Configuration : HowTo use LDAP/ActiveDirectory for Authentication and Authorization : Comments

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Wed, 28 Jul 2010 07:26:10 GMT

When will the instructions for Ubuntu 10.04 and Zenoss 3.0 be posted?

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Thu, 29 Jul 2010 06:13:01 GMT

Try it

http://community.zenoss.org/message/51118

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Thu, 29 Jul 2010 06:15:23 GMT

Thanks man. On to it

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Mon, 03 Jan 2011 15:09:06 GMT

Hi,

-> Happy New Year! <-

since in configured everthing like above, it seems to work, but now im no longer able to logon, even with the 'admin' account. I always get the login screen reappeard...

Any help is very appreciated!

Kind regards

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 21 Jan 2011 14:58:50 GMT

Does anyone know the same thing but with federated software like shibboleth or simpleSAMLphp ?

And what attributes / variables are needed in order to implement groups and identifying users ?

thanks

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Thu, 24 Mar 2011 12:33:58 GMT

anyone can make it working on zenoss 3.1.x?

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 08 Apr 2011 15:19:37 GMT

It works perfectly on 3.1.0.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Thu, 07 Jul 2011 16:32:15 GMT

If you're using RHEL5 or similar, be sure you ONLY download python-ldap-2.3.13 and not a newer version, lest ye be damned.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 03 Feb 2012 14:28:04 GMT

Hi.

I want authentic Zenoss with Active Directoy.

Should I continue the next steps?

Enabling caching.
Fetching user settings from ldap.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 03 Feb 2012 15:26:34 GMT

Lord_King:

You definately should enable caching.

--Shane

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 03 Feb 2012 22:21:32 GMT

Hi Shane.

In the next step:

Your LDAPMultiPlugins object (whatever you named it) and userManager will appear as objects that you can associate with the RAM Cache.

Should I choose Active Directory plugin?

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Sat, 04 Feb 2012 02:56:11 GMT

Lord_King:

Either should work...I think.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Sat, 04 Feb 2012 12:50:18 GMT

Hi Shane.

how to I taste it is configured correctly on Zenoss AD?

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Mon, 06 Feb 2012 15:38:31 GMT

Hi.

I was testing the connection but, show to me these:

[root@itlibre ~]# ldapsearch -LLL -x -b 'BaseDN' -D 'Bind DN' -W -H ldap://172.27.0.3 "sAMAccountName=*" zadmin

Enter LDAP Password:

ldap_bind: Invalid credentials (49)

additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Thu, 09 Feb 2012 19:30:17 GMT

I tried this process on a new install of zenoss 3.2.1 on CentOS 5.7. Here are my problems:

1) after installing python_ldap (it's 2.2.0) (the python site only shows 2.4.x, so I used what was in the rpm), and the two ldap plugin modules as described, there are neither of the ldap plugins in the dropdown list beside the Add button.

3) my OpenLdap installation works fine, I have other applications querying it without problems.

I am not really familiar with either Zope or Python, and I don't know where to look for error messages and the like. I've checked the logs in $ZENHOME/log and found nothing useful.

part2: clearly the install instructions for the ldap plugins above were made before the plugins moved to the normal python module site. Untarring them into $ZENHOME/Products does not work, they need to be python installed. I don't know how to do that so they end up in the Zenoss Products directory, can any one help me?

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Wed, 15 Feb 2012 20:07:04 GMT

Hi tigerpaws.

Are You try LDAP or Acive Directory authetication?

My problem is with AD.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Wed, 15 Feb 2012 20:26:37 GMT

In my case it's openldap. If you have it running, and it just won't talk to ad, you're ahead of me.

When I finally got the two python ldap modules installed, my zenoss won't start any more; I get the following errors:

Daemon: zopectl Traceback (most recent call last):

File "/opt/zenoss/bin/zopectl", line 8, in <module>

load_entry_point('Zope2==2.12.1', 'console_scripts', 'zopectl')()

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 408, in run

exitstatus = main()

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 364, in main

options.realize(args)

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 170, in realize

self.directory = config.instancehome

AttributeError: 'NoneType' object has no attribute 'instancehome'

Daemon: zeoctl Error: no program specified; use -p or -C

For help, use /opt/zenoss/bin/zeoctl -h

Daemon: zeoctl Error: no program specified; use -p or -C

For help, use /opt/zenoss/bin/zeoctl -h

Daemon: zopectl Traceback (most recent call last):

File "/opt/zenoss/bin/zopectl", line 8, in <module>

load_entry_point('Zope2==2.12.1', 'console_scripts', 'zopectl')()

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 408, in run

exitstatus = main()

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 364, in main

options.realize(args)

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 170, in realize

self.directory = config.instancehome

AttributeError: 'NoneType' object has no attribute 'instancehome'

I'm sure it's pretty simple to fix, but I haven't found it yet.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Tue, 22 May 2012 15:04:58 GMT

I could not get this procedure to work on Red Hat 5 x64 using the latest versions of the LDAP plugins. I had to use LDAPMultiPlugins-1.7.tgz and LDAPUserFolder-2.12.tgz

These article were very helpful

http://community.zenoss.org/thread/16749?start=0&tstart=0

http://community.zenoss.org/thread/12224?decorator=print&displayFullThread=true

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Tue, 29 May 2012 17:38:10 GMT

We have several different installs of Zenoss Core. I have been able to install LDAP on 3 out of 4. In the 4th installation, I am able to install the plugin fine but get an error when trying to add LDAP settings. The first error I get

Type:

Value: (2, 'No such file or directory')

If I press back on my browser and try again I get a different error

Type:

Value: (11, 'Resource temporarily unavailable')

This zenoss installation is the same setup as all other installation where the LDAP plugin installed without a problem. I don't see any problems with it.

Any idea what my problem might be?

PROBLEM SOLVED: Not sure what I did but eventually it went through

Everything I searched online said this happens sometimes and try again

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Tue, 29 May 2012 18:33:33 GMT

kenhen93:

Hum, that's odd. Can you try restarting zeo and zope and trying to add them again?

If that doesn't work, su zenoss then zopectl stop then zopectl fg. Post any traceback. If there isn't any traceback, hit /manage and try to resume adding LDAP. Note any tyraceback on the console and post it.

Best,

--Shane

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Wed, 13 Jun 2012 19:16:03 GMT

Getting that error again when I try to configure LDAP on a new zenoss setup. Here is a log from event.log

2012-06-13T15:11:36 ERROR Zope.SiteErrorLog 1339614696.60.658918105489 http://zenoss-frr.vip.prod.root:8080/zport/acl_users/manage_addProduct/LDAPMultiPlugins/manage_addLDAPMultiPlugin

Traceback (innermost last):

Module ZPublisher.Publish, line 127, in publish

Module ZPublisher.mapply, line 77, in mapply

Module ZPublisher.Publish, line 47, in call_object

Module Products.LDAPMultiPlugins.LDAPMultiPlugin, line 95, in manage_addLDAPMultiPlugin

Module Products.LDAPUserFolder.LDAPUserFolder, line 441, in manage_edit

Module Products.LDAPUserFolder.LDAPDelegate, line 233, in connect

Module Products.LDAPUserFolder.LDAPDelegate, line 303, in _connect

Module ldap.ldapobject, line 692, in __init__

Module ldap.ldapobject, line 69, in __init__

Module ldap.functions, line 63, in _ldap_function_call

LDAPError: (11, 'Resource temporarily unavailable')

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Tue, 28 Aug 2012 17:47:43 GMT

I was able to install LDAP plugin on Core 4.2 x64 using these same steps. I am running Red Hat Linux x64 5.8

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Tue, 02 Oct 2012 08:08:27 GMT

Hi,

I am running CentOS 6.3 64bit on a VirtualBox and have installed ZenOss 4.2.

I have tried to install ldap so I can authenticate users.

I have tried this guide and used LDAPMultiPlugins-1.7.tgz, LDAPUserFolder-2.12.tgz and python-ldap-2.3.13

The plugins don’t show up under zport/manage/ -> /zport/acl_users.

I have tried this lot of times and sometime the server it crashes on reboot.

Don’t know if this is the issue my knowledge of python is equal to zero.

[root@localhost ~]# /usr/bin/python -V

Python 2.6.6

[root@localhost ~]# /opt/zenoss/bin/python -V

Python 2.7.2

[root@localhost ~]#

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Thu, 04 Oct 2012 19:50:40 GMT

Mike:

Try LDAPMultiPlugins-1.14 and LDAPUserFolder-2.20.

Best,

--Shane Scott (Hackman238)

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 05 Oct 2012 11:23:35 GMT

It still won’t show up, then I did su zenoss and run python setup.py install on LDAPMulti and LDAPUser

Then I restarted zenoss

[root@localhost /]# service zenoss restart

No handlers could be found for logger "Init"

Daemon: zeneventlog stopping...

Daemon: zenwin stopping...

Daemon: zenwinperf stopping...

Daemon: zenjmx stopping...

Daemon: zenrrdcached stopping...

Daemon: zenprocess stopping...

Daemon: zencommand stopping...

Daemon: zenperfsnmp stopping...

Daemon: zenmodeler stopping...

Daemon: zentrap stopping...

Daemon: zenactiond stopping...

Daemon: zenstatus stopping...

Daemon: zensyslog stopping...

Daemon: zenping stopping...

Daemon: zeneventd stopping...

Daemon: zenjobs stopping...

Daemon: zenhub stopping...

Daemon: zopectl Traceback (most recent call last):

File "/opt/zenoss/bin/zopectl", line 8, in <module>

load_entry_point('Zope2==2.13.13', 'console_scripts', 'zopectl')()

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 483, in run

exitstatus = main()

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 439, in main

options.realize(args)

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 180, in realize

self.directory = config.instancehome

AttributeError: 'NoneType' object has no attribute 'instancehome'

Daemon: zeneventserver stopping...

Daemon: zeneventserver starting...

Waiting for zeneventserver to start.......

Daemon: zopectl Traceback (most recent call last):

File "/opt/zenoss/bin/zopectl", line 8, in <module>

load_entry_point('Zope2==2.13.13', 'console_scripts', 'zopectl')()

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 483, in run

exitstatus = main()

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 439, in main

options.realize(args)

File "/opt/zenoss/lib/python/Zope2/Startup/zopectl.py", line 180, in realize

self.directory = config.instancehome

AttributeError: 'NoneType' object has no attribute 'instancehome'

Daemon: zenhub starting...

No handlers could be found for logger "Init"

Daemon: zenjobs starting...

No handlers could be found for logger "Init"

Daemon: zeneventd starting...

No handlers could be found for logger "Init"

Daemon: zenping starting...

No handlers could be found for logger "Init"

Daemon: zensyslog starting...

No handlers could be found for logger "Init"

Daemon: zenstatus starting...

No handlers could be found for logger "Init"

Daemon: zenactiond starting...

No handlers could be found for logger "Init"

Daemon: zentrap starting...

No handlers could be found for logger "Init"

Daemon: zenmodeler starting...

WARNING:Init:Class Products.LDAPUserFolder.LDAPUserFolder.LDAPUserFolder has a security declaration for nonexistent method 'getEncryptedPassword'

Daemon: zenperfsnmp starting...

No handlers could be found for logger "Init"

Daemon: zencommand starting...

No handlers could be found for logger "Init"

Daemon: zenprocess starting...

No handlers could be found for logger "Init"

Daemon: zenrrdcached starting...

Daemon: zenjmx starting...

No handlers could be found for logger "Init"

Daemon: zenwinperf starting...

WARNING:Init:Class Products.LDAPUserFolder.LDAPUserFolder.LDAPUserFolder has a security declaration for nonexistent method 'getEncryptedPassword'

Daemon: zenwin starting...

WARNING:Init:Class Products.LDAPUserFolder.LDAPUserFolder.LDAPUserFolder has a security declaration for nonexistent method 'getEncryptedPassword'

Daemon: zeneventlog starting...

WARNING:Init:Class Products.LDAPUserFolder.LDAPUserFolder.LDAPUserFolder has a security declaration for nonexistent method 'getEncryptedPassword'

[root@localhost /]#

I have no idea what to do next.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 05 Oct 2012 13:49:29 GMT

Mike:

Hum. I'll look for a solution.

Best,

--Shane Scott (Hackman238)

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Wed, 24 Oct 2012 12:45:59 GMT

Same error here. I'm using the same OS/Zenoss versions here (RHEL6.3 Zenoss 4.2 rpms).

I've tried to install with LDAPUserFolder-2.24, LDAPMultiPlugins-1.14 and python-ldap-2.4.10.

I kindly ask for your help.

Thanks in advance,

Felipe Castelar

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Wed, 24 Oct 2012 12:56:27 GMT

I am not sure if this would fix your problem but you are not using the versions of the needed files that I have got to work. I just installed LDAP on Zenoss 4.2 on RH5 using LDAPUserFolder-2.12, LDAPMultiPlugins1.7 and python-ldap-2.3.13. I actually tried newer versions of these files and it did not work. These files did not look available via the link.

Shane, is there any way I can upload them to this how-to?

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 26 Oct 2012 08:40:35 GMT

PM me what you did and where you got the files. I'll update the doc and put the files up for download.

Nice work!

--Shane Scott (Hackman238)

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Mon, 17 Dec 2012 02:00:01 GMT

Has anyone established compatiblity with LDAP in Zenoss 4.2 on RHEL 6.2 or 6.3?

I have been able to get LDAP to work with LDAPMultiPlugins 1.7, LDAPUserFolder 2.12 and Python-LDAP 2.3.13 in a Zenoss 4.2 on a few RHEL 5.* environments. Unfortunatley I haven't been able to get LDAP in Zenoss 4.2 on RHEL 6.2 to work properly; it seems /zport/acl_users just doesnt populate with the AD and LDAP options.

Can anyone else confirm my observations?
I will keep investigating and post what I find.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Fri, 01 Mar 2013 23:05:25 GMT

For those of you running into the 'NoneType' object has no attribute 'instancehome' error:

This is likely because you used the stack installer on centos 6, which handles python modules a bit differently. If you installed via the "python setup.py install" command, then you will get this error - regardless of if you are running as the zenoss user or not.

The proper way to install modules, if you've installed from a recent stack build, is via "/opt/zenoss/bin/easy_install [pythonpkg.tar.gz]" - If you do this, then you can get it working. I stuck with as close of a version as possible to this document for all of the modules. I did have to make a couple of changes in addition - mostly changing the groupid_attr property to "name" instead of "objectGUID" for the AD module (role mapping was broken until i did this)

I was having all for the 'instancehome' errors until I stumbled on tho this... It took a bit to figure out, as this was the first time I used the autodeploy - I had always done it manually before.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Tue, 23 Apr 2013 10:40:30 GMT

I followed this link which is a step by step walkthrough: "Enabling LDAP Authentication in Zenoss Core 4.2+ and CentOS 6"

http://blogs.oregonstate.edu/sig/2013/03/28/enabling-ldap-authentication-in-zenoss-core-4-2-and-centos-6/

Thanks, I couldn't comment on his site but it helped me out.

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Tue, 10 Sep 2013 15:35:20 GMT

Created a script. Do not know if anyone is interested. Here it is. Tested on 4.2.4 auto-deploy and RHEL 6.4 x64.

#!/bin/bash

#Install LDAP support for Zenoss

#Jeff Creek - 9/10/2013

if [ $USER = "zenoss" ]; then

echo "logged in as zenoss"

else

echo "Must be ran while logged in as zenoss"

exit

installed=`rpm -qa | grep python-ldap`

echo $installed

if [ $installed ]; then

echo "phython-ldap is installed....\n..."

else

echo -e "Manually run 'yum -y install python-ldap' as root. Then run this script."

exit

echo "Making directories..."

mkdir $ZENHOME/python

mkdir $ZENHOME/python/lib

mkdir $ZENHOME/python/lib/python2.6

mkdir $ZENHOME/python/lib/python2.6/site-packages

echo "Creating links..."

ln -s /usr/lib64/python2.6/site-packages/ldap/ $ZENHOME/python/lib/python2.6/site-packages/

ln -s /usr/lib64/python2.6/site-packages/ldapurl.py $ZENHOME/python/lib/python2.6/site-packages/

ln -s /usr/lib64/python2.6/site-packages/ldapurl.pyc $ZENHOME/python/lib/python2.6/site-packages/

ln -s /usr/lib64/python2.6/site-packages/_ldap.so $ZENHOME/python/lib/python2.6/site-packages/

cd /home/zenoss

echo "Downloading..."

wget http://www.dataflake.org/software/ldapuserfolder/ldapuserfolder_2.12/LDAPUserFolder-2.12.tgz/download -O LDAPUserFolder-2.12.tgz

wget http://www.dataflake.org/software/ldapmultiplugins/ldapmultiplugins_1.7/LDAPMultiPlugins-1.7.tgz/download -O LDAPMultiPlugins-1.7.tgz

echo "Extracting..."

tar -zxvf LDAPUserFolder*.tgz -C $ZENHOME/Products

tar -zxvf LDAPMultiPlugins*.tgz -C $ZENHOME/Products

echo

echo -e "Now login to http://servername:8080

Restart zopectl

Click acl_users on the left side.

From the list next to Add, select LDAP Multi Plugin.

Configure the LDAP settings for you environment.

Click Add.

Enable LDAP cache.

\ta. Click on acl_users

\tb. In the upper right corner next to Add select RAM Cache Manager

\tc. Give the Cache Manager a name – LDAP Cache

\td. Click Add

\te. Click on LDAP Cache in the list

\tf. Click on the Associate tab

\tg. Click on LDAP Multi Plugin in the list

\th. Click Locate

\ti. Click the check box next to the LDAP Authentication object you created earlier

\tj. Click Save Changes

Click on acl_users then LDAP Authentication.

Click the check box next to Authentication, User_Enumeration and Roles.

Click Update.

Click the Contents tab.

Click acl_users.

Make sure that Group Mapping is set to "Manually map LDAP groups to Zope roles".

Click the Groups tab.

Scroll to the "LDAP group to Zope role mappings" section.

Next to My LDAP Group select your admin group.

Next to …to Zope Rule select Manager.

Click Add."

RE: HowTo use LDAP/ActiveDirectory for Authentication and Authorization

community@zenoss.org — Thu, 06 Mar 2014 18:53:54 GMT

Just wanted to post a similar script to Jeffs but doesn't need symlinks for python 2.6. This includes steps for setting up LDAPS.

#!/bin/bash
#
# Install LDAP Support for Zenoss
# Taken from this post http://blogs.oregonstate.edu/sig/2013/03/28/enabling-ldap-authentication-in-zenoss-core-4-2-and-centos-6/
# https://bugs.launchpad.net/ldapuserfolder/+bug/1221624

echo "Please make sure OpenLDAP is configured with the CA of the Active Directory/LDAP server you are connecting to for secure communication"
# Place the CA cert into /etc/openldap/certs

# OpenLDAP needs to be configued to use the CA with the following configuration /etc/openldap/ldap.conf

## Start Config File ##

##
## LDAP Defaults
##

## See ldap.conf(5) for details
## This file should be world readable but not world writable.
#
##BASE   dc=example,dc=com
##URI    ldap://ldap.example.com ldap://ldap-master.example.com:666
#
##SIZELIMIT      12
##TIMELIMIT      15
##DEREF          never
#
#TLS_REQCERT never
#
#TLS_CACERTDIR /etc/openldap/certs
#TLS_CACERT /etc/openldap/certs/<YOUR CA ROOT CERT>.crt

## End Config File ##

echo "Installing required packages..."
sudo yum -y install gcc python-devel openssl-devel openldap-devel
rc=$?
if [ ${rc} != 0 ]; then
echo "Unable to install required packages. Error Code: ${?}"
exit 1
fi

echo "Downloading required auth plugins..."
sudo runuser -l zenoss -c 'mkdir -p /home/zenoss/ldap-auth'
rc=$?
if [ ${rc} != 0 ]; then
echo "Unable to create ldap-auth directory. Error Code: ${?}"
exit 1
fi

sudo runuser -l zenoss -c 'wget -P /home/zenoss/ldap-auth https://pypi.python.org/packages/source/P/Products.LDAPMultiPlugins/Products.LDAPMultiPlugins-1.14.tar.gz'
rc=$?
if [ ${rc} != 0 ]; then
echo "Unable to download LDAPMultiPlugins. Error Code: ${?}"
exit 1
fi

sudo runuser -l zenoss -c 'wget -P /home/zenoss/ldap-auth https://pypi.python.org/packages/source/P/Products.LDAPUserFolder/Products.LDAPUserFolder-2.24.tar.gz'
rc=$?
if [ ${rc} != 0 ]; then
echo "Unable to download LDAPUserFolder. Error Code: ${?}"
exit 1
fi

sudo runuser -l zenoss -c 'wget -P /home/zenoss/ldap-auth https://pypi.python.org/packages/source/p/python-ldap/python-ldap-2.4.10.tar.gz'
rc=$?
if [ ${rc} != 0 ]; then
echo "Unable to download python-ldap. Error Code: ${?}"
exit 1
fi

echo "Running python easy_install as zenoss user..."
sudo runuser -l zenoss -c 'easy_install /home/zenoss/ldap-auth/Products.LDAPMultiPlugins-1.14.tar.gz'
rc=$?
if [ ${rc} != 0 ]; then
echo "Unable to easy_install /home/zenoss/ldap-auth/LDAPMultiPlugins. Error Code: ${?}"
exit 1
fi

sudo runuser -l zenoss -c 'easy_install /home/zenoss/ldap-auth/Products.LDAPUserFolder-2.24.tar.gz'
rc=$?
if [ ${rc} != 0 ]; then
echo "Unable to easy_install LDAPUserFolder. Error Code: ${?}"
exit 1
fi

echo "Creating patch file for security declaration of non-existing method"
cat << EOF >> /home/zenoss/ldap-auth/LDAPUserFolder.patch
--- a/Products/LDAPUserFolder/LDAPUserFolder.py
+++ b/Products/LDAPUserFolder/LDAPUserFolder.py
@@ -1990,7 +1990,7 @@ class LDAPUserFolder(BasicUserFolder):

         return getattr(conn, '_uri', '-- not connected --')

-    security.declareProtected(manage_users, 'getEncryptedPassword')
+    security.declareProtected(manage_users, 'getEncryptedBindPassword')
     def getEncryptedBindPassword(self):
         """ Return a hashed bind password for safe use in forms etc.
         """
EOF

echo "Applying LDAPUserFolder patch.."
# Run this as the zenoss user to have the correct path for $ZENHOME -- need a way to not hardcode this
sudo patch /vol0/opt/zenoss/lib/python2.7/site-packages/Products.LDAPUserFolder-2.24-py2.7.egg/Products/LDAPUserFolder/LDAPUserFolder.py < /home/zenoss/ldap-auth/LDAPUserFolder.patch
if [ ${rc} != 0 ]; then
echo "Unable to patch LDAPUserFolder.py. Error Code: ${?}"
exit 1
fi

sudo runuser -l zenoss -c 'easy_install /home/zenoss/ldap-auth/python-ldap-2.4.10.tar.gz'
rc=$?
if [ ${rc} != 0 ]; then
echo "Unable to easy_install python-ldap. Error Code: ${?}"
exit 1
fi

echo "Restarting zenoss..."
sudo /etc/init.d/zenoss restart

echo "Log into https://`hostname`/zport/manage to configure ldap authentication"
echo "Click acl_users in the tree on the left side.
From the list next to Add on the right, select ActiveDirectory Multi Plugin from the dropdown and Click Add.
Configure the ActiveDirectory settings for you environment and click Add.
\ta: ID: Active Directory Authentication
\tb: Title: Active Directory Authentication
\tc: LDAP Server[:port]: <Domain Controller>
\td: Use SSL: <checked>
\te: Read-only: <checked>
\tf: Login Name Attribute: Windows Login Name (sAMAccountName)
\tg: Users Base DN: OU=Foo,dc=example,dc=net
\th: Scope: SUBTREE
\ti: Group storage: Groups stored on LDAP server
\tj: Groups Base DN: OU=Bar,dc=example,dc=net
\tk: Scope: SUBTREE
\tl: Manager DN: user@example.net
\tm: Password: <password>
\tn: User password encryption: SHA
\to: Default User Roles: Anonymous

Expand acl_useres on the tree on the left side and Click Active Directory Authentication
Check the boxes next to 'Authentication', 'Properties' and 'User_Enumeration'.

Expand acl_useres -> Active Directory Authentication on the tree on the left side and Click acl_users
Modify the Active Direcotry settings
\ta: User ID Attribute: Windows Login Name (sAMAccountName)
\tb: RDN Attribute Windows Login Name (sAMAccountName)
Re-Enter the Manager DN Passsword and Click Add.

Testing
-------
Expand acl_useres -> Active Directory Authentication on the tree on the left side and Click acl_users
Select the Users 'Tab'
Select Windows Login Name (SamMAccountName) from the dropdown under Find existing user
Enter a user account name in the emtpy search field to the right of the dropdown
Click Search!
"