Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Here's the overview of the setup:

  • I have a multisite installation of WordPress 3.4.2.
  • I've installed the Active Directory Authentication Integration plugin (http://wordpress.org/extend/plugins/active-directory-authentication-integration/) to allow users to use their AD credentials. This also allows assigning AD groups to each site, so that the site admins do not manually have to assign permissions.
  • I have installed the Network Privacy plugin (http://wordpress.org/extend/plugins/network-privacy/), so that certain sites must be logged into before you are able to see any content. Anonymous users only see the login page.

In many regards, this setup works. I am having one problem however, which is stopping me from rolling this out to our primary WordPress multisite installation:

  • Bob is a member of the "ITSupport" group in AD.
  • Bob is also a member of the "Domain Users" group in AD.
  • The main site (www.mysite.com) is locked down to only allow "Domain Users" members to login.
  • The sub-site (www.mysite.com/itsupport) is locked down to only allow "ITSupport" members to login.
  • Bob visits www.mysite.com and is prompted for authentication. He enters his AD credentials and is allowed into the site.
  • Now that he's logged in on www.mysite.com, Bob clicks the link to go to www.mysite.com/itsupport and receives an error that he is not a member of the site.
    • It appears that no user entry has been created in the WordPress database for this sub-site.
  • Bob logs out of www.mysite.com.
  • Now that he is logged out, Bob goes directly to www.mysite.com/itsupport and is prompted for authentication. He enters his AD credentials and is allowed into the site.
    • It appears that the user entry in the WordPress database is created at this point for this sub-site.
  • Now if he logs out and logs into www.mysite.com, he can traverse to the itsupport site without any issues.

If I delete Bob's user entries for both sites and disable the Network Privacy plugin, Bob is able to login to www.mysite.com and then traverse to the itsupport site. But if I delete his user entries and re-enable the Network Privacy plugin, the problem reappears.

I had the same problem with one other privacy plugin, though I can't remember which one.

If you can spot the problem or if you have setup something similar, I'm willing to try anything, as long as I meet the basic criteria of using AD groups and being able to lock down certain sites.

share|improve this question
    
It sounds like a plugin / edge use case conflict. Have you checked with the plugin developer if it supports external user databases? –  Damien Oct 3 '12 at 19:40
    
Damien - I've logged support items in the forums for both plugins. I'm just seeing if I can pick the brains of those who may have tackled something similar before. I don't believe that the privacy plugin really needs to know about external user databases, it just needs to let the AD plugin do its thing and add the user to the internal WordPress database. Unfortunately, the privacy plugin seems to be getting in the way of that. –  Phil Erb Oct 3 '12 at 23:25
    
How did you get on with this? Im researching a similar implementation for a school. –  orionrush Jun 26 '13 at 12:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.