Print Page | Close Window

Active Directory Group Membership

Printed From: Web Wiz Forums
Category: Web Wiz Web App Support Forums
Forum Name: Web Wiz Forums
Forum Description: Support forum for Web Wiz Forums application.
URL: https://forums.webwiz.net/forum_posts.asp?TID=20554
Printed Date: 07 April 2026 at 12:44pm
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com


Topic: Active Directory Group Membership
Posted By: kastigeer
Subject: Active Directory Group Membership
Date Posted: 05 July 2006 at 4:52pm
The active directory integration is working great but I can't see how to change the group membership of AD users - they all start as Newbie's and I can't see how to make them Administrators or moderators ...
 
We need AD functionality for our forum but it will be a showstopper if we can't assign internal users to be moderators... (and not using separate logons to do this is the whole reason why we want AD integration)  If this works then we'll definitely be stumping up cash for the ad-free version.
 
thanks
Barry



Replies:
Posted By: WebWiz-Bruce
Date Posted: 05 July 2006 at 6:10pm
There is no way to get Group info from AD into ASP.

This means that placing members into moderator groups would need to be a manual process.

Log into the forum as the forum admin, then edit the profiles of those users you want to be moderators, and down near the bottom of there forum settings you should find a drop down to move that member to a different Group within the forum.


-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting


Posted By: kastigeer
Date Posted: 05 July 2006 at 6:48pm
Sorry, should have been clearer - that's what I'm trying to do, but when I turn on Windows Authentication the option to change the moderater/group membership in WebWiz dissapears ... if I turn off windows authentication then it re-appears! (It also dissapears from the member control panel menu)
 
thanks
Barry


Posted By: kastigeer
Date Posted: 06 July 2006 at 9:34am
Just to help clarify, this is the member control panel menu I get when I logon as the administrator with windows authentication turned off:
 
Member Control Panel Menu

http://www.petro-sim.com/forum/register.asp?FPN=0&PF=23&M=A - Edit Profile
Make changes to your profile and forum preferences

http://www.petro-sim.com/forum/register.asp?FPN=1&PF=23&M=A - Registration Details
Make changes to your login password and/or email address

http://www.petro-sim.com/forum/register.asp?FPN=2&PF=23&M=A - Profile Information
Make changes to personal information you have given

http://www.petro-sim.com/forum/register.asp?FPN=3&PF=23&M=A - Forum Preferences
Make changes to your forum preferences

http://www.petro-sim.com/forum/register.asp?PF=23&M=A#admin - Admin and Moderator functions
Admin and Moderator functions to delete, suspend, change user group etc. of member

http://www.petro-sim.com/forum/help.asp - Forum Help
Forum Help files and FAQ's to help you with any difficulties you may have when using the forum

 

 

When I then turn on windows authentication I have to logon as a valid AD user, all of whom are only in as newbie's - I then force an admin logon to the control panel area by manually specifying the /admin.asp page in the address.

 

Once logged on I go to the members admin area, click in the logon ID for a windows user and this is the control panel menu I get - the option for Admin and Moderator functions is simply not there ...

 

Member Control Panel Menu

http://www.petro-sim.com/forum/register.asp?FPN=0 - Edit Profile
Make changes to your profile and forum preferences

http://www.petro-sim.com/forum/register.asp?FPN=1 - Registration Details
Make changes to your login password and/or email address

http://www.petro-sim.com/forum/register.asp?FPN=2 - Profile Information
Make changes to personal information you have given

http://www.petro-sim.com/forum/register.asp?FPN=3 - Forum Preferences
Make changes to your forum preferences

http://www.petro-sim.com/forum/help.asp - Forum Help
Forum Help files and FAQ's to help you with any difficulties you may have when using the forum

 

 
Any ideas on how to go about getting a windows user setup as an administrator under these circumstances?  I can try a fresh install if you think that will help...
 
thanks
Barry


Posted By: WebWiz-Bruce
Date Posted: 06 July 2006 at 9:38am
You may find that you need to login directly to the forum as the forum administrators account in order to get these functions to appear.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting


Posted By: kastigeer
Date Posted: 06 July 2006 at 9:42am
But how can I do that when windows authentication is turned on ...  I lose the option to manually login as it's doing the login automatically as the forum folder is set in IIS to only allow windows authentication (in directory security) so that this works in webwiz
 
(apologies if I'm being thick about this and missing something obvious!)
 
thanks
Barry


Posted By: WebWiz-Bruce
Date Posted: 06 July 2006 at 9:51am
Navigate to the file admin.asp and then login as the admin

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting


Posted By: kastigeer
Date Posted: 06 July 2006 at 9:54am

Hmm, ok that's what I'm doing and the option for Admin and Moderator functions is definitely not there.

I think I should try a fresh install of the forums and then turn on authentication and see if anything is different (not that I've really made any changes to anything yet)
 
thanks
Barry


Posted By: kastigeer
Date Posted: 06 July 2006 at 10:45am
Ok I've done a bit more testing as this is what I have so far ..
 
Did a complete reinstall as follows:
copied the "forum" folder to the web server
In IIS admin set the "directory Security" for that folder to Integrated Authemtication only
Setup a new DB and ran the initial setup as per instructions
Logged on to the system - this happen as an AD user.
changed the last bit in the address from "/default.asp" to "/admin.asp"
logged in using the default administrator account and password
Went to "membership admin", clicked on the AD user account that had been automatically created (as "newbie" ) and then clicked on "Edit this members forum settings"
No option is available for "Admin and Moderator" functions - I'm pretty sure that when I click on the username and it pops up the new window for editing it's authenticating me as the AD user who is a "newbie" not the admin account
 
I then did a bit more fiddling - I went into the Database and changed the group membership for the AD account to "1" effectively making that account an admin account - I then logged on as the default administrator account (using /admin.asp) and checked that the AD user was an administrator.
The I logged on as the user by just opening a new browser and I then had the link to the Admin function in the top options, but when I click on it it asks for a password (the username cannot be changed) and it's not the password from AD so there's no way to go any further...
 
Is this something that can definitely be done?  To have an AD user be an administrator for the forums?
 
thanks
Barry


Posted By: WebWiz-Bruce
Date Posted: 06 July 2006 at 11:42am
The AD part at the moment is still relatively new, and until the last few weeks I didn't have an AD setup to test any of this on.

The AD feature is going to be developed further in future versions but for the moment anything other than just basic AD authentication may mean you will have to modify the code to get it to do what you want.


-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting


Posted By: kastigeer
Date Posted: 06 July 2006 at 11:49am

Ok thanks - I think I know where the problem lies - in the member forum admin area when you click on the users name to edit their profile it pops up a new window to do so and there is the button at the bottom of this screen to "edit this members profile" and I think that when windows authentication is turned on it is not passing through the fact that you are logged on as an administrator (ie not and AD account) when you click this button and instead logs you onto the new page (The "member control panel menu") it is doing so as a user not an administrator...

I'll see if I can figure something out about getting it working (always fun working with code you didn't write!) and let you know if I find anything.

 

thank

Barry



Posted By: WebWiz-Bruce
Date Posted: 06 July 2006 at 11:57am
For the moment one way around this is to give your AD authentication username and password field to the admin account in the database, this will mean that when you go to the forum you will always be logged in as the admin.

Further development will be carried out to streamline the process and build on the present AD authentication so that future versions will have a much better and simply way of setting this up.


-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting


Posted By: kastigeer
Date Posted: 06 July 2006 at 11:59am
Thanks - I'll try that route first.


Posted By: kastigeer
Date Posted: 06 July 2006 at 12:51pm
Ok you can't set the admin name to be the same as an AD username as the login then fails with a complaint about a duplicate field in the DB.
 
I can however confirm that for some reason when you logon as an administrator (using the default account and NOT and AD account) with windows authentication enabled that when you get to the admin pages (The forum control panel - admin_menu.asp) that the blnAdmin field is False, ie the account is not being properly recognised as an admin account ...
 
I'm going to keep looking but maybe this will give you a clue as to something minor to adjust...
 
Barry


Posted By: kastigeer
Date Posted: 06 July 2006 at 3:24pm
After a bit more digging I think there are two issues with using windows authentication.
 
The first I would imagine is quite easy to fix (easy for me to say!) - when someone logs in using windows authentication I don't believe that a cookie is being generated or used, so when getuserdata is called it does not return correct information such as the group to which the user belongs...  hence you even though an AD account may be a moderator you don't get moderator permissions when logged in.
 
The second has already been mentioned and is where after logging into the control panel as an admin user (non AD) when you try to edit a members profile it re-does an automatic logon and you end up viewing the members profile as the AD account you are using - which effectively will prevent any admin functions.
 
Barry


Posted By: WebWiz-Bruce
Date Posted: 06 July 2006 at 3:56pm
There is another topic on this same subject today, it maybe worth having a look in that topic about all these issues.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting


Posted By: switchbak
Date Posted: 23 August 2006 at 11:33pm
I can't find the other thread, so I'm gonna post this here.
 
Here's what I've done to populate my forum groups based on my Active Directory groups:
 
in functions_windows_authentication.asp i changed the code that says:
 
  'We need to get the start user group ID from the database
  'Initalise the strSQL variable with an SQL statement to query the database
                'strSQL = "SELECT " & strDbTable & "Group.Group_ID " & _
                '"FROM " & strDbTable & "Group" & strDBNoLock & " " & _
                '"WHERE " & strDbTable & "Group.Starting_group = " & strDBTrue & ";"
 
 
to
 
 
 
  dim ADS_SCOPE_SUBTREE
  dim objConnection
  dim objCommand
  dim objRecordSet
  dim distName
  dim arrMemberOf
  dim theGroup
  dim objUser
  dim theGroupList
  dim intPrimaryGroupID
     
  ADS_SCOPE_SUBTREE = 2
  Set objConnection = CreateObject("ADODB.Connection")
  Set objCommand = CreateObject("ADODB.Command")
       
  objConnection.Provider = "ADsDSOObject"
  objConnection.Open "Active Directory Provider"
       
  Set objCommand.ActiveConnection = objConnection
  objCommand.CommandText = "Select distinguishedName, primaryGroupToken from 'LDAP://DC=my,DC=domain'  where sAMAccountName=' " & strUserName & "'"
  objCommand.Properties("Page Size") = 100
  objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
  Set objRecordSet = objCommand.Execute
  If objRecordSet.RecordCount > 0 Then
   objRecordSet.MoveFirst
       
   distName = vbNullString
   distName = objRecordSet.Fields("distinguishedName").Value           
  else
   'user not found in AD
  End If
  
  if distName <> vbnullstring then
   'lookup all groups but primary
   Set objUser = GetObject("LDAP://" & distname)  
   arrMemberOf = objUser.GetEx("memberOf")
   intPrimaryGroupID = objUser.Get("primaryGroupID")
   For Each theGroup in arrMemberOf
    theGroupList = theGroupList & lcase(theGroup) & ","
   Next
   'look up primary group
   objCommand.CommandText = "< - ;(objectCategory=Group);distinguishedName,primaryGroupToken;subtree - ;(objectCategory=Group);distinguishedName,primaryGroupToken;subtree">LDAP://DC=my,DC=domain>;(objectCategory=Group);distinguishedName,primaryGroupToken;subtree "
   Set objRecordSet = objCommand.Execute
   objRecordSet.MoveFirst       
   Do Until objRecordset.EOF
    If objRecordset.Fields("primaryGroupToken") = intPrimaryGroupID Then
    theGroupList = theGroupList & lcase(objRecordSet.Fields("distinguishedName").Value) & ","
    End If
    objRecordset.MoveNext
   Loop
 
   'look for specific groups:
   'enterprise admins = db admins
   '_faculty = moderators
   'everyone else = newbies
   if instr(theGroupList,"enterprise admins,") <> 0 then
    'admin
    'We need to get the start user group ID from the database
    'Initalise the strSQL variable with an SQL statement to query the database
                  strSQL = "SELECT " & strDbTable & "Group.Group_ID " & _
                  "FROM " & strDbTable & "Group" & strDBNoLock & " " & _
                  "WHERE " & strDbTable & "Group.Name = 'Admin Group';" 
   elseif instr(theGroupList,"_faculty,") <> 0 then
    'moderators
    'We need to get the start user group ID from the database
    'Initalise the strSQL variable with an SQL statement to query the database
                  strSQL = "SELECT " & strDbTable & "Group.Group_ID " & _
                  "FROM " & strDbTable & "Group" & strDBNoLock & " " & _
                  "WHERE " & strDbTable & "Group.Name = 'Moderator Group';"
   else
    'newbies
    'We need to get the start user group ID from the database
    'Initalise the strSQL variable with an SQL statement to query the database
                  strSQL = "SELECT " & strDbTable & "Group.Group_ID " & _
                  "FROM " & strDbTable & "Group" & strDBNoLock & " " & _
                  "WHERE " & strDbTable & "Group.Starting_group = " & strDBTrue & ";"
   end if
  else
   'newbies
   'We need to get the start user group ID from the database
   'Initalise the strSQL variable with an SQL statement to query the database
                 strSQL = "SELECT " & strDbTable & "Group.Group_ID " & _
                 "FROM " & strDbTable & "Group" & strDBNoLock & " " & _
                 "WHERE " & strDbTable & "Group.Starting_group = " & strDBTrue & ";"
  end if



Print Page | Close Window

Forum Software by Web Wiz Forums® version 12.08 - https://www.webwizforums.com
Copyright ©2001-2026 Web Wiz Ltd. - https://www.webwiz.net