Howto: Active Directory + LDAP Authentication

I'm posting this for the benefit of anyone else running into problems with hooking into AD/LDAP. We have this setup running on Win2k3 and now Win2k8 AD servers with LDAP providers. Configuring that part of the equation is up to you.

Additions to activecollab/config/config.php:

define('AUTH_PROVIDER', 'ActiveDirectoryAuthenticationProvider');
define('AUTH_AD_ACCOUNT_SUFFIX','@ldap.server.com');
define('AUTH_AD_EMAIL_SUFFIX','@ldap.server.com');
define('AUTH_AD_BIND_USERNAME', 'authdummy');
define('AUTH_AD_BIND_PASSWORD', 'dummypassword');
define('AUTH_AD_BASE_DN', 'CN=Developers,ou=Apache,dc=server,dc=com?sAMAccountName');
define('AUTH_AD_DOMAIN_CONTROLLER','ldap://ldap.server.com');
define('AUTH_AD_REAL_PRIMARYGROUP', true);
define('AUTH_AD_USE_SSL', false);
define('AUTH_AD_RECURSIVE_GROUPS', true);
define('AUTH_AD_USERADD_AUTO', true);
define('AUTH_AD_USERADD_ROLE_ID', 0);
define('AUTH_AD_USERADD_COMPANY_ID', 0);

Note the use of a dummy account which is required to iterate LDAP. We are using a Developers CN in Apache OU (YMMV)

Changes to activecollab/activecollab/angie/classes/auth/providers/LDAPAuthenticationProvider.class.php:

    function authenticate($credentials) {
      $email    = array_var($credentials, 'authdummy@ldap.server.com');
      $password = array_var($credentials, 'dummypassword');
      $remember = (boolean) array_var($credentials, 'remember', false);
      $user = Users::findByEmail($email);
                $ldapserver = 'ldap://ldap.server.com/ou=Apache,dc=server,dc=com?sAMAccountName'; //   ldap://ldap.server.com
                $conn_string = 'CN=Developers,ou=Apache,dc=server,dc=com'; //   cn=users, dc=xxx, dc=xxx
                $ldapconn = ldap_connect("$ldapserver");
                $userInfo = ldap_search($ldapconn,"$conn_string", "mail=$email");  // first check to see if they are active in LDAP
                $count = ldap_count_entries($ldapconn, $userInfo);
                if ($count) {
                        $info = ldap_get_entries($ldapconn, $userInfo);
                        $shortname =(isset($info[0]["uid"][0])) ? $info[0]["uid"][0]:'' ;
                   ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
                   $ldapbind = ldap_bind($ldapconn,"uid=$shortname, $conn_string", $password);
                        if (!$ldapbind) {
                                return new Error('Invalid LDAP password');
                        }
                } else if(!$user->isCurrentPassword($password)) {
                        return new Error('Invalid password');
                }
      return $this->logUserIn($user, array(
        'remember' => $remember,
        'new_visit' => true,
      ));
    } // authenticate

Using:

Your administrator account logs in with administrator@fqdn and password assigned in the AC db. To add LDAP users you must manually add them - user@fqdn, with a dummy password. When they log in, they must log in as user/password (the @fqdn is then used to determine their AD location and authenticate them) where the password is their LDAP/AD password.

Hope that helps anyone else out having problems.