LDAP Authentication

From WeBWorK
(Difference between revisions)
Jump to: navigation, search
Line 94: Line 94:
== Development ==
== Development ==
*[http://webwork.maa.org/viewvc/system/trunk/webwork2/lib/WeBWorK/Authen.pm?view=markup WeBWorK::Authen source code] |
*[http://webwork.maa.org/viewvc/system/trunk/webwork2/lib/WeBWorK/Authen.pm?view=markup WeBWorK::Authen source code]  
=== Bug Reports ===
=== Bug Reports ===

Revision as of 14:29, 31 August 2011

WeBWorK contains support for authenticating WeBWorK logins against an LDAP database.



WeBWorK 2.3.x or newer.

For WeBWorK 2.3.0, the Net::LDAPS Perl module and access to an LDAPS server.

For later versions of WeBWorK, the Net::LDAP Perl module and access to an LDAP or LDAPS server.


If you are using 2.3.1 or later If you are using WeBWorK 2.3.0 all configuration is now done in global.conf, using the $authen{ldap_options} hash. The items in this hash are as follows:

key description
net_ldap_hosts A reference to an array listing hosts to attempt to connect to. Examples:
auth.myschool.edu (uses LDAP scheme and port 389)
ldap://auth.myschool.edu:666 (non-standard port)
ldaps://auth.myschool.edu (uses LDAPS scheme and port 636)
ldaps://auth.myschool.edu:389 (SSL on non-SSL port)
net_ldap_options Options passed to Net::LDAP's constructor. See Net::LDAP#CONSTRUCTOR for details.
net_ldap_base LDAP base to use when searching for the user's DN. Site-specific.
failover If this is true, the WeBWorK password database will be consulted if the LDAP server rejects the user's password. The is necessary if you want to allow users to log in who are not listed in the LDAP server's database.

The following instructions apply to 2.3.0 and later versions of WeBWorK.

To use LDAP authentication with one course, add this to the course's course.conf file: $authen{user_module}{"*"} = "WeBWorK::Authen::LDAP";

To use LDAP authentication with all courses, change the $authen{user_module} hash in global.conf to look like this: $authen{user_module} = { sql_moodle => "WeBWorK::Authen::Moodle", "*" => "WeBWorK::Authen::LDAP", };

If you are using a bind user to connect to LDAP, Mark Hamrick (mmhamric@uncc.edu) has modified the ldap_authen_uid subroutine in the LDAP.PM file to handle the bind user authentication. The file is available at the link http://www.math.uncc.edu/~mmhamric/RevisedLDAP.pm It is not known if this change will be included in future versions of WebWork.


If you are using WeBWorK 2.3.0 you should upgrade!!!  :-)

If you insist on using WeBWorK 2.3.0, you'll have to set the following configuration options in webwork2/lib/WeBWorK/Authen/LDAP.pm:

constant description
$TIMEOUT Seconds to wait for LDAP server.
$PORT TCP port to connect to on LDAP server.
$VERSION LDAP protocol version to use.
$BASE LDAP base string.
@HOST This is kind of confusing. This is a one-element array, containing an arrayref. The arrayref is a list of servers to attempt to connect to. You'll see what to do when you look at the file. (Yes, this is a bug.)

Security Considerations

You must make sure that each accounts in your WeBWorK course "belongs" to the same person as the LDAP account with the same user ID. User ID mapping is not supported.

In WeBWorK 2.3.0, the LDAP module always fails over to checking the WeBWorK password if LDAP authentication fails.

It is suggested to run the authentication over SSL so that the password is encrypted and not sent in plain text.


The code is slanted towards University of Rochester's <nop>NetID implementation and hasn't been tested with other systems.

Only LDAPS is supported in WeBWorK 2.3.0. Both LDAP and LDAPS servers are supported in later versions.

You still have to add users to WeBWorK manually.

Gateway test proctors cannot authenticate with LDAP. They will have to have valid passwords in the WeBWorK database.

Forum Discussions


Bug Reports

IDPStatusSeverityVersionProductSummary (2 tasks)  
1926*P5RESOLVEDenhancementtrunk (SVN)WeBWorK 2feature request: more granular LDAP failover 

The code I run locally (probably changed after I ran into that warning) uses eq for all of the checks on line 39 of LDAP.pm. I think that'd also solve the issue and allow the use of "local". Your call, though -- using 0, 1, and 2 would also solve the issue. Sorry about that -- I guess I posted the wrong diff.

(I think this is in reference to the patch attached to #1926?)
P5RESOLVEDnormaltrunk (SVN)WeBWorK 2Active Directory specific LDAP search breaks on other systems 
follow us