WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's the overview of the setup:

  • I have a multisite installation of WordPress 3.4.2.
  • I've installed the Active Directory Authentication Integration plugin to allow users to use their AD credentials. This also allows assigning AD groups to each site, so that the site admins do not manually have to assign permissions.
  • I have installed the Network Privacy plugin, so that certain sites must be logged into before you are able to see any content. Anonymous users only see the login page.

In many regards, this setup works. I am having one problem however, which is stopping me from rolling this out to our primary WordPress multi-site installation:

  • Bob is a member of the "IT Support" group in AD.
  • Bob is also a member of the "Domain Users" group in AD.
  • The main site (www.mysite.com) is locked down to only allow "Domain Users" members to login.
  • The sub-site (www.mysite.com/itsupport) is locked down to only allow "IT Support" members to login.
  • Bob visits www.mysite.com and is prompted for authentication. He enters his AD credentials and is allowed into the site.
  • Now that he's logged in on www.mysite.com, Bob clicks the link to go to www.mysite.com/itsupport and receives an error that he is not a member of the site.
    • It appears that no user entry has been created in the WordPress database for this sub-site.
  • Bob logs out of www.mysite.com.
  • Now that he is logged out, Bob goes directly to www.mysite.com/itsupport and is prompted for authentication. He enters his AD credentials and is allowed into the site.
    • It appears that the user entry in the WordPress database is created at this point for this sub-site.
  • Now if he logs out and logs into www.mysite.com, he can traverse to the itsupport site without any issues.

If I delete Bob's user entries for both sites and disable the Network Privacy plugin, Bob is able to login to www.mysite.com and then traverse to the itsupport site. But if I delete his user entries and re-enable the Network Privacy plugin, the problem reappears.

I had the same problem with one other privacy plugin, though I can't remember which one.

If you can spot the problem or if you have setup something similar, I'm willing to try anything, as long as I meet the basic criteria of using AD groups and being able to lock down certain sites.

share|improve this question
    
It sounds like a plugin / edge use case conflict. Have you checked with the plugin developer if it supports external user databases? – Damien Oct 3 '12 at 19:40
    
Damien - I've logged support items in the forums for both plugins. I'm just seeing if I can pick the brains of those who may have tackled something similar before. I don't believe that the privacy plugin really needs to know about external user databases, it just needs to let the AD plugin do its thing and add the user to the internal WordPress database. Unfortunately, the privacy plugin seems to be getting in the way of that. – Phil Erb Oct 3 '12 at 23:25
1  
How did you get on with this? Im researching a similar implementation for a school. – orionrush Jun 26 '13 at 12:26
    
It almost sounds like AD is only giving back the group that is assigned for that site - as in, "Hey, this is the IT site, so I'm only going to verify that the account logging in is the IT group and ignore the other groups." Maybe see if there is a way to get AD to remember all groups a user belongs to. – phatskat Apr 25 at 13:32

You should activate debug inside your wp-config.php file. Also, consider browsing the plugin directory for WPMU. They have tons of multisite plugins and I think one of them is what you may be looking for.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.