Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Hi Stuart - This is great, just one question - you mention not having anon ticked for windowssignin.aspx - does this mean that you have it ticked for the rest of the site?

When I have it ticked my users are only logged in on their first views page, when they navigate they lose their logged in status.

I have tried with both windows and forms authentication in web.config

Any ideas?

Cheers, Matt

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

I have the rest of the site setup for Annoymous access. The only file that isn't is windowssignin.aspx. I do not have the problem that you are having.

I am not thinking of anything right off my head that could be causing your problem. Do your users have cookie enabled?

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Hi Stuart, thanks for that.

Turns out I should have left the web.config in FORMS authentication - I just assumed I should be using WINDOWS authentication but aparently not! - So to confirm, I have Anon access to everything but WindowsSignIn.aspx, Authentication HTTP module enabled, and FORM authentication and all seems to be working well.

Also I have compiled Mikes 435 version for 436 and everything still seems to be working well.

I made a slight change to the ADSI provider to set the display name as FirstName + LastName (since I know our AD has these fields correct).

Cheers for you work for this fix - finally our intranet works as it should!

Matt

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Matt, thanks for the update. Yes, I guess we should be compiling for the new version of DNN now... I just wish this stuff was added into the core.... Someday....

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Hi Stuart, me again!

I have just been thinking - I have about 30 'web editor' roles and only 3 roles which I need synched with AD.

Since we are running an intranet I have no need to have users edit their profilers and for that matter add themselves to public roles. I was therefore considering using the IsPublic field to represent mean that these roles (and no other) are the ones which should be checked against AD.

To achieve this I was thinking of modifying ADSIProvider.vb in the following way:

BEFORE:
For Each objRole In lstRoles
If Not objRole.AutoAssignment Then

AFTER:

For Each objRole In lstRoles
If Not objRole.AutoAssignment And objRole.IsPublic Then

====================

I am thinkning this would cut down the number of roles to check against AD directory to just those which are 'public' - which I hope will be a big speed improvement.

Am I going along the right lines here?

With regards to this making it into the core build you are absolutely right - and perhaps if/when it does there should be an option for 'IsADgroup' - if checked then AutoAssignment and IsPublic are disabled and cannot be ticked.... But that is for the future!

If you could let me know if you think this change would work, because I am not completely sure if I understand what is happening here!

Thanks
Matt

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

I am not looking at the code right now. But I think that you logic seems right on. I believe I even looked at doing something like that myself. Are you seeing long delays because of all of the role checking? I sort of doubt that you would.

Happy Thanksgiving!
Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Cool, well I'm not smart enough to know where to begin testing the performance of 30 AD checks vs 3 AD checks but since our Domain Controller is not on site and the first load (which include windows login) is very much the slowest part of our site now I figured the fewer calls to the DC the better.

Being a UK person myself I wasn't lucky enough to have a day off today :( But Happy Thanksgiving to you too!

Matt

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

If only your relative could have stowed away on a ship bound for the New World 300 years ago like mine, then you would have gotten the day off. That explains why you posted your message today.

Yeah, I could see how offsite that would be so great. I would say you are on the right track and in theory it sounds like you have a great plan.

Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

This is a great walk through!
As usual my DNN never seems to cooperate.

First when I enable AD Authentication I get:
Accessing LDAP:
FAIL
Find all domains in network:
Could not access LDAP to obtain domains info
The specified domain either does not exist or could not be contacted

AD Authentication works even though it fails on the module configuration. I can login with domain\user and it pulls my info from AD and logs me in. I've decided to ignore that problem since it works anyway.

2nd issue is that I set the windowssignin.aspx for integrated windows security and unchecked the anonymous access but when I navigate to to windowssignin.aspx I get the following error:

Error while processing Windows Authentication
Check your IIS settings. Admin/Security/WindowsSignin.aspx should NOT allow anonymous access

I have checked the file several times and anonymous access is unchecked (win2k server). I do have it set correctly.... What am I doing wrong?

Thanks

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Mark,

I have the first issue you mention when I run DNN locally on my dev laptop. Once I move it out to my staging server the error goes away. I just ignore it as well.

2nd issue is weird. Can you confirm that you are definately removing annoymous access from within IIS? If so, try adding it and removing it again. If that doesn't work, go to start | run | in windows and type in the run box, IISRESET and then hit okay. This will restart IIS. If it still doesn't work post another comment with more detail and we will see what we can do.

Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Hi Stuart,

Interesting blog entry regarding the setup of AD from within DNN, works fine from within our current Intranet setup. I have just one query regarding AD within DNN, is it possible to port to a AD server hosted somewhere else, lets say in the USA and the DNN portal hosted in China?

I'm not experienced in setting up AD and have no experience in linking between intranets over a WAN, and cannot find any solution on the net regarding my query.

Regards,

Eric

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

I haven't tried it myself, but I know it is possible. The issue here isn't really Dotnetnuke but how you setup your WAN connection. You need to have a trusted connection between the two sites. I currently work at a firm where we have 4 remote sites all on a trusted WAN connection and our Active Directory works across the sites fine.

Of course these connections are point-to-point so we aren't traveling across the Internet at all. Basically, what I am saying is that it all depends on how the sites are connected.

Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Hi Stuart,

Thank you for your reply. Basically the points are connected securely and that the site will be hosted internally by the 'main' cluster, from which all other nodes have access.

I'm implementing the scenario within the next couple of days.

Regards,

Eric

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

I am not sure of the issues with Active Directory and Clustering. I haven't had to deal with that. You can check the AD Project Area on Dotnetnuke and see if soneone else might know.

http://www.dotnetnuke.com/DotNetNukeProjects/CoreActiveDirectory/tabid/840/Default.aspx

Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Hi Stuart,

Does this allow DNN to work in a mode that for a public website, users who are not in AD can create an account, users coming in from web who are in AD authenticate via AD with username and pwd?

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Maybe.....

I have some issues on my server that when I am logged in as non AD users I sometimes get logged off the system. It could be a multitude of things, so I suggest you try it out. In theory yes that would work.

Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

I must be missing something. I'm attempting to setup DNN solely for intranet use, and really want AD authentication. When configuring authentication (even for test purposes), I make the following entries.

Windows Authentication = checked
Synchronize Role = unchecked (not sure what this buys me, checking failed too)
Provider = ADSIAuthenticationProvider (only choice in pull down)
Authentication Type = Delegation
Root Domain = DC = OUR_DOMAIN, tried DC=OUR_DOMAIN,DC=COM too
User Name = OUR_DOMAIN\SVCDNN
Email Domain = @OUR_DOMAIN.COM

Unfortunately, I encounter the following error - Error: Windows Authentication is currently unavailable. The event log reveals three entries, the first one is this:

AssemblyVersion: 04.05.05
PortalID: 0
PortalName: Star Portal
UserID: 2
UserName: admin
ActiveTabID: 52
ActiveTabName: Authentication
RawURL: /dotnetnuke/Admin/Authentication/tabid/52/Default.aspx
AbsoluteURL: /DotNetNuke/Default.aspx
AbsoluteURLReferrer: http://duke/dotnetnuke/Admin/Authentication/tabid/52/Default.aspx
UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
DefaultDataProvider: DotNetNuke.Data.SqlDataProvider, DotNetNuke.SqlDataProvider
ExceptionGUID: 770a27a4-0ab1-40e3-8f00-fe1a6fa89e77
InnerException: Logon failure: unknown user name or bad password.
FileName:
FileLineNumber: 0
FileColumnNumber: 0
Method: System.DirectoryServices.DirectoryEntry.Bind
StackTrace:
Message: System.DirectoryServices.DirectoryServicesCOMException (0x8007052E): Logon failure: unknown user name or bad password. at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_AdsObject() at System.DirectoryServices.PropertyValueCollection.PopulateList() at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName) at System.DirectoryServices.PropertyCollection.get_Item(String propertyName) at DotNetNuke.Security.Authentication.ADSI.Utilities.GetRootForestPath(Path ADSIPath)
Source:
Server Name: DUKE

I've attempted other domain admin user names and passwords, none of them work. The other two event entries are collateral. I doubt I'm simply not typing the user name and/or password incorrectly.

Any help would be most appreciative. I would not expect DNN to use the admin account's credentials to reach out to AD, otherwise why prompt for the AD user name and password. I'll post in the DNN forums too.

Thanks,
Dan.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Make sure your username is domainname\username.

If that doesn't work try a username without the domain name.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Hi Stuart,

Version your DNN?

thanks,

Basnight

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Basenight, not sure what you are asking.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

pls can anyone give solution to release this error, I m trying this to fix but it shows me same error prone.

Accessing Global Catalog:
FAIL
Checking Root Domain:
FAIL
Accessing LDAP:
FAIL
Find all domains in network:
Could not access LDAP to obtain domains info
The specified domain either does not exist or could not be contacted.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Verify that the credentials you are trying to login to your AD are correct. You can do this by using any sort of ldap browser software and trying to login via that software to your directory.

As I mention above I had to prefix my login name with my domain to get it to work. It is going to be trial and error until you find the combination that works.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Is there a way to setup DNN for AD Authentication where the user doesn't have to specify the domain name in the login? For example, my users have to login using domainname\username and I would rather them just log in using their username?

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

That requires a core modification. It is pretty easy mod though and doesn't require a recompile. You would need to modify the sigin.aspx.vb code behind file.

Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

I have successfully configured my DNN portal for AD authentication. If a user accesses the site from within the network, he is automatically logged into the site - no problem. If I access the site from the Internet, I get a login window and must login with an AD user/password. I would like to allow anonymous access from outside of the domain, i.e., I am logged in automatically at work, but also have access to the site from outside of the network without a login - I might then choose to login as my AD user to access restricted areas of the site. Is this possible? I have searched quite a bit and haven't gotten an answer to this question. This is my first DNN site. Thanks in advance for any help.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

You would have to customize the code and it would get messy. You could customize the default.aspx page so that if an IP is within a certain range the user is logged in automatically, otherwise they aren't.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Thanks Stuart. Is there a way to allow all users anon access, whether or not they are in the domain (just as DNN normally does), but allow them to use AD authentication to access restricted areas only? (Of course, they would have to login from within the site - but authentication would be by AD) Thanks.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Thanks Stuart. Is there a way to allow all users anon access, whether or not they are in the domain (just as DNN normally does), but allow them to use AD authentication to access restricted areas only? (Of course, they would have to login from within the site - but authentication would be by AD) Thanks.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Thanks Stuart. Is there a way to allow all users anon access, whether or not they are in the domain (just as DNN normally does), but allow them to use AD authentication to access restricted areas only? (Of course, they would have to login from within the site - but authentication would be by AD) Thanks.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Thanks Stuart. Is there a way to allow all users anon access, whether or not they are in the domain (just as DNN normally does), but allow them to use AD authentication to access restricted areas only? (Of course, they would have to login from within the site - but authentication would be by AD) Thanks.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

You are going to have to play around, but I think if you don't auto log them into DNN and everything is synced up you can let them login normally with their DNN Credentials. You might be able to find a module on snowcovered that will help you.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Thank you. You have been very helpful. Take care

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Stuart. I have one more idea. Is it possible to have every visitor logged in as a predetermined AD user automatically? Thanks

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Again, you are going to have to modify the default.aspx or to make a decision on that. Short answer is not out of the box. Long answer, if you want to modify the core of DNN, then yes.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Guess I'll dig a little deeper. Thanks again!

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Guess I'll dig a little deeper. Thanks again!

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

hi everyone,

i am trying to follow these instructions, but on my dnn (which is hosted with godaddy) i cannot do windows authentications because there is the message: "The default authentication provider specified in web.config is not configured properly. Authentication settings are disabled."

My dnn instalation was done directly on godaddy. can anyone advice what should i do?

Thanks

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

hi everyone,

i am trying to follow these instructions, but on my dnn (which is hosted with godaddy) i cannot do windows authentications because there is the message: "The default authentication provider specified in web.config is not configured properly. Authentication settings are disabled."

My dnn instalation was done directly on godaddy. can anyone advice what should i do?

Thanks

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

for some reason my install cannot verify domain settings, we have nested groups am I out of luck?

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

The DNN AD module has changed over the past few months. You would be better served visiting the AD Forum on Dotnetnuke.com. Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

I wouldn't think that nested groups would cause you not to be able to authenticate though. Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Hello I am trying to sync roles with my AD and DNN 4.07 and Some users get the sync roles and others don't. Is anyone having this problem?

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

By using this method,
The authentication works for us but we have been struggling with the other AD account features

1. enabling password resets
2. popup messages for changing password according to AD policies i.e. you have 10 days to reset your password before it expires etc.
3. user directory list

These are some of the features we would like to enable via AD to DNN

Any ideas would be appreciated.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

By using this method,
The authentication works for us but we have been struggling with the other AD account features

1. enabling password resets
2. popup messages for changing password according to AD policies i.e. you have 10 days to reset your password before it expires etc.
3. user directory list

These are some of the features we would like to enable via AD to DNN

Any ideas would be appreciated.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

By using this method,
The authentication works for us but we have been struggling with the other AD account features

1. enabling password resets
2. popup messages for changing password according to AD policies i.e. you have 10 days to reset your password before it expires etc.
3. user directory list

These are some of the features we would like to enable via AD to DNN

Any ideas would be appreciated.

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Now that the AD Authentication Provider is seperate from the core of Dotnetnuke you are able to modify it as much as you want without having to break the upgrade path for Dotnetnuke.

I will address your items in order.

1. The reason you can't enable passowrd resets from DNN to AD is that DNN is really just building a duplicate of your AD system within DNN. When a DNN runs AD all of the DNN Users and Roles still exist. DNN is just making sure that you have access to these users and roles by authenticating you against DNN. Using AD with DNN is synchronzing your AD to your DNN in many respects. With that said you could modify the core of Dotnetnuke so that when someone does a password reset it would reset DNN, though you would be modifying the core of DNN and thus breaking up the upgrade path.
2. Same as number 1. It could be done but it would be a core modification I believe.
3. You can achieve a directory list by importing all of your users from AD into DNN. There are several good examples out on the interweb that show you how to create users using XML, etc. The reason you have to import the users is that an AD user doesn't exist within the DNN Users table until that user successfully logs into DNN the first time. You could also develop a module that simply pointed to your AD structure and pulled out the users and made a user directory. Lots of options really.

If you are needed help drop me a line. I do consult on these types of things.

Stuart

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

i have an small question, i am new to this dnn,in my intranet site, i am able to get the user name and password from the active directory, but the PROBLEM is when ever a new user from enters for the first time he is not able to login in the first attempt itself, the user needs to type in his username and password for the second time, then only he is able to get into the site (NOTE: here user refers to the person in the active directory).....
when he types his username and password and clicks enter the pages starts loading but he is still in the same login page and he has to type the same for the second time ......
once the user logs into the intranet site.... then the same user can login to the site in the first attempt itself from then on..
any help ..... waitting for an clear reply friends.....

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

i have an small question, i am new to this dnn,in my intranet site, i am able to get the user name and password from the active directory, but the PROBLEM is when ever a new user from enters for the first time he is not able to login in the first attempt itself, the user needs to type in his username and password for the second time, then only he is able to get into the site (NOTE: here user refers to the person in the active directory).....
when he types his username and password and clicks enter the pages starts loading but he is still in the same login page and he has to type the same for the second time ......
once the user logs into the intranet site.... then the same user can login to the site in the first attempt itself from then on..
any help ..... waitting for an clear reply friends.....

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

i have an small question, i am new to this dnn,in my intranet site, i am able to get the user name and password from the active directory, but the PROBLEM is when ever a new user from enters for the first time he is not able to login in the first attempt itself, the user needs to type in his username and password for the second time, then only he is able to get into the site (NOTE: here user refers to the person in the active directory).....
when he types his username and password and clicks enter the pages starts loading but he is still in the same login page and he has to type the same for the second time ......
once the user logs into the intranet site.... then the same user can login to the site in the first attempt itself from then on..
any help ..... waitting for an clear reply friends.....

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

I have been working with the new setup with Active Directory just a little bit. Try to come in as a new user and type your username and password, then click the login button, DO NOT HIT ENTER. Does it work then?

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

yeah stuart;
once u have entered the intranet site, by typing the username and password for the second time, u can get into the intranet site easily, u can either click the login button or click the enter button.. it gets u into the intranet site....

another issue2:
now i am typing my username as (domain\username) format, is there any way to log into the site by just giving the username instead of typing the whole domain\username...

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

yeah stuart;
once u have entered the intranet site, by typing the username and password for the second time, u can get into the intranet site easily, u can either click the login button or click the enter button.. it gets u into the intranet site....

another issue2:
now i am typing my username as (domain\username) format, is there any way to log into the site by just giving the username instead of typing the whole domain\username...

Re: Setting up Dotnetnuke (DNN) to work with Active Directory

Have you checked out the Forum on DNN for AD? It will probably address the double login. The second issue is easily fixed with a minor change to the code for Active Directory.

Stuart