ActiveDirectory Class

Properties   Methods   Events   Configuration Settings   Errors  

The ActiveDirectory class can be used to authenticate users against Active Directory using Kerberos 5.0.

Class Name

IPWorksAuth_ActiveDirectory

Procedural Interface

 ipworksauth_activedirectory_open();
 ipworksauth_activedirectory_close($res);
 ipworksauth_activedirectory_register_callback($res, $id, $function);
 ipworksauth_activedirectory_get_last_error($res);
 ipworksauth_activedirectory_get_last_error_code($res);
 ipworksauth_activedirectory_set($res, $id, $index, $value);
 ipworksauth_activedirectory_get($res, $id, $index);
 ipworksauth_activedirectory_do_authenticate($res);
 ipworksauth_activedirectory_do_changepassword($res, $user, $oldpassword, $newpassword);
 ipworksauth_activedirectory_do_config($res, $configurationstring);
 ipworksauth_activedirectory_do_doevents($res);
 ipworksauth_activedirectory_do_interrupt($res);
 ipworksauth_activedirectory_do_listcomputers($res);
 ipworksauth_activedirectory_do_listgroupmembers($res, $group);
 ipworksauth_activedirectory_do_listgroups($res);
 ipworksauth_activedirectory_do_listusergroups($res, $user);
 ipworksauth_activedirectory_do_reset($res);

Remarks

The ActiveDirectory class authenticates users against Active Directory. Authentication is performed using the Kerberos protocol defined in RFC 1510 and RFC 4120.

Authentication

When Authenticate is called the class will attempt to authenticate the user with the Active Directory server. The class will communicate with the ADHost to obtain a service ticket and populate AuthToken. The following properties are required when calling this method:

• SPN (required)
• User (required)
• Password (required)
• ADHost (required)

A typical sequence of messages would be:

• KRB_AS_REQ -> KDC
• KRB_AS_REP <- KDC
• KRB_TGS_REQ -> KDC
• KRB_TGS_REP <- KDC
• AuthToken is populated with the constructed KRB_AP_REP message.

Communication with the ADHost can be seen through the PITrail event.