\authorization\AuthorizationDecisionManager.inc.php:204
[18-Jul-2019 14:56:01 UTC] PHP 12. PluginRequiredPolicy->effect() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\security\authorization\AuthorizationDecisionManager.inc.php:196
[18-Jul-2019 14:56:01 UTC] PHP 13. PluginRegistry::loadCategory() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\security\authorization\internal\PluginRequiredPolicy.inc.php:44
[18-Jul-2019 14:56:01 UTC] PHP 14. PluginRegistry::_instantiatePlugin() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:122
[18-Jul-2019 14:56:01 UTC] PHP 15. include() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:233
[18-Jul-2019 14:56:02 UTC] PHP Warning: ldap_start_tls(): Unable to start TLS: Protocol error in C:\wamp64\www\ojs-3.1.2\plugins\generic\ldap\LDAPAuthPlugin.inc.php on line 287
[18-Jul-2019 14:56:02 UTC] PHP Stack trace:
[18-Jul-2019 14:56:02 UTC] PHP 1. {main}() C:\wamp64\www\ojs-3.1.2\index.php:0
[18-Jul-2019 14:56:02 UTC] PHP 2. Application->execute() C:\wamp64\www\ojs-3.1.2\index.php:68
[18-Jul-2019 14:56:02 UTC] PHP 3. Dispatcher->dispatch() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPApplication.inc.php:252
[18-Jul-2019 14:56:02 UTC] PHP 4. PKPComponentRouter->route() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\Dispatcher.inc.php:134
[18-Jul-2019 14:56:02 UTC] PHP 5. PKPComponentRouter->_authorizeInitializeAndCallRequest() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPComponentRouter.inc.php:257
[18-Jul-2019 14:56:02 UTC] PHP 6. SettingsPluginGridHandler->manage() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPRouter.inc.php:390
[18-Jul-2019 14:56:02 UTC] PHP 7. LDAPAuthPlugin->manage() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\controllers\grid\plugins\PluginGridHandler.inc.php:234
[18-Jul-2019 14:56:02 UTC] PHP 8. LDAPSettingsForm->validate() C:\wamp64\www\ojs-3.1.2\plugins\generic\ldap\LDAPAuthPlugin.inc.php:119
[18-Jul-2019 14:56:02 UTC] PHP 9. FormValidatorCustom->isValid() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\form\Form.inc.php:260
[18-Jul-2019 14:56:02 UTC] PHP 10. LDAPSettingsForm->_canBindCredentialed() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\form\validation\FormValidatorCustom.inc.php:61
[18-Jul-2019 14:56:02 UTC] PHP 11. LDAPAuthPlugin->_getLdapResource() C:\wamp64\www\ojs-3.1.2\plugins\generic\ldap\LDAPSettingsForm.inc.php:215
[18-Jul-2019 14:56:02 UTC] PHP 12. ldap_start_tls() C:\wamp64\www\ojs-3.1.2\plugins\generic\ldap\LDAPAuthPlugin.inc.php:287
[18-Jul-2019 14:56:02 UTC] PHP Warning: Declaration of CustomBlockPlugin::getBlockContext() should be compatible with BlockPlugin::getBlockContext($contextId = NULL) in C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockPlugin.inc.php on line 0
[18-Jul-2019 14:56:02 UTC] PHP Stack trace:
[18-Jul-2019 14:56:02 UTC] PHP 1. {main}() C:\wamp64\www\ojs-3.1.2\index.php:0
[18-Jul-2019 14:56:02 UTC] PHP 2. Application->execute() C:\wamp64\www\ojs-3.1.2\index.php:68
[18-Jul-2019 14:56:02 UTC] PHP 3. Dispatcher->dispatch() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPApplication.inc.php:252
[18-Jul-2019 14:56:02 UTC] PHP 4. PluginRegistry::loadCategory() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\Dispatcher.inc.php:132
[18-Jul-2019 14:56:02 UTC] PHP 5. PluginRegistry::register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:138
[18-Jul-2019 14:56:02 UTC] PHP 6. CustomBlockManagerPlugin->register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:65
[18-Jul-2019 14:56:02 UTC] PHP 7. CustomBlockManagerPlugin->import() C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockManagerPlugin.inc.php:45
[18-Jul-2019 14:56:03 UTC] PHP Warning: Declaration of CustomBlockPlugin::getBlockContext() should be compatible with BlockPlugin::getBlockContext($contextId = NULL) in C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockPlugin.inc.php on line 0
[18-Jul-2019 14:56:03 UTC] PHP Stack trace:
[18-Jul-2019 14:56:03 UTC] PHP 1. {main}() C:\wamp64\www\ojs-3.1.2\index.php:0
[18-Jul-2019 14:56:03 UTC] PHP 2. Application->execute() C:\wamp64\www\ojs-3.1.2\index.php:68
[18-Jul-2019 14:56:03 UTC] PHP 3. Dispatcher->dispatch() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPApplication.inc.php:252
[18-Jul-2019 14:56:03 UTC] PHP 4. PluginRegistry::loadCategory() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\Dispatcher.inc.php:132
[18-Jul-2019 14:56:03 UTC] PHP 5. PluginRegistry::register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:138
[18-Jul-2019 14:56:03 UTC] PHP 6. CustomBlockManagerPlugin->register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:65
[18-Jul-2019 14:56:03 UTC] PHP 7. CustomBlockManagerPlugin->import() C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockManagerPlugin.inc.php:45
[18-Jul-2019 14:56:15 UTC] PHP Warning: Declaration of CustomBlockPlugin::getBlockContext() should be compatible with BlockPlugin::getBlockContext($contextId = NULL) in C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockPlugin.inc.php on line 0
[18-Jul-2019 14:56:15 UTC] PHP Stack trace:
[18-Jul-2019 14:56:15 UTC] PHP 1. {main}() C:\wamp64\www\ojs-3.1.2\index.php:0
[18-Jul-2019 14:56:15 UTC] PHP 2. Application->execute() C:\wamp64\www\ojs-3.1.2\index.php:68
[18-Jul-2019 14:56:15 UTC] PHP 3. Dispatcher->dispatch() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPApplication.inc.php:252
[18-Jul-2019 14:56:15 UTC] PHP 4. PluginRegistry::loadCategory() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\Dispatcher.inc.php:132
[18-Jul-2019 14:56:15 UTC] PHP 5. PluginRegistry::register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:138
[18-Jul-2019 14:56:15 UTC] PHP 6. CustomBlockManagerPlugin->register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:65
[18-Jul-2019 14:56:15 UTC] PHP 7. CustomBlockManagerPlugin->import() C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockManagerPlugin.inc.php:45
[18-Jul-2019 14:56:15 UTC] PHP Warning: Declaration of DatesPlugin::register($category, $path) should be compatible with LazyLoadPlugin::register($category, $path, $mainContextId = NULL) in C:\wamp64\www\ojs-3.1.2\plugins\generic\dates\DatesPlugin.inc.php on line 0
[18-Jul-2019 14:56:15 UTC] PHP Stack trace:
[18-Jul-2019 14:56:15 UTC] PHP 1. {main}() C:\wamp64\www\ojs-3.1.2\index.php:0
[18-Jul-2019 14:56:15 UTC] PHP 2. Application->execute() C:\wamp64\www\ojs-3.1.2\index.php:68
[18-Jul-2019 14:56:15 UTC] PHP 3. Dispatcher->dispatch() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPApplication.inc.php:252
[18-Jul-2019 14:56:15 UTC] PHP 4. PKPComponentRouter->route() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\Dispatcher.inc.php:134
[18-Jul-2019 14:56:15 UTC] PHP 5. PKPComponentRouter->_authorizeInitializeAndCallRequest() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPComponentRouter.inc.php:257
[18-Jul-2019 14:56:15 UTC] PHP 6. SettingsPluginGridHandler->authorize() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPRouter.inc.php:382
[18-Jul-2019 14:56:15 UTC] PHP 7. SettingsPluginGridHandler->authorize() C:\wamp64\www\ojs-3.1.2\controllers\grid\settings\plugins\SettingsPluginGridHandler.inc.php:92
[18-Jul-2019 14:56:15 UTC] PHP 8. SettingsPluginGridHandler->authorize() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\controllers\grid\GridHandler.inc.php:572
[18-Jul-2019 14:56:15 UTC] PHP 9. AuthorizationDecisionManager->decide() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\handler\PKPHandler.inc.php:299
[18-Jul-2019 14:56:15 UTC] PHP 10. AuthorizationDecisionManager->_decidePolicySet() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\security\authorization\AuthorizationDecisionManager.inc.php:125
[18-Jul-2019 14:56:15 UTC] PHP 11. AuthorizationDecisionManager->_decidePolicySet() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\security\authorization\AuthorizationDecisionManager.inc.php:204
[18-Jul-2019 14:56:15 UTC] PHP 12. PluginRequiredPolicy->effect() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\security\authorization\AuthorizationDecisionManager.inc.php:196
[18-Jul-2019 14:56:15 UTC] PHP 13. PluginRegistry::loadCategory() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\security\authorization\internal\PluginRequiredPolicy.inc.php:44
[18-Jul-2019 14:56:15 UTC] PHP 14. PluginRegistry::_instantiatePlugin() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:122
[18-Jul-2019 14:56:15 UTC] PHP 15. include() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:233
[18-Jul-2019 14:56:16 UTC] PHP Warning: Declaration of CustomBlockPlugin::getBlockContext() should be compatible with BlockPlugin::getBlockContext($contextId = NULL) in C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockPlugin.inc.php on line 0
[18-Jul-2019 14:56:16 UTC] PHP Stack trace:
[18-Jul-2019 14:56:16 UTC] PHP 1. {main}() C:\wamp64\www\ojs-3.1.2\index.php:0
[18-Jul-2019 14:56:16 UTC] PHP 2. Application->execute() C:\wamp64\www\ojs-3.1.2\index.php:68
[18-Jul-2019 14:56:16 UTC] PHP 3. Dispatcher->dispatch() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\PKPApplication.inc.php:252
[18-Jul-2019 14:56:16 UTC] PHP 4. PluginRegistry::loadCategory() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\core\Dispatcher.inc.php:132
[18-Jul-2019 14:56:16 UTC] PHP 5. PluginRegistry::register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:138
[18-Jul-2019 14:56:16 UTC] PHP 6. CustomBlockManagerPlugin->register() C:\wamp64\www\ojs-3.1.2\lib\pkp\classes\plugins\PluginRegistry.inc.php:65
[18-Jul-2019 14:56:16 UTC] PHP 7. CustomBlockManagerPlugin->import() C:\wamp64\www\ojs-3.1.2\plugins\generic\customBlockManager\CustomBlockManagerPlugin.inc.php:45
The warning
PHP Warning: ldap_start_tls(): Unable to start TLS: Protocol error in C:\wamp64\www\ojs-3.1.2\plugins\generic\ldap\LDAPAuthPlugin.inc.php on line 287
Indicates that your credentials would be transmitted unencrypted between OJS and the LDAP server, which is not secure. This shouldn’t, however, prevent the plugin from working.
When you try to save the settings, does the form go away, does it return with a message, or does it stay in place with no change? The plugin will try to make a connection with LDAP when saving the form, and it should report an error if that connection fails.
The form disappears and shows no error. I know that the connection between the LDAP and the OJS is not secure but it is like that, under those conditions the plugin does not work?
please help me
I would expect the plugin to work (with that warning logged) even if the connection was not sure.
shemgp has updated the code with some new commits, and I see that my branch included a subset of them. Can you test the latest master
code from:
?
ok, I’ll try it again and I’ll tell you later
Well, It lets me save the data, but it does not let me log in, and the error is still:
PHP Warning: ldap_start_tls(): Unable to start TLS: Protocol error
Can not implement the plugin for a non-secure connection? I know it’s not the right thing but it would be another test to be done …
What do you think?