MoodleDocs - User contributions [en]

Talk:Capabilities/mod/forum:initialsubscriptions

2011-12-14T01:30:03Z

Molmos:

This page might need deleting, this setting has been removed in 2.2, see [http://tracker.moodle.org/browse/MDL-30151 MDL_30151].

Talk:Capabilities/mod/forum:initialsubscriptions

2011-12-14T01:28:02Z

Molmos:

This page might need deleting, this setting has been removed in 2.2 ([http://tracker.moodle.org/browse/MDL-30151 MDL-30151]).

Talk:Capabilities/mod/forum:initialsubscriptions

2011-12-14T01:26:35Z

Molmos: Blanked the page

Talk:Capabilities/mod/forum:initialsubscriptions

2011-12-14T01:26:00Z

Molmos:

This should probably be deleted, as this permission has been removed as I understand ([http://tracker.moodle.org/browse/MDL-30151 MDL_30151]).

Talk:Capabilities/mod/forum:initialsubscriptions

2011-12-14T01:24:41Z

Molmos: Created page with "This should probably be deleted, as this permission has been removed as I understand ([http://tracker.moodle.org/browse/MDL-16665 MDL_16665])."

This should probably be deleted, as this permission has been removed as I understand ([http://tracker.moodle.org/browse/MDL-16665 MDL_16665]).

CentOS Linux installation

2011-02-16T03:02:36Z

Molmos: Typo: Than -> Then

{{Moodle 2.0}}

Installing Moodle 2.0 on stock version of CentOS 5.5 is not that straightforward due to a limitations imposed by the software available in the default repositories.

So let us go step by step in configuring and installing Moodle 2.0 on CentOS 5.5.

== Asumptions ==
* We have just a minimal OS installation
* PHP is not installed
* No RDBMS is installed
* Apache is not installed
* We plan on using MySQL as Moodle RDBMS

== Requirements ==
As you may or may not know Moodle 2.0 requires following versions of software:

{| class="nicetable"
|-
! Element
! Version
|-
| PHP
| 5.2.8 (5.3.3 or more recent recommended)
|-
| MySQL
| 5.0.25 (5.5.x recommended)
|-
| Apache
| 2.2.x (CentOS ships with 2.2.3)
|}

=== PHP ===

By default CentOS 5.5 ships with PHP 5.1.6. It is very old version and unsupported by Moodle 2. To avoid recompiling PHP I recommend use of certified PHP build -[http://www.zend.com/en/products/server-ce/downloads Zend Server 5.x Community Edition] .

==== Installation ====
Before being able to download it you will need to register and login on the site which is free of charge. Site offers several options for installing the product and the one I recommend is the RPM installer.

You can find detailed description of this process [http://files-source.zend.com/help/Zend-Server-Community-Edition/zend-server-community-edition.htm#rpm_installation.htm here]. Make sure to install PHP 5.3 for the best results.

Execute this in command line
<code php>
sh install_zs.sh 5.3 ce
</code>

and after all the installation process add this package:

<code php>
yum -y install php-5.3-xmlrpc-zend-server
</code>

Finally start the zend server:

<code php>
service zend-server start
</code>

==== Configuration ====
Zend Server can be configured using nice web frontend that can be accessed through <code>http://<server url>:10082/ZendServer/</code> .

We will not go into details of how to use it but instead I will just list the PHP options and their recommended values that you should set.

<code php>
date.timezone=<Your server timezone>
display_errors=Off
expose_php=Off
max_execution_time=80
memory_limit=256M
realpath_cache_size=200K
realpath_cache_ttl=200
zend_optimizerplus.memory_consumption=80
</code>

Also disable all extensions that Moodle does not use to speed things up.

=== MySQL ===

MySQL is a good choice for Moodle RDBMS but it requires a bit more tackling to get adequate power. CentOS repositories ship with older version of MySQL (5.0.77 at the time of writing). It is highly recommended to install and use MySQL 5.5 using Oracle's official rpm packages.

==== Getting the packages ====
To do that go to [http://dev.mysql.com/downloads/mysql/5.5.html#downloads MySQL 5.5. GA download page].
Download the client utilities ( MySQL-client-5.5.x-x.rhel5.xxxx.rpm ) and MySQL Server (MySQL-server-5.5.x-x.rhel5.xxxx.rpm) package.

==== Installation ====
After that install the downloaded packages by executing this from command line:

<code> rpm -ivh MySQL-* </code>

==== Configuration ====
MySQL 5.5 does not install any configuration file by default so we need to create one. You can use one of the existing configuration files as starting points for your personalized configuration. They are located here:

<code php>
/usr/share/mysql/my-huge.cnf
/usr/share/mysql/my-innodb-heavy-4G.cnf
/usr/share/mysql/my-large.cnf
/usr/share/mysql/my-medium.cnf
/usr/share/mysql/my-small.cnf
</code>

To use any of these just copy them to the /etc/my.cnf. For example:

<code>
cp /usr/share/mysql/my-medium.cnf /etc/my.cnf
</code>

For the purporse of installing Moodle 2.0 this is the configuration that I recommend as a starting point for a small Moodle instance:

<code php>
[client]
port = 3306
socket = /var/lib/mysql/mysql.sock

[mysqld]
port = 3306
socket = /var/lib/mysql/mysql.sock

character-set-server=utf8
collation-server=utf8_bin

innodb_buffer_pool_size=400M
innodb_additional_mem_pool_size=40M
innodb_log_file_size=100M
innodb_log_buffer_size=4M
innodb_flush_method=O_DIRECT
transaction_isolation=READ-COMMITTED

#You can disable the TCP/IP protocol support
#and all of the communication will be done through UNIX sockets
skip-networking

#If you use additional web applications or other programs
#that do not support connections through UNIX Sockets,
#do not disable TCP/IP. Just force the
#server to accept connections only from localhost
#bind-address=127.0.0.1

#Disable symbolic links
symbolic-links=0
</code>

If you plan on having heavy duty Moodle instance with a lot of users you should increase <code>innodb_buffer_pool_size</code> and <code>innodb_log_file_size</code>, and of course add more RAM.

Do not forget to start the server.

<code>service mysql start</code>

==== Database ====
Now it is time to create database for the Moodle. This is the recommended command:

<code php>
create database <dbname> character set=utf8 collate=utf8_bin;
</code>

The reason for specifying collation as utf8_bin is that it is the only collation that offers proper treatment of special and accented characters in sorting and comparison. For more details on this see this [http://moodle.org/mod/forum/discuss.php?d=163766 forum thread].

=== Apache ===
Apache will be installed autoimaticly by the zend-server installation script. The only thing we should do is to slightly optimize the default configuration. To do that we should modify the <code>/etc/httpd/conf/httpd.conf</code> file.

These are the recommended settings that should be added or modified:

<code php>
#Display only web server name without any additional info
ServerTokens Prod

#....

<Directory "/var/www/html">
# ....
Options -Indexes FollowSymLinks
AllowOverride None
#...
#add this to activate compressing and caching of the pages
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE image/svg+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/atom_xml
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE application/x-httpd-php
AddOutputFilterByType DEFLATE application/x-httpd-fastphp
AddOutputFilterByType DEFLATE application/x-httpd-eruby
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE text/ecmascript
AddOutputFilterByType DEFLATE text/js
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4\.0[678] no-gzip
BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
Header append Vary User-Agent env=!dont-vary
ExpiresActive On
ExpiresByType image/gif A2592000
ExpiresByType image/png A2592000
ExpiresByType image/x-icon A2592000
ExpiresByType image/jpeg A2592000
ExpiresByType image/pjpeg A2592000
ExpiresDefault "access plus 1 day"
FileETag none
</Directory>

#...
#Disable any additional server info on error pages
ServerSignature Off

</code>

=== Moodle ===
We need now to obtain and deploy Moodle files. We will use the simplest deployment scenario that involves minimal ammount of work and offers at the same time appropriate level of security.

==== Getting Moodle ====
Download from moodle.org latest stable release of Moodle 2 and unpack it into <code>/var/www/html</code> .

<code php>
cd /tmp/
wget http://download.moodle.org/download.php/direct/stable20/moodle-latest-20.tgz
tar xzpf moodle-latest-20.tgz -C /var/www/html/
</code>

==== Configuring file structure ====
Now that we have moodle files deployed in <code>/var/www/html/moodle/</code> we need to add a directory for moodledata.

<code php>
mkdir /var/www/moodledata
</code>

And now to apply appropriate file permissions for both directgories.

First moodle directory:
<code php>
chown -R root:apache /var/www/html/moodle/
chmod -R u=rwX,g=rX,o= /var/www/html/moodle/
</code>

And than moodledata directory:
<code php>
chown -R root:apache /var/www/moodledata/
chmod -R ug=rwX,o= /var/www/moodledata/
</code>

==== Installation ====
Start the installation in a usual manner. Make sure to enter the valid name of the database you just created, choose mysqlnd/mysqli as database driver and '''make sure to select "Unix socket" option for best performance'''.

[[Image:db_connection.png]]

Because of the way we applied file permissions to the <code>/var/www/html/moodle/</code> directory installation will not be able to save <code>config.php</code>. Just copy the content of the file from the browser and manually add it to the directory.

==== CRON ====
To reflect the changes in Moodle 2.0 and use of Zend Server procedure for activating cron is following:

Copy the following content and save it into <code>/etc/cron.hourly/moodle2.cron</code> .

<code php>
#!/bin/sh
/usr/bin/sudo -u apache /usr/local/zend/bin/php-cli /var/www/html/moodle/admin/cli/cron.php
</code>

Then mark the file as executable:

<code php>
chmod u=rwx,go= /etc/cron.hourly/moodle2.cron
</code>

[[Category:Administrator]]
[[Category:Moodle_2.0]]
[[Category:Installation]]

Multimedia plugins filter

2010-11-05T02:17:29Z

Molmos:

Location: Multimedia Plugins settings link in ''Site administration > Modules > Filters > Manage filters''

The Multimedia plugins filter finds URLs that point to multimedia resources in text and replaces them with an appropriate multimedia player.

== Supported media formats ==
* .mp3 - MPEG Audio Stream, Layer III
* .swf - Macromedia Flash Format File (Adobe, Inc.)
* .mov - QuickTime Video Clip (Apple Computer, Inc.)
* .wmv - Windows Media File (Microsoft)
* .mpg - MPEG Animation
* .avi - Audio Video Interleave File
* .flv - Flash Video File (Macromedia, Inc.)
* .ram - RealMedia Metafile (RealNetworks, Inc.)
* .rpm - RealMedia Player Plug-in (RealNetworks)
* .rm - RealMedia Streaming Media (Real Networks, Inc.)
* .mp4 (in Moodle 1.9.6 onwards)
* .m4v (in Moodle 1.9.6 onwards)

In Moodle 1.9.6 onwards, a YouTube link filter (disabled by default) is also available.

== Usage ==

Insert the URL of the multimedia resource into your text (which can be the URL of a file in the course files area). When displayed a suitable player will be provided. Moodle detects the media type using the filename extension, so you should ensure that the file contents match the extension correctly.

For some file types, like Flash, you can size the plugin using an extended syntax:

<a href="somepath.swf?d=640x480">My link name</a>

where the first number is the width in pixels, and the second is the height.

== Required Software ==

Although Moodle prepares the media files to be played in the browser, the actual playback is handled by various types of browser plug-in software, primarily Adobe Flash, Quicktime, Windows Media Player and Real Player. If users do not have these installed they may be prompted to go and install them by their browser. These pieces of software are generally free, easily installed and widely used so this will only be an issue for small numbers of users.

== Settings page ==
The settings page is in the administration block. Prior to version 1.7, this can be reached from ''Configuration > Filters > MultiMedia Plugins''. In 1.7 it can be found via ''Administration > Modules > Filters > MultiMedia Plugins''. In 1.8 it can be found via:
''Notifications > Modules > Filters > MultiMedia Plugins > Settings''.

There is an individual setting to turn on or off each supported media type. Note that by default all but the Flash (.swf) filter are enabled. As Flash files present a theoretical security risk, it is strongly recommended not to allow users to add flash content.

== YouTube Link Filter ==

The youtube filter uses a custom delimiting tag inserted anywhere within the text of a resource to embed and display an embedded youtube player
without having to paste the embed code into the HTML of the page. It is also designed to ignore youtube links placed in standard <a href> tags.

* Enable the filter from the administration menu in Moodle: Modules -> Filters -> Manage filters.
* To embed the youtube video, enclose the video URL in [youtube] tags. Note that there is no closing tab ([/youtube]) - simply us e the regular tag again.
* Videos that cannot be embedded will display with an error message and a standard html link to the video on youtube.
* Youtube links placed inside of <a href> tags are designed to display normally as HTML.
* The filter does its best to strip out additional php GET parameters. Example: anything after the video ID root in the URL, starting with the first '&': http://www.youtube.com/watch?v=ahuduPpZJQA(-->)&feature=featured)
* Multiple links can be placed within a page.

Examples:
* RIGHT:
**This is some text of a page.[youtube]http://www.youtube.com/watch?v=zs2XiyLYJOo[youtube] This is some more text in a page.
** This is some text that has a non-embedable video. [youtube]http://www.youtube.com/watch?v=ahuduPpZJQA&feature=featured[youtube]
** This is some text of a page.<a href='http://www.youtube.com/watch?v=zs2XiyLYJOo'>This video will show up as a standard html link.</a> This is some more text in a page.

* WRONG:
** This is some text of a page.[youtube]http://www.youtube.com/watch?v=zs2XiyLYJOo[/youtube] This is some more text in a page.
** This is some text of a page. http://www.youtube.com/watch?v=zs2XiyLYJOo This is some more text in a page.

* Advanced Quirk:
** A youtube url that is place in a resource that is the only text on the page will display, but will not if any other text or HTML on the page exists.

== See also ==

* [[Filters]]
* [[MP3 player]]
* [[Audio in Moodle]]
* [[Speech tools]]

Using Moodle forum discussions:
* [http://moodle.org/mod/forum/discuss.php?d=37119 Multimedia plugin vs object embed]
* [http://moodle.org/mod/forum/discuss.php?d=29588 Size of embedded Flash]
* [http://moodle.org/mod/forum/discuss.php?d=89416&parent=394828 Linking to FLV video files]
* [http://moodle.org/mod/forum

/discuss.php?d=90781 video streaming]
* [http://moodle.org/mod/forum/discuss.php?d=95174 Media filter does not work for rm files]
* [http://moodle.org/mod/forum/discuss.php?d=98698 swf filter security]
* [http://moodle.org/mod/forum/discuss.php?d=125619 How to upload a screen capture video to the Moodle?]
* [http://moodle.org/mod/forum/discuss.php?d=143478 Best video format]

[[Category:Filter]]

[[pl:Pluginy_Multimedia]]
[[ja:マルチメディアプラグイン]]
[[de:Multimedia Plugins]]
[[fr:Extensions multimédia]]
[[es:Multimedia plugins (filtro)|Multimedia plugins]]

Development:Theme changes in 2.0

2010-07-19T06:42:38Z

Molmos: Typo: plugins->exluded_sheetes

{{Work in progress}}
{{Infobox Project
|name = Theme changes
|state = Implementation
|tracker = MDL-20204
|discussion = [http://moodle.org/mod/forum/discuss.php?d=140089 HEADS UP: Major theme changes landing]
|assignee = [[User:Petr Škoda (škoďák)|Petr Škoda (škoďák)]] + feedback and ideas from other developers
}}
{{Moodle 2.0}}

=Goals=
The main goals are:
# easier theme customisations - both CSS and images
# simplify core and themes code
# significant performance improvements
# solve majority of browser caching problems
# use YUI CSS foundation
# allow themes to be stored in separate directory without www access (such as dataroot)

It should be easy to upgrade simple older themes. I think it is better if old themes are completely disabled with reasonable fallback mechanism. Why should we display broken themes during upgrade? Imagine users or teachers can select "broken" themes in the course edit page or a profile, I think it is more professional to display only new and upgraded themes in selectors instead of pretending old themes will work 100%. We have to make sure old themes will not cause fatal white screen errors.

=Design overview=

All theme files are served through two files ''/theme/styles.php'' and ''/theme/image.php''. More advanced themes may serve extra javascript files through the ''/theme/javascripts.php'' file and a new config option with list of JS files. This approach allows us to parse the resulting CSS and replace all image placeholders and theme settings with current values.

All CSS style sheets (including YUI, plugin CSS and parent themes) are merged into a single large CSS file served via the /theme/styles.php file. This script accepts following parameters:
* '''theme''' (string) - name of the theme
* '''rev''' (int) - theme revision number stored in $CFG->themerevision

All options and features are reviewed and optimised. Backwards compatibility is not a primary concern, future possibilities and easy maintenance are always favoured.

==Theme directory structure==

{| class="nicetable"
|-
! <center>''File/folder'''</center>
! <center>'''Description''</center>
|-
| db/ (optional)
| Installation and upgrade hooks - use of db tables is not recommended.
|-
| lang/
| Folder with standard language files - name of theme, usage information, settings. Standard themes store lang files in /lang/ for now.
|-
| layout/*.php
| Folder with page layout templates
|-
| pix/
| Folder with theme pictures - used from CSS or layout only, not used from other plugins.
|-
| pix_core/ (optional)
| Folder with overridden core images and icons from /pix/ folder
|-
| pix_plugins/ (optional)
| Folder with overridden plugin icons - structure is typeofplugin/pluginname/ which maps to pix folder in plugins
|-
| style/*.css
| Style sheet files referenced from the config.php.
|-
| config.php
| Theme configuration - see bellow.
|-
| lib.php (optional)
| Library functions - custom css post-processing, custom render factory, theme init function
|-
| renderers.php (optional)
| Custom renderers used from custom renderer factories.
|-
| settings.php (optional)
| Custom theme settings - colours, logos, etc. Settings are applied in custom css post-processing function.
|-
| version.php
| Needed for install and upgrade hooks, states compatibility with specific Moodle versions. Used for triggering of cache purging.
|}

==Theme config.php==

The theme config.php structure is simplified and a bit more flexible. The goal is to make overriding of parent themes simple and easy to understand. Please note global $THEME variable is not available any more, use theme property in current page instance instead.

<code php>$THEME->parents = array('standard', 'purple');</code>
Lists all parents top-down, each theme contains the full list of parents, this is non-recursive and more flexible specification without any limits. Originally the number of parent levels was restricted.

<code php>$THEME->sheets = array('styles_layout', 'styles_fonts', 'styles_color');</code>
The same as before, lists files from current theme directory.

<code php>$THEME->parents_exclude_sheets('standard'=>array('styles_moz'), 'purple'=>array('styles_fonts'));</code>
It is also posssible to use ''true'' instead of array in order to specify ''all'' sheets or all sheets in all parents, if not specified the value from the parent theme is used.

<code php>$THEME->editor_sheets = array('styles_tinymce');</code>
We can not load the full CSS file into the HTML editor's content area, instead we load editor sheet from lib/editor/editorname/editor_sheets.css and also sheets specified in theme.

<code php>$THEME->plugins_exclude_sheets('mod_book', 'gradereport_grader');</code>
Ideally all plugin specific CSS should be stored in styles.css file separately in each plugin. This option lists plugins that should be excluded from this theme, if not specified the value from the parent theme is used.

<code php>$THEME->layouts = array(...);</code>
The complete list of layouts is in theme/base/config.php. Page layouts are in fact high level templates that are using PHP syntax. The template files are stored in layout/ subdirectory. Each page layout has specification of block areas and link to template file. Themes may also reference layouts files from other themes.

<code php>$THEME->resource_mp3player_colors, $THEME->filter_mediaplugin_colors</code>
Obsoleted. If not specified the value from the parent theme is used. All these should be moved to real theme settings.

<code php>$THEME->rendererfactory = 'standard_renderer_factory';</code>
The same as before. It is the name of class that returns needed instances of core and plugin renderers. defined in core some library or theme/themename/lib.php or theme/themename/renderers.php

<code php>$THEME->csspostprocess = 'csspostprocess';</code>
Name of custom CSS post-processing function, this function is usually defined in theme/themename/lib.php.

<code php>
$THEME->javascripts = array('navigation');
$THEME->javascripts_footer = array('someJSlibrary');
</code>
List of extra javascript files that are included on each page. Themes can not include extra scripts from the theme folder because the folder may not be accessible via web.

=Implementation=

==One huge CSS sheet==

Each page includes only one huge style sheet. All theme sheets are served by a /theme/styles.php script. Page parameters specify the theme name and revision.

The CSS concatenation is done from the YUI CSS, styles.css from all plugins and theme style sheets starting with top most parent and current theme last, please note the order is very important. The algorithm is following:
# YUI2 CSS
## merge all YUI2 CSS into one file, respect correct order of files
# plugins CSS
## go through all plugins and search for styles.css - put the list into array, use component names as keys, locations as values
## filter out excluded sheets specified in current $THEME->plugins_exclude_sheets
# theme CSS
## go through all sheets defined in all parents and store all $THEME->sheets in array
## filter out excluded sheets specified in current $THEME->parent_exclude_sheets
# resolve real image locations
## regex search for <nowiki>[[pix:componentname|imagewithsibdirnoext]]</nowiki>
## priority is: current theme, parent themes, then plugin or YUI fodlers
## images in web accessible areas are linked directly, images in dataroot would have to go through /theme/image.php?theme=xxx&file=/sub/img&component=moodle&rev=-1
# apply theme admin settings - values and image locations

Please note that the current $PAGE->requires->css() is suitable mostly for user supplied CSS for data content such as the custom CSS used in mod/data/ module.

The YUI3 reset CSS is loaded separated before this huge combined CSS stylesheet, YUI3 loader may load CSS on the fly from Javascript.

==Theme caching==

Potential problems are:
* server performance - the merging of all CSS, parent themes and image resolving is relatively expensive
* bandwidth - longer caching, fewer files and optional gzip compression
* stale data in browser caches - different file needs to be served when anything in CSS changes

The theme CSS content depends on:
* current theme
* theme revision

The theme revision is stored in $CFG->themerev, it is an integer counter incremented after installation/upgrade of any plugin or core. The revision value -1 is used in theme designer mode to prevent the caching completely.

All images used both from PHP and CSS have to be cached too. This is handled automatically in /theme/image.php which accepts similar parameters like the styles.php script.

==The theme designer mode==

Administrator, theme designers and developers often need to tweak CSS or images. In previous versions users had to purge the browser caches manually.

In theme designer mode no CSS is cached on server or in browser, each changes are immediately visible. The switching on of this mode immediately invalidates old caches, the caching is turned on again after switching it off. This mode causes higher server load.

This mode also disables all CSS cleanup and compression, all comments are kept and extra debug information can be included in CSS.

This setting is available from the Appearance settings page.

==Performance improvements==

There are several possibilities for more performance improvements:
* storing of final CSS files in dataroot - caches need to be deleted after each theme revision change; this could significantly reduce server load
* longer lifetimes - revision parameter eliminates the stale CSS in browser cache completely , lower bandwidth consumption
* gzip compression - faster page loading on first page
* remove comments and useless white space
* etc.

==Browser hacks==

Old meta.php was used mostly for conditional loading of IE specific hacks. Open University developed alternative solution which adds browser specific classes to body html element. This can be implemented in the pagelib method returning standard body tags.

<body class="ie ie7">

#mypage .whatever {
/** normal rules */
}
.ie6#mypage .whatever {
/** broken rules */
}

OU used these hacks not only for IE ;-)

==RTL support==

Originally RTL tweaks were stored in separate files. Now we use the same body class tweaks as described above.

<body class="dir-rtl">

#mypage .whatever {
/** normal rules */
}
.dir-rtl #mypage .whatever {
/** RTL rules */
}

==YUI==

Moodle started using YUI framework around 1.7, until 2.0dev we did not use any UI widgets that required CSS. The problem is that the YUI needs to be loaded before theme and plugin CSS, second problem is that standard YUI CSS requires reset CSS which greatly improves A-grade browser compatibility and helps theme designers.

YUI3 implements new loaders both for CSS and JS, there is a complementing PHP dependency loader for YUI.

===YUI CSS foundation===

Moodle styles are based on YUI foundation? Why not? The benefits are:
* eliminates some different HTML defaults (margins, paddings, font sizes, etc.) [http://developer.yahoo.com/yui/reset/ (YUI CSS Reset)]
* consistent font sizing and better font-family degradation [http://developer.yahoo.com/yui/fonts/ (YUI CSS Fonts)]
* the standard YUI CSS is already built on top of this foundation
* incredibly simple table-less page layouts that include nesting [http://developer.yahoo.com/yui/fonts/ (YUI CSS Grids)] (optional, themes do not have to use it for layout)

===YUI widgets customisation===

The standard YUI CSS has to be loaded after YUI CSS Base (Reset+Fonts+Grids), but before our own CSS. Overriding of YUI stylesheets should not depend on the order of loading, we only guarantee that the YUI CSS foundation sheets are loaded before any other CSS, customisations of YUI skins has to use moodle class selectors.

===YUI versioning===

In 1.9 we store all YUI files in /lib/yui/ folder, this was a problem when upgrading to YUI version from upstream because the old files could be still cached in browsers.

In 2.0 we are finally replicating the YAHOO directory structures, each new version is stored in separate directory.

===Combination of YUI 2 and 3===

YUI 3 uses JS autoloading which is a great step forward and simplification. Unfortunately we still need the YUI2 libraries around for some time, luckily YUI2 libraries may coexist with YUI3 code.

==The image resolver==

Images are used in html code and in CSS style sheets. The problem is easy to solve in PHP code, partial solution was already present in Moodle 1.9 - see $CFG->pixpath

In 2.0dev there was implemented a new icon_finder class, it can be replaced by much simpler rules, we could also add pix support into all plugins.

Image locations:
* /mod/modulename/pix/, blocks/blockname/pix/ - in all plugins
* /theme/themename/pix/ - theme images
* /theme/themename/pix_core/ - overridden images from core /pix/ folder
* /theme/themename/pix_plugins/plugin/plugintype/ - overriding of plugin images in themes

The standard API is <code>$OUTPUT->pix_url($componentname, $imagename, encoded)</code> when used from PHP and <nowiki>[[pix:componentname|imagename]]</nowiki> if used in CSS.

Image resolved allows us to serve images from dataroot via /theme/image.php script and also solves all browser caching issues.

==Themes in extra directory==

Themes in dataroot is a frequently requested feature. Some admins might not like this, it should be optional. Some really advanced themes with lots of custom files might not be compatible at first. In fact it does not have to be dataroot, this location is configurable via $CFG->themedir.

In the stable branch we have a strange mix of standard themes. Moodle 2.0 is expected to include following themes:
* base - bare bones minimal theming that most other themes build on
* standard - basic theme that can be used as base for really simple themes (the exact look of new standard theme is not decided yet)
* customcolor - standard with admin specified colour palette and custom logos (not confirmed)
* and many other fancy modern themes like anomaly ( optionally with multiple configuration settings)

Other contrib themes could be available via web interface from Moodle configuration in some future Moodle version.

==Admin theme settings==

Very often users need to make small tweaks to standard themes such as different colour or logos. There should be a way to keep this settings in config_plugin and files separately in dataroot. Settings are placed in /theme/themename/settings.php. This new feature could significantly reduce known theme upgrade problems in the future.

This feature replaces the original CSS constants and will probably use the same syntax. The original CSS constants required modifications in dirroot which was in some cases unacceptable. CSS constants would not be compatible with automatic updates vie web interface anyway.

This feature requires advanced caching of CSS. These settings and files should be available in layouts and renderers too.

The actual replacing of setting placeholders by setting values is performed in custom css post-processing function specified in config.php. Logos and other custom images would be specified as external URLs, later we could also add basic support for storage of these custom theme files in standard Moodle filesystem.

==Page layout==
Each page may specify one of standard page layouts that are defined in theme/base/config.php. It is not possible to add custom layouts.

Layout definition consists of:
* template file specification - template name + file name without extension
* definition of regions
* default region

New layouts will not be added in the STABLE CVS branches.

==Renderers==

Renderers are small methods that render visual elements using functional programming - our old style PHP style.

Module may define own renderer class and use own renderer methods. Themes may override both core and plugin renderers however you need to have some more advanced understanding of PHP and Moodle design in general.

==Templates (maybe in future)==

Similar to page layouts but much smaller parts of UI that are embedded into pages. This is a new feature that is not used in Moodle core yet.

Code developers may choose to use templates instead of renderers for some larger parts of UI, they may also use renderers from templates. The major difference is that templates accept just one $DATA object with all parameters, templates might be also much easier to use&understand for typical theme designers.

The original emulated templates approach was replaced because it was designed for code developers, not designers. I think it is much easier to just copy templates from core or plugins into themes and tweak them, instead of the reverse engineering of the renderers.

Please note this does not mean that Moodle is switching to templates now, but technically we could, plugin developers would decide to do so independently. This topic should be revisited in Moodle 2.1dev.

==Other API changes==

* added ''course'' layout
* $PAGE->set_generaltype() replaced by $PAGE->set_pagelayout() because it really switches to one of the layouts from the standard theme; also the complete list of layouts is given in theme/standard/config.php - there is no way to add plugin layouts, the $PAGE->set_pagelayout() is used from core and plugin code, not from themes, so it is not possible to add new layouts at all (and never was)
* name things ''moodle_*'' only if potential conflicts exist, everything plugin related should be named ''componentname_'' (mod_ is usually an exception)- this was discussed several times before; renamed ''moodle_core_renderer' class to ''core_renderer'', etc.
* themes are now real plugins with capabilities, lang packs, upgrade code, settings, upgrade code, etc. - it is not recommended to create new db table though

=Backwards compatibility and upgrades=

BC is very limited, all themes and modules need to be manually updated. Keeping old themes during the upgrade must not cause fatal PHP errors. Old themes can be detected by searching for /theme/oldtheme/styles.php, this file will not be present in the new themes any more. Moodle core would simply use the specified parent theme or the standard theme.

==Theme upgrade steps==
# delete styles.php
# redefine all config.php options - in majority of cases change parent value to parents array
# rename styles_ie6.css and styles_ie7.css to styles_layout_ie6.css and styles_layout_ie7.css - each normal sheet may have an extra sheet with _ieX suffix now, these are loaded automatically, excluding is applied based on $THEME->parents_exclude_sheets() info from the current theme
# rename rtl.css to styles_layout_rtl.css - again each normal style sheet may have extra sheet with _rtl suffix similar to IE hacks sheets
# delete header.html, footer.html and meta.php - obsoleted by $THEME->layouts option and new layout files
# add custom layouts and rendereds

In order to minimize confusion during the upgrade, the old themes will be ignored and will be listed os "Incompatible" on the theme selection page - this page is probably the first place admins go in order to diagnose theme problems.

==Module upgrade steps==
* rename mod/modname/styles.php to styles.css
* put all images into mod/modname/pix/
* replace $CFG->pixpath with $OUTPUT->pix_url('imagename', 'mod_modname')

==Removed features==
# '''sometheme/meta.php''' - used mostly for IE6/7 hacks, custom layouts may be used instead
# '''smartpix''' - completely obsoleted by the new image location resolution algorithm
# '''styles.php''' replaced by styles.css, supported in all plugin types - the PHP syntax is not needed anymore because images are specified using <nowiki>[[pix:component|dir/image]]</nowiki> syntax and we can also use custom css post-processors
# '''$CFG->pixpath''' replaced by $OUTPUT->pix_url()
# '''CSS constants''' replaced by the admin theme settings
# separate IE6 and IE7 sheets - replaced by body class attributes
# separate RTL sheets - replaced by body class attribute

=Expected reactions=

{| class="nicetable"
|-
! <center>'''User type'''</center>
! <center>'''Negative'''</center>
! <center>'''Positive'''</center>
|-
| Core developer
| none
| No backwards compatibility headaches. Powerful new features. More flexible API.
|-
| Contrib developer
| Has to learn new API and upgrade current code.
| New useful pix folder and standard styles.css in all plugins. $OUTPUT->pix_url() more flexible then old pixpath.
|-
| Theme designer
| Has to learn new theme API. Old advanced themes has to be completely redesigned. Has to understand YUI CSS foundation.
| They can finally override core and plugin images. Easier distribution of custom themes. New income opportunity. Basic theme structure is simplified. No browser caching issues when designing themes.
|-
| Administrator
| All themes need to be updated. Old themes are ignored.
| Much easier installation (optionally in dataroot) and easy customisation without code modification (images and colours for example). Much safer upgrades. Possibility to upgrade theme via web interface. No browser caching issues when upgrading themes. Better performance and lower server load.
|}

==See also==

Using Moodle forum discussions:
* [http://moodle.org/mod/forum/discuss.php?d=131219 Yet more theme changes proposal]
* [http://moodle.org/mod/forum/discuss.php?d=140089 HEADS UP: Major theme changes landing]
* [[Development:Output_renderers]]

[[Category:Themes]]

Performance recommendations

2010-04-01T01:27:31Z

Molmos: /* Obtain a baseline benchmark */

Location: ''Administration > Server > Performance''

Moodle can be made to perform very well, at small usage levels or scaling up to many thousands of users. The factors involved in performance are basically the same as for any PHP-based database-driven system. When trying to optimize your server, try to focus on the factor which will make the most difference to the user. For example, if you have relatively more users browsing than accessing the database, look to improve the webserver performance.

==Obtain a baseline benchmark==

Before attempting any optimization, you should obtain a baseline benchmark of the component of the system you are trying to improve. For Linux try [http://lbs.sourceforge.net/ LBS] and for Windows use the Performance Monitor. Once you have quantitative data about how your system is performing currently, you'll be able to determine if the change you have made has had any real impact.

The overall aim of adjustments to improve performance is to use RAM (cacheing) and to reduce disk-based activity. It is especially important to try to eliminate swap file usage as much as you can. If your system starts swapping, this is a sign that you need more RAM.

The '''optimization order preference''' is usually: primary storage (more RAM), secondary storage (faster hard disks/improved hard disk configuration), processor (more and faster).

==Scalability==

Moodle's design (with clear separation of application layers) allows for strongly scalable setups. (Please check the list of [[Large installations|large Moodle installations]].)

Large sites usually separate the web server and database onto separate servers, although for smaller installations this is typically not necessary.

It is possible to load-balance a Moodle installation, for example by using more than one webserver. The separate webservers should query the same database and refer to the same filestore area, but otherwise the separation of the application layers is complete enough to make this kind of clustering feasible. Similarly, the database could be a cluster of servers (e.g. a MySQL cluster), but this is not an easy task and you should seek expert support, e.g. from a Moodle Partner.

'''See also''':
*[[Server cluster]]
*[http://moodle.org/mod/forum/discuss.php?d=4801 Scalability] forum discussion.
*[http://moodle.org/mod/forum/discuss.php?d=57202 Moodle clustering] forum discussion.
*[http://moodle.org/mod/forum/discuss.php?d=44470 Software load balancing] forum discussion.
*[http://moodle.org/mod/forum/discuss.php?d=49986 TCP load balancing] forum dicsussion.

==Hardware configuration==
'''Note''': The fastest and most effective change that you can make to improve performance is to '''increase the amount of RAM on your web server''' - get as much as possible (eg 4GB). Increasing primary memory will reduce the need for processes to swap to disk and will enable your server to handle more users.
* Better performance is gained by obtaining the best '''processor capability''' you can, i.e. dual or dual core processors. A modern BIOS should allow you to enable hyperthreading, but check if this makes a difference to the overall performance of the processors by using a [http://en.wikipedia.org/wiki/Super_PI CPU benchmarking tool].
* If you can afford them, use '''SCSI hard disks''' instead of SATA drives. SATA drives will increase your system's CPU utilization, whereas SCSI drives have their own integrated processors and come into their own when you have multiple drives. If you must have SATA drives, check that your motherboard and the drives themselves support NCQ (Native Command Queuing).
* Purchase hard disks with a '''low seek time'''. This will improve the overall speed of your system, especially when accessing Moodle's reports.
* Size your '''swap file''' correctly. The general advice is to set it to 4 x physical RAM.
* Use a '''RAID disk system'''. Although there are many different RAID configurations you can create, the following generally works best:
** install a hardware RAID controller (if you can)
** the operating system and swap drive on one set of disks configured as RAID-1.
** Moodle, Web server and Database server on another set of disks configured as RAID-5.
* Use '''gigabit ethernet''' for improved latency and throughput. This is especially important when you have your webserver and database server separated out on different hosts.
* Check the settings on your '''network card'''. You may get an improvement in performance by increasing the use of buffers and transmit/receive descriptors (balance this with processor and memory overheads) and off-loading TCP checksum calculation onto the card instead of the OS.
* Read this [http://moodle.org/mod/forum/discuss.php?d=68579 Case Study] on a server stress test with 300 users.
* See this [http://elearning.sgu.ac.jp/doc/PT/ accompanying report] on network traffic and server loads.
* See the [[Moodle.org configuration]]
* Also see this SFSU presentation at Educause (using VMWare): [http://www.educause.edu/Resources/AnOpenSourceLMSforaMissionCrit/162843]

==Operating System==
* You can use [http://en.wikipedia.org/wiki/Linux Linux](recommended), Unix-based, Windows or Mac OS X for the server '''operating system'''. *nix operating systems generally require less memory than Mac OS X or Windows servers for doing the same task as the server is configured with just a shell interface. Additionally Linux does not have licensing fees attached, but can have a big learning curve if you're used to another operating system. If you have a large number of processors running SMP, you may also want to consider using a highly tuned OS such as [http://en.wikipedia.org/wiki/Solaris_Operating_Environment Solaris].
* Check your own OS and '''vendor specific instructions''' for optimization steps.
** For Linux look at the [http://linuxperf.sourceforge.net/ Linux Performance Team] site.
** For Linux investigate the hdparm command, e.g. hdparm -m16 -d1 can be used to enable read/write on multiple sectors and DMA. Mount disks with the async and noatime options.
** For Windows set the sever to be optimized for network applications (Control Panel, Network Connections, LAN connection, Properties, File & Printer Sharing for Microsoft Networks, Properties, Optimization). You can also search the [http://technet.microsoft.com/ Microsoft TechNet site] for optimization documents.

==Web server performance==

Installing [http://www.mozilla.com/en-US/ Firefox] and the [https://addons.mozilla.org/en-US/firefox/addon/1843 firebug] extension will allow you to watch the time it takes for each page component to load. Also, the [https://addons.mozilla.org/en-US/firefox/addon/5369 Yslow] extension will evaluate your page against Yahoo's [http://www.skrenta.com/2007/05/14_rules_for_fast_web_pages_by_1.html 14 rules] ([http://video.yahoo.com/video/play?vid=1040890 video]) for fast loading websites.

===PHP performance===
* You are strongly recommended to use a '''PHP accelerator''' to ease CPU load, such as [http://pecl.php.net/apc APC], [http://www.php-accelerator.co.uk/ PHPA], [http://trac.lighttpd.net/xcache/ Xcache] or [http://eaccelerator.net/ eAccelerator]. (Take care to choose a PHP accelerator that is known to work well with your version of PHP and note that Turck MMCache is [http://turckmmcache.exeprod.com/TheManifestoEnglish no longer maintained] and can cause failures with PHP 5).
* Improvements in read/write performance can be improved by putting the cached PHP pages on a [[TMPFS]] filesystem - but remember that you'll lose the cache contents when there is a power failure or the server is rebooted.
* Performance of PHP is better when installed as an '''Apache/IIS ISAPI module''' (rather than a CGI).
* Also check the '''memory_limit''' in php.ini, reduce it to 16M for Moodle version earlier than 1.7 ([http://moodle.org/mod/forum/discuss.php?d=39656 See this forum discussion]). For Moodle 1.7 or later, it is recommended that the value of memory_limit should be 40M. As of [http://www.php.net/ChangeLog-5.php PHP 5.2.1] the default value for the memory_limit directive is 128M.
===Install HowTo===
* [http://2bits.com/articles/installing-php-apc-gnulinux-centos-5.html APC on CentOS 5.x (linux)]
* [http://fplanque.com/dev/linux/install-apc-php-cache-debian-lenny APC on Debian (linux)]
* [http://www.linuxtuts.net/211-installing-memcached-php5-memcache-module-debian-apache2.html MemCache module on Debian (Apache2 and PHP5) ]

===Apache performance===
* If you are using Apache on a Windows server, use the build from [http://www.apachelounge.com Apache Lounge] which is reported to have [http://moodle.org/mod/forum/discuss.php?d=93358 performance and stability improvements] compared to the official Apache download. Note that this is an unofficial build, so may not keep up with official releases.
* Set the '''MaxClients''' directive correctly. Use this formula to help (which uses 80% of available memory to leave room for spare):
MaxClients = Total available memory * 80% / Max memory usage of apache process
:Memory usage of apache process is usually 10MB, so a general rule of thumb is to divide your available memory in megabytes by 10 to get the value of MaxClients. To find the max memory usage of apache processes read the value from the shell command:
#ps -ylC httpd --sort:rss

:If you need to increase the value of '''MaxClients''' beyond 256, you will also need to set the '''ServerLimit''' directive.

:'''Warning''': Do not be tempted to set the value of MaxClients higher than your available memory as your server will consume more RAM than available and start to swap to disk.
* Consider reducing the '''number of modules''' that Apache loads in the httpd.conf file to the minumum necessary to reduce the memory needed.
* Use the '''latest version of Apache''' - Apache 2 has an improved memory model which reduces memory usage further.
* For Unix/Linux systems, consider lowering '''MaxRequestsPerChild''' in httpd.conf to as low as 20-30 (if you set it any lower the overhead of forking begins to outweigh the benefits).
* For a heavily loaded server, consider setting '''KeepAlive Off''' (do this only if your Moodle pages do not contain links to resources or uploaded images) or lowering the '''KeepAliveTimeout''' to between 2 and 5. The default is 15 (seconds) - the higher the value the more server processes will be kept waiting for possibly idle connections. A more accurate value for KeepAliveTimeout is obtained by observing how long it takes your users to download a page. After altering any of the KeepAlive variables, monitor your CPU utilization as there may be an additional overhead in initiating more worker processes/threads.
* A warning about the previous performance tip. Microsoft Internet Explorer has a (little) known bug that causes seriously problems with SSL-enabled Apache websites. The issue is that if a web server's KeepAlive timeout is set to less than 60 seconds (say to the default of 15 seconds), MSIE can get confused about whether a keep-alive connection is available or not. As a result, any browser POST requests (which always use a keep-alive if available) will fail to reach the server. This is easily reproduced with postings to the Moodle forums. Using MSIE, connect to an ssl-enabled Moodle site. Write a quick forum post, and submit it when the form has been displayed for between 15 seconds and 60 seconds. You will see a browser error message, and your post content will be lost. In some cases, doing this will even crash the Windows TCP stack on the client machine. ''' So, if your site is SSL-enabled, and you use Apache, you should set the KeepAliveTimeout to at least 60 seconds'''.
* As an alternative to using KeepAlive Off, consider setting-up a '''Reverse Proxy server''' infront of the Moodle server to cache HTML files with images. You can then return Apache to using keep-alives on the Moodle server.
* If you do not use a .htaccess file, set the '''AllowOverride''' variable to AllowOverride None to prevent .htaccess lookups.
* Set '''DirectoryIndex''' correctly so as to avoid content-negotiation. Here's an example from a production server:
DirectoryIndex index.php index.html index.htm
* Unless you are doing development work on the server, set '''ExtendedStatus Off''' and disable mod_info as well as mod_status.
* Leave '''HostnameLookups Off''' (as default) to reduce DNS latency.
* Consider reducing the value of '''TimeOut''' to between 30 to 60 (seconds).
* For the '''Options directive''', avoid Options Multiviews as this performs a directory scan. To reduce disk I/O further use
Options -Indexes FollowSymLinks
*'''Caching''' - Apache can be told to make pages load a lot faster by specifying that the browser should cache some various page elements such as images and reuse them from local memory rather than ask for them again every time a page is requested. How to do this varies slightly between OSes but there are two basic steps:

# Install and enable mod_expires - refer to documentation or man pages
# Add this code to the virtual server config file within the <directory> section for the root directory (or within the .htaccess file if AllowOverrides is On):
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 1 seconds"
ExpiresByType text/html "access plus 1 seconds"
ExpiresByType image/gif "access plus 1 week"
ExpiresByType image/jpeg "access plus 1 week"
ExpiresByType image/png "access plus 1 week"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/javascript "access plus 1 week"
ExpiresByType application/x-javascript "access plus 1 week"
ExpiresByType text/xml "access plus 1 seconds"
</IfModule>

The effect is to make everything stay in the cache except HTML and XML, which change dynamically. It's possible to gain a several hundred percent decrease in load times this way. Adjust the cache times according to how often your images etc change.

More info: [http://www.metaskills.net/blog/heuristics/sysadmin/how-to-control-browser-caching-with-apache-2 www.metaskills.net]

===IIS performance===
All alter this location in the registry:
HKLM\SYSTEM\CurrentControlSet\Services\Inetinfo\Parameters\
* The equivalent to KeepAliveTimeout is '''ListenBackLog''' (IIS - registry location is HKLM\ SYSTEM\ CurrentControlSet\ Services\ Inetinfo\ Parameters). Set this to between 2 to 5.
*Change the '''MemCacheSize''' value to adjust the amount of memory (Mb) that IIS will use for its file cache (50% of available memory by default).
*Change the '''MaxCachedFileSize''' to adjust the maximum size of a file cached in the file cache in bytes. Default is 262,144 (256K).
*Create a new DWORD called '''ObjectCacheTTL''' to change the length of time (in milliseconds) that objects in the cache are held in memory. Default is 30,000 milliseconds (30 seconds).

===Lighttpd performance===
You can increase server performance by using a '''light-weight''' webserver like [http://www.lighttpd.net/ lighttpd] (or [http://nginx.net/ nginx])in combination with PHP in FastCGI-mode. Lighttpd was originally created as a proof-of-concept[http://www.lighttpd.net/story] to address the [http://www.kegel.com/c10k.html C10k problem] and while primarily recommended for memory-limited servers, its design origins and asynchronous-IO model make it a suitable and proven[http://blog.lighttpd.net/articles/2006/12/28/lighttpd-powers-5-alexa-top-250-sites] alternative HTTP server for high-load websites and web apps, including Moodle. See the [[lighttpd | MoodleDocs Lighttpd page]] for additional information, configuration example and links.

Alternatively, both [http://www.lighttpd.net/ lighttpd] and [http://nginx.net/ nginx] are capable of performing as a load-balancer and/or reverse-proxy to alleviate load on back-end servers[http://www.linuxjournal.com/article/10108], providing benefit without requiring an actual software change on existing servers.

==Database performance==

Moodle contains a script which will display some key database performance statistics from the [http://phplens.com/lens/adodb/docs-perf.htm ADOdb performance monitor]. Run the script in your browser as in the following example:

http://www.mymoodle.com/admin/dbperformance.php

Use the data displayed as a guide to tune and improve the performance of your database server.

===MySQL performance===

The following are MySQL specific settings which can be adjusted for better performance in your my.cnf (my.ini in Windows). The file contains a list of settings and their values. To see the current values use these commands
SHOW STATUS;
SHOW VARIABLES;
'''Important''': You must make backups of your database before attempting to change any MySQL server configuration. After any change to the my.cnf, restart mysqld.

If you are able, the [http://mysqltuner.com/ MySQLTuner] tool can be run against your MySQL server and will calculate appropriate configuration values for most of the following settings based on your current load, status and variables automatically.

* Enable the '''query cache''' with
query_cache_type = 1.
For most Moodle installs, set the following:
query_cache_size = 36M
query_cache_min_res_unit = 2K.
The query cache will improve performance if you are doing few updates on the database.
* Set the '''table cache''' correctly. For Moodle 1.6 set
table_cache = 256 #(table_open_cache in MySQL > 5.1.2)
(min), and for Moodle 1.7 set
table_cache = 512 #(table_open_cache in MySQL > 5.1.2)
(min). The table cache is used by all threads (connections), so monitor the value of opened_tables to further adjust - if opened_tables > 3 * table_cache(table_open_cache in MySQL > 5.1.2) then increase table_cache upto your OS limit. Note also that the figure for table_cache will also change depending on the number of modules and plugins you have installed. Find the number for your server by executing the mysql statement below. Look at the number returned and set table_cache to this value.
mysql>SELECT COUNT(table_name) FROM information_schema.tables WHERE table_schema='yourmoodledbname';
* Set the '''thread cache''' correctly. Adjust the value so that your thread cache utilization is as close to 100% as possible by this formula:
thread cache utilization (%) = (threads_created / connections) * 100
* The '''key buffer''' can improve the access speed to Moodle's SELECT queries. The correct size depends on the size of the index files (.myi) and in Moodle 1.6 or later (without any additional modules and plugins), the recommendation for this value is key_buffer_size = 32M. Ideally you want the database to be reading once from the disk for every 100 requests so monitor that the value is suitable for your install by adjusting the value of key_buffer_size so that the following formulas are true:
key_read / key_read_requests < 0.01
key_write / key_write_requests <= 1.0
* Set the '''maximum number of connections''' so that your users will not see a "Too many connections" message. Be careful that this may have an impact on the total memory used. MySQL connections usually last for milliseconds, so it is unusual even for a heavily loaded server for this value to be over 200.
* Manage '''high burst activity'''. If your Moodle install uses a lot of quizzes and you are experiencing performance problems (check by monitoring the value of threads_connected - it should not be rising) consider increasing the value of back_log.
* '''Optimize your tables weekly and after upgrading Moodle'''. It is good practice to also optimize your tables after performing a large data deletion exercise, e.g. at the end of your semester or academic year. This will ensure that index files are up to date. Backup your database first and then use:
mysql>CHECK TABLE mdl_tablename;
mysql>OPTIMIZE TABLE mdl_tablename;
:The common tables in Moodle to check are mdl_course_sections, mdl_forum_posts, mdl_log and mdl_sessions (if using dbsessions). Any errors need to be corrected using REPAIR TABLE (see the [http://dev.mysql.com/doc/refman/5.0/en/repair-table.html MySQL manual] and this [http://moodle.org/mod/forum/discuss.php?d=58208#p279638 forum script]).
* '''Maintain the key distribution'''. Every month or so it is a good idea to stop the mysql server and run these myisamchk commands.
#myisamchk -a -S /pathtomysql/data/moodledir/*.MYI
:'''Warning''': You must stop the mysql database process (mysqld) before running any myisamchk command. If you do not, you risk data loss.
* Reduce the number of '''temporary tables saved to disk'''. Check this with the created_tmp_disk_tables value. If this is relatively large (>5%) increase tmp_table_size until you see a reduction. Note that this will have an impact on RAM usage.
* Moodle's tables are in the MyISAM format, so '''turn InnoDB off''' if you feel there is no performance gain. Add <code>skip-innodb</code> to your <code>my.cnf</code> file. If you must use InnoDB, you'll have to convert all of Moodle's tables. To do this run the innodb script:

http://www.mymoodle.com/admin/innodb.php

:See also [http://moodle.org/mod/forum/discuss.php?d=12961 this forum discussion] which looks at the MyISAM vs InnoDB options.

===PostgreSQL performance===

There are some good papers around on tuning PostgreSQL, and Moodle's case does not seem to be different to the general case.

The first thing to recognise is that if you really need to worry about tuning you should be using a separate machine for the database server. If you are not using a separate machine then the answers to many performance questions are substantially muddied by the memory requirements of the rest of the application.

You should probably '''enable autovacuum''', unless you know what you are doing. Many e-learning sites have predictable periods of low use, so disabling autovacuum and running a specific vacuum at those times can be a good option. Or perhaps leave autovacuum running but do a full vacuum weekly in a quiet period.

Set '''shared_buffers''' to something reasonable. For versions up to 8.1 my testing has shown that peak performance is almost always obtained with buffers < 10000, so if you are using such a version, and have more than 512M of RAM just set shared_buffers to 10,000 (8MB).

The buffer management had a big overhaul in 8.2 and "reasonable" is now a much larger number. I have not conducted performance tests with 8.2, but the recommendations from others are generally that you should now scale shared_buffers much more with memory and may continue to reap benefits even up to values like 100,000 (80MB). Consider using 1-2% of system RAM.

PostgreSQL will also assume that the operating system is caching its files, so setting '''effective_cache_size''' to a reasonable value is also a good idea. A reasonable value will usually be (total RAM - RAM in use by programs). If you are running Linux and leave the system running for a day or two you can look at 'free' and under the 'cached' column you will see what it currently is. Consider taking that number (which is kB) and dividing it by 10 (i.e. allow 20% for other programs cache needs and then divide by 8 to get pages). If you are not using a dedicated database server you will need to decrease that value to account for usage by other programs.

Some other useful parameters that can have positive effects, and the values I would typically set them to on a machine with 4G RAM, are:

work_mem = 10240

That's 10M of RAM to use instead of on-disk sorting and so forth. That can give a big speed increase, but it is per connection and 200 connections * 10M is 2G, so it can theoretically chew up a lot of RAM.

maintenance_work_mem = 163840

That's 160M of RAM which will be used by (e.g.) VACUUM, index rebuild, cluster and so forth. This should only be used periodically and should be freed when those processes exit, so I believe it is well worth while.

max_fsm_pages = 100000
max_fsm_relations = 5000

These are used to hold the free-space map, and if they are too small you will see performance degradation after the database has been operating for some time. The exact numbers to set can be gleaned from the output of VACUUM VERBOSE, which prints the required FSM pages at the end of it's run. The 5x increase seems to be useful for a Moodle installation, from experience.

wal_buffers = 64

These buffers are used for the write-ahead log, and there have been a number of reports on the PostgreSQL mailing lists of improvement from this level of increase.

This is a little out of date now (version 8.0) but still worth a read: http://www.powerpostgresql.com/Docs

And there is lots of good stuff here as well: http://www.varlena.com/GeneralBits/Tidbits/index.php

''Based on Andrew McMillan's post at [http://moodle.org/mod/forum/discuss.php?d=68558 Tuning PostgreSQL] forum thread.''

===Other database performance links===
* Consider using a '''distributed cacheing system''' like [http://en.wikipedia.org/wiki/Memcached memcached] but note that memcached does not have any security features so it should be used behind a firewall.
* Consider using PostgreSQL. See [[Arguments in favour of PostgreSQL]] and [http://moodle.org/mod/forum/discuss.php?d=49195 how to migrate from MySQL to PostgreSQL] (forum discussion).
* [[Increasing the database connection lifetime | Try increasing the database connection lifetime]]
* [http://dev.mysql.com/doc/refman/5.0/en/server-parameters.html General advice on tuning MySQL parameters] (advice from the MySQL manual)
* [http://www.mysqlperformanceblog.com/2007/11/01/innodb-performance-optimization-basics/ InnoDB performance optimization] taken from the [http://www.mysqlperformanceblog.com/ MySQL performance blog] site.

==Moodle Admin settings==
* In Moodle 1.7 or later, set the '''Cache type''' for your server: Site Admin -> Server -> Performance -> Cache type. There are several options available.
:*If you do not have eaccelerator or mmemcached installed, choose "internal" (which makes use of the record/internal cache - see the next bullet point).
:* If you have a single server and have compiled '''eaccelerator with shared memory support''', set the cache type to the eaccelerator option.
:* If you have a '''separate memcached server''', set the cache type to memcached and enter a csv list of server IP addresses.
* Enable the '''record/internal cache''': Site Admin -> Server -> Performance -> Record cache = True. Set the maximum amount of memory allocated to the cache in the Int Cache Max box. This will enable a primary cache for database records, without using any database engine cache, e.g. MySQL/PostgreSQL cache. See [http://tracker.moodle.org/browse/MDL-7196 this Tracker entry] for a full discussion.
* Enable the '''language cache'''.
* Large log files can cause overall performance to degrade over time. If you observe that the site has gradually got slower loading pages in the browser, '''reduce your Log life time''' setting (Admin/Server/Cleanup).
* Performance can be greatly improved by allowing Moodle to use the system '''zip/unzip''' commands (rather than PHP-based zip libraries) - visit Admin/Server/System Paths and enter the path to the relevant executables. (Similarly, filling in the path to '''du''' will improve Moodle's speed at listing directory contents.)
* Note that using '''secure web connections''' ('''https''' rather than '''http''') carries a higher processing burden, both for the webserver and the client - particularly because cacheing cannot be used as effectively, so the number of file requests is likely to increase dramatically. For this reason using https for all Moodle pages is not recommended. You can enable https just for the login screen, simply from Moodle's config page.
* Check your '''filters'''. Having too many filters active can have serious effects on server load, especially on lower-end systems. The number of active filters has a direct effect on the perceived latency of your site; that is the time taken for each page impression.
* Enable the '''text cache''' but do not "Filter all strings" unless you have a specific need. If in doubt profile the performance, and see how your changes affect the processing time.
* Check your '''anti-virus''' measures on the server. Although they are useful for preventing security holes being exploited, some "On-Demand" scanners can affect performance by scanning page content (word, ppt files etc).
* If there are performance problems loading course pages, check the '''Resource module settings'''. The setting resource_filterexternalpages is known to slow-down course pages and should be set to 'No' for better performance.
* Check your '''forum settings'''. To improve performance set forum_trackreadposts = No and forum_usermarksread = Yes (this will impact on the convenience of your users' forum experience). Also consider setting the time of the day when old posts are cleared from the read table (forum_cleanreadtime) to when your site is less busy.
* Don't use database sessions unless you really need them. On-disc sessions tend to be much faster.

==Performance of different Moodle modules==

Moodle's activity modules, filters, and other plugins can be activated/deactivated. If necessary, you may wish to deactivate some features (such as chat) if not required - but this isn't necessary. Some notes on the performance of certain modules:

* The '''Chat''' module is [http://moodle.org/mod/forum/discuss.php?d=37979&parent=175079 said] to be a hog in terms of frequent HTTP requests to the main server. This can be reduced by setting the module to use ''Streamed'' updates, or, if you're using a Unix-based webserver, by running the chat in daemon mode. When using the Chat module use the configuration settings to tune for your expected load. Pay particular attention to the ''chat_old_ping'' and ''chat_refresh'' parameters as these can have greatest impact on server load.
* The '''Quiz''' module is known to stretch database performance. Try to optimise your database server by tuning. See [http://moodle.org/mod/forum/discuss.php?d=25616&parent=120770 for a brief report on performance for 55 students simultaneously using quizzes]
** See this Case Study for an extensive server stress test with 300 quiz users.[http://moodle.org/mod/forum/discuss.php?d=68579] And this accompanying report on network traffic and server loads. [http://elearning.sgu.ac.jp/doc/PT/]
* The Moodle '''Cron''' task is triggered by calling the script ''cron.php''. If this is called over HTTP (e.g. using wget or curl) it can take a large amount of memory on large installations. If it is called by directly invoking the php command (e.g. ''php -f /path/to/moodle/directory/admin/cron.php'') efficiency can be much improved.
* The '''Recent activities''' block is consuming to much resources if you have huge number of records <code>mdl_log</code>. this is being tested to optimize the SQL query.

==Moodle Image Optimization==

The base images delivered in the original Moodle distribution package provide unoptimized graphics, most of which can benefit from lossless recompression utilizing [http://optipng.sourceforge.net/ optipng] for PNGs, [http://www.lcdf.org/gifsicle/ gifsicle] for GIFs and [http://www.kokkonen.net/tjko/projects.html jpegoptim] for JPGs. Optimized graphics transfer faster and provide a faster perceived response for clients[http://www.websiteoptimization.com/speed/12/], especially distance learners. The following example will recursively optimize (without any loss of quality) all the graphics and image files included in a base Moodle installation directory on a server with the above commands installed and available.

<pre>
find /example/directory/moodle-1.9 -iname *.png -exec optipng -o7 {} \;
find /example/directory/moodle-1.9 -iname *.gif -exec gifsicle -O2 -b {} \;
find /example/directory/moodle-1.9 -iname *.jpg -exec jpegoptim -p {} \;
</pre>

Both [http://optipng.sourceforge.net/ optipng] and [http://www.lcdf.org/gifsicle/ gifsicle] are provided in the base repositories of most newer Linux distributions; [http://www.kokkonen.net/tjko/projects.html jpegoptim] must be downloaded and installed manually.

==See also==

*[[Performance FAQ]]
*Using Moodle: [http://moodle.org/mod/forum/view.php?f=94 Hardware and Performance] forum

There have been a lot of discussions on moodle.org about performance, here are some of the more interesting and (potentially) useful ones:

* [http://moodle.org/mod/forum/discuss.php?d=83057 Performance woes!]
* [http://moodle.org/mod/forum/discuss.php?d=57028 Performance perspectives - a little script]
* [http://moodle.org/mod/forum/discuss.php?d=88927 Comments on planned server hardware]
* [http://moodle.org/mod/forum/discuss.php?d=102978#p461624 Moodle performance in a pil by Martin Langhoff]
[[Category:Performance]]

[[es:Rendimiento]]
[[fr:Performance]]
[[ja:???????]]
[[pl:Wydajnosc]]

LDAP authentication

2010-03-26T11:26:23Z

Molmos: typo: couuntry -> country

{{Moodle 1.9}}
Location: Settings link in ''Administration > Users > [[Authentication]] > LDAP Server''

This document describes how to set up Lightweight Directory Access Protocol (LDAP) authentication in Moodle. We cover the basic, advanced and some trouble shooting sections to assist the user in the installation and administrating LDAP in Moodle.
==Table of Contents==
__TOC__
==Basic Scenario==
The simple and straightforward approach for most installations.

===Assumptions===

# Your Moodle site is located at '''http://your.moodle.site/'''
# You have configured your PHP installation with the LDAP extension. It is loaded and activated, and it shows when you go to '''http://your.moodle.site/admin/phpinfo.php''' (logged in as user 'admin').
# Your LDAP server has '''192.168.1.100''' as its IP address.
# You are not using LDAP with SSL (also known as LDAPS) in your settings. This might prevent certain operations from working (e.g., you cannot update data if you are using MS Active Directory -- MS-AD from here on --), but should be OK if you just want to authenticate your users.
# You don't want your users to change their passwords the first time they log in into Moodle.
# You are using a single domain as the source of your authentication data in case you are using MS-AD (more on this in the Appendices).
# You are using a top level distinguished name (DN) of '''dc=my,dc=organization,dc=domain''' as the root of your LDAP tree.
# You have a non-privileged LDAP user account you will use to bind to the LDAP server. This is not necessary with certain LDAP servers, but MS-AD requires this and it won't hurt if you use it even if your LDAP server doesn't need it. Make sure '''this account and its password don't expire''', and make this password as strong as possible. Remember you only need to type this password once, when configuring Moodle, so don't be afraid of making it as hard to guess as possible. Let's say this user account has a DN of '''cn=ldap-user,dc=my,dc=organization,dc=domain''', and password '''hardtoguesspassword'''.
# All of your Moodle users are in an organizational unit (OU) called '''moodleusers''', which is right under your LDAP root. That OU has a DN of '''ou=moodleusers,dc=my,dc=organization,dc=domain'''.
# You '''don't''' want your LDAP users' passwords to be stored in Moodle at all.

[[LDAP_authentication#Table of Contents|Table of Contents]]

===Configuring Moodle authentication===

Log in as an admin user and go to Administration >> Users >> Authentication >> Manage authentication. In the table that appears, enable the "LDAP Server" authentication option (click on the closed eye to make it open) and then click on the associated 'Settings' link. You will get a page similar to this one:

[[Image:auth_ldap_config_screenshot.jpg|center]]

Now, you just have to fill in the values. Let's go step by step.

[[LDAP_authentication#Table of Contents|Table of Contents]]

====LDAP Server Settings====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Host URL
| As the IP of your LDAP server is 192.168.1.100, type "'''ldap://192.168.1.100'''" (without the quotes), or just "'''192.168.1.100'''" (some people have trouble connecting with the first syntax, specially on MS Windows servers).
|-
| Version
| Unless you are using a really old LDAP server, '''version 3''' is the one you should choose.
|-
| LDAP Encoding
| Specify encoding used by LDAP server. Most probably utf-8.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Bind settings====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Hide passwords
| As you '''don't''' want to store the users's password in Moodle's database, choose '''Yes''' here.
|-
| Distinguished Name
| This is the distinguished name of the bind user defined above. Just type "'''cn=ldap-user,dc=my,dc=organization,dc=domain'''" (without the quotes).
|-
| Password
| This is the bind user password defined above. Type "'''hardtoguesspassword'''" (without the quotes).
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====User lookup settings====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| User type
| Choose:
* '''Novel Edirectory''' if your LDAP server is running Novell's eDdirectory.
* '''posixAccount (rfc2307)''' if your LDAP server is running a RFC-2307 compatible LDAP server (choose this is your server is running OpenLDAP).
* '''posixAccount (rfc2307bis)''' if your LDAP server is running a RFC-2307bis compatible LDAP server.
* '''sambaSamAccount (v.3.0.7)''' if your LDAP server is running with SAMBA's 3.x LDAP schema extension and you want to use it.
* '''MS ActiveDirectory''' if your LDAP server is running Microsoft's Active Directory (MS-AD)
|-
| Contexts
| The DN of the context (container) where all of your Moodle users are found. Type '''ou=moodleusers,dc=my,dc=organization,dc=domain''' here.
|-
| Search subcontexts
| If you have any sub organizational units (subcontexts) hanging from '''ou=moodleusers,dc=my,dc=organization,dc=domain''' and you want Moodle to search there too, set this to '''yes'''. Otherwise, set this to '''no'''.
|-
| Dereference aliases
| Sometimes your LDAP server will tell you that the real value you are searching for is in fact in another part of the LDAP tree (this is called an alias). If you want Moodle to 'dereference' the alias and fetch the real value from the original location, set this to '''yes'''. If you don't want Moodle to dereference it, set this to '''no'''. If you are using MS-AD, set this to '''no'''.
|-
| User attribute
| The attribute used to name/search users in your LDAP tree. This option takes a default value based on the ''User type'' value you chose above. So unless you need something special, you don't need to fill this in.

By the way, it's usually '''cn''' (Novell eDirectory and MS-AD) or '''uid''' (RFC-2037, RFC-2037bis and SAMBA 3.x LDAP extension), but if you are using MS-AD you could use '''sAMAccountName''' (the pre-Windows 2000 logon account name) if you need too.
|-
| Member attribute
| The attribute used to list the members of a given group. This option takes a default value based on the ''User type'' value you choosed above. So unless you need something special, you don't need to fill this in.

By the way, the usual values are '''member''' and '''memberUid'''.
|-
| Member attribute uses dn
| Whether the member attribute contains distinguished names (1) or not (0).This option takes a default value based on the ''User type'' value you choosed above. So unless you need something special, you don't need to fill this in.
|-
| Object class
| The type of LDAP object used to search for users. This option takes a default value based on the ''User type'' value you choosed above. So unless you need something special, you don't need to fill this in.

Here are the default values for each of the ''ldap_user_type'' values:
* '''User''' for Novel eDirectory
* '''posixAccount''' for RFC-2037 and RFC-2037bis
* '''sambaSamAccount''' for SAMBA 3.0.x LDAP extension
* '''user''' for MS-AD
If you get an error about a problem with updating the ldap server (even if you have specified not to write changes back to the ldap server) try setting the ldap object class to * - see http://moodle.org/mod/forum/discuss.php?d=70566 for a discussion on this problem
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Force change password====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Force change password
| Set this to ''Yes'' if you want to force your users to change their password on the first login into Moodle. Otherwise, set this to ''no''. Bear in mind the password they are forced to change is the one stored in your LDAP server.

As you don't want your users to change their passwords in their first login, leave this set to ''No''
|-
| Use standard Change Password Page
|
* Setting this to ''Yes'' makes Moodle use it's own standard password change page, everytime users want to change their passwords.
* Setting this to ''No'' makes Moodle use the the page specified in the field called "Password change URL" (see below).

Bear in mind that changing your LDAP passwords from Moodle might require a LDAPS connection (this is actually a requirement for MS-AD). In addition to that, the bind user specified above must have the rights needed to change other users' passwords.

Also, code for changing passwords from Moodle for anything but Novell eDirectory and Active Directory is almost not tested, so this may or may not work for other LDAP servers.
|-
| Password Format
| Specify how the new password is encrypted before sending it to the LDAP server: Plain text, MD5 hash or SHA-1 hash. MS-AD uses plain text, for example.
|-
| Password change URL
| Here you can specify a location at which your users can recover or change their username/password if they've forgotten it. This will be provided to users as a button on the login page and their user page. if you leave this blank the button will not be printed.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====LDAP password expiration settings====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Expiration
|
* Setting this to ''No'' will make Moodle not to check if the password of the user has expired or not.
* Setting this to ''LDAP'' will make Moodle check if the LDAP password of the user has expired or not, and warn her a number of days before the password expires.

Current code only deals with Novell eDirectory LDAP server and MS-AD.

So unless you have Novell eDirectory server or MS-AD, choose ''No'' here.
|-
| Expiration warning
| This value sets how many days in advance of password expiration the user is warned that her password is about to expire.
|-
| Expiration attribute.
| The LDAP user attribute used to check password expiration. This option takes a default value based on the ''User type'' value you choosed above. So unless you need something special, you don't need to fill this in.
|-
| Grace logins
| This setting is specific to Novell eDirectory. If set to ''Yes'', enable LDAP gracelogin support. After password has expired the user can login until gracelogin count is 0.

So unless you have Novell eDirectory server and want to allow gracelogin support, choose ''No'' here.
|-
| Grace login attribute
| This setting is currently not used in the code (and is specific to Novell eDirectory).

So you don't need to fill this in.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Enable user creation====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Create users externally
| New (anonymous) users can self-create user accounts on the external LDAP server and confirm them via email. If you enable this, remember to also configure module-specific options for user creation and to fill in some instructions in ''auth_instructions'' field in Administration >> Users >> Authentication >> Manage authentication. Otherwise the new users won't be able to self-create new accounts.

As of now, only Novell eDirectory and MS-AD can create users externally.
|-
| Context for new users
| Specify the context where users are created. This context should be different from other users' contexts to prevent security issues.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Course creation====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Creators
| The DN of the group that contains all of your Moodle creators. This is typically a posixGroup with a "memberUid" attribute for each user you want to be a creator. If your group is called ''creators'', type '''cn=creators,ou=moodleusers,dc=my,dc=organization,dc=domain''' here. Each memberUid attribute contains the CN of a user who is authorized to be a creator. Do not use the user's full DN (e.g., not '''memberUid: cn=JoeTeacher,ou=moodleusers,dc-my,dc=organizations,dc=domain''', but rather '''memberUid: JoeTeacher''').

In eDirectory, the objectClass for a group is (by default) not '''posixGroup''' but '''groupOfNames,''' whose member attribute is '''member,''' not '''memberUid,''' and whose value is the full DN of the user in question. Although you can probably modify Moodle's code to use this field, a better solution is just to add a new '''objectClass''' attribute of '''posixGroup''' to your creators group and put the CNs for each creator in a '''memberUid''' attribute.

In MS Active Directory, you will need to create a security group for your creators to be part of and then add them all. If your ldap context above is 'ou=staff,dc=my,dc=org' then your group should then be 'cn=creators,ou=staff,dc=my,dc=org'. If some of the users are from other contexts and have been added to the same security group, you'll have to add these as separate contexts after the first one using the same format.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Cron synchronization script====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Removed ext user
| Specify what to do with internal user account during mass synchronization when user was removed from external source. Only suspended users are automatically revived if they reappear in ext source.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====NTLM SSO====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Enable
| If you want to use NTLM SSO (see details at [[NTLM_authentication]]), choose ''Yes'' here. Otherwise, choose ''No''.
|-
| Subnet
| Specify the subnets of the clients that will use NTLM SSO (see details at [[NTLM_authentication]]).
|-
| MS IE Fast Path?
| If all of you clients (or most of them) are using MS Internet Explorer, you can set this option to bypasses certain steps of the SSO login and speed up login times. This only works with MS Internet Explorer, but deals with other browsers in a sensible way (they are automatically sent to the plain login page).
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Data Mapping====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| First name
| The name of the attribute that holds the first name of your users in your LDAP server. This is usually '''givenName''' or '''displayName'''

This setting is optional
|-
| Surname
| The name of the attribute that holds the surname of your users in your LDAP server. This is usually '''sn'''.

This setting is optional
|-
| Email address
| The name of the attribute that holds the email address of your users in your LDAP server. This is usually '''mail'''.

This setting is optional
|-
| City/town
| The name of the attribute that holds the city/town of your users in your LDAP server. This is usully '''l''' (lowercase L) or '''localityName''' (not valid in MS-AD).

This setting is optional
|-
| Country
| The name of the attribute that holds the country of your users in your LDAP server. This is usully '''c''' or '''countryName''' (not valid in MS-AD).

This setting is optional
|-
| Language
| '''preferredLanguage'''

This setting is optional
|-
| Description
| '''description'''

This setting is optional
|-
| Webpage
| This setting is optional
|-
| ID Number
|

This setting is optional
|-
| Institution
|

This setting is optional
|-
| Department
| The name of the attribute that holds the department name of your users in your LDAP server. This is usully '''departmentNumber''' (for posixAccount and maybe eDirectory) or '''department''' (for MS-AD).

This setting is optional
|-
| Phone 1
| The name of the attribute that holds the telephone number of your users in your LDAP server. This is usually '''telephoneNumber'''.

This setting is optional
|-
| Phone 2
| The name of the attribute that holds an additional telephone number of your users in your LDAP server. This can be '''homePhone''', '''mobile''', '''pager''', '''facsimileTelephoneNumber''' or even others.

This setting is optional
|-
| Address
| The name of the attribute that holds the street address of your users in your LDAP server. This is usully '''streetAddress''' or '''street'.

This setting is optional
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

===Setting up regular automatic synchronisation using cron===
There is a script located at /auth/ldap/auth_ldap_sync_users.php which will create or suspend/delete (see the setting above) all LDAP accounts automatically. Ideally, this is called from the command line once a day during a quiet time using exactly the same procedure as the standard [[Cron|cron]] job (so you will end up with two cron entries). It is important, however, to make sure that all of the above LDAP settings are working properly before you try this, as well as backing up your database and moodledata folders. Poor LDAP configuration could lead to users being wrongly deleted.

If you find that the script is not running through all of your users properly and you have MS Active Directory + over 1000 users, this is because by default, MS AD only sends back 1000 users at a time. Follow the instructions [http://support.microsoft.com/kb/315071 here] to set the MaxPageSize setting to a number higher than your total number of users (both now and in future) to fix it.

[[LDAP_authentication#Table of Contents|Table of Contents]]

==Active Directory help==
[[Active Directory]] is Microsoft's directory service. It is included in Windows 2000 Server and later versions of their operating system. For more information about subjects below, '''[[Active Directory|please go here]]'''.

*Warning: The PHP LDAP module does not seem to be present
*LDAP-module cannot connect any LDAP servers
*Getting correct CNs for Contexts and Creators
*Getting the right user_attribute
*Installing ldp.exe Server Tool
*Example Active Directory Configuration
*Child Domains and the Global Catalog in MS Active Directory
*Enabling the Global Catalog
*Active Directory with Moodle 1.8
*MS Active Directory + SSL

==Advanced Scenarios - Multiple servers or locations==
For larger installations with multiple LDAP servers, or multiple locations (contexts) in a LDAP tree.

===Using multiple LDAP Servers===
Entering more than one name in the ldap_host_url field can provide some sort of resilience to your system. Simply use the syntax :
ldap://my.first.server ; ldap://my.second.server ; ...

Of course, this will only work if all the servers share the same directory information, using a replication or synchronization mecanism once introduced in eDirectory and now generalized to the main LDAP-compatible directories.

There is one drawback in Moodle 1.5 - 1.6 implementation of LDAP authentication : the auth_ldap_connect() function processes the servers sequentially, not in a round robin mode. Thus, if the primary server fails, you will have to wait for the connection to time out before switching to the following one.

===Using multiple user locations (contexts) in your LDAP tree===
There is no need to use multiple user locations if your directory tree is flat, i.e. if all user accounts reside in a '''ou=people,dc=my,dc=organization,dc=domain''' or '''ou=people,o=myorg''' container.

At the opposite, if you use the ACL mecanism to delegate user management, there are chances that your users will be stored in containers like '''ou=students,ou=dept1,o=myorg''' and '''ou=students,ou=dept2,o=myorg''' ...

Then there is an alternative :
* Look at the '''o=myorg''' level with the ldap_search_sub attribute set to '''yes'''.
* Set the ldap_context to '''ou=students,ou=dept1,o=myorg ; ou=students,ou=dept2,o=myorg'''.

Choosing between these two solutions supposes some sort of benchmarking, as the result depends heavily on the structure of your directory tree '''and''' on your LDAP software indexing capabilities. Simply note that there is a probability in such deep trees that two users share the same ''common name'' (cn), while having different ''distinguished names''. Then only the second solution will have a deterministic result (returning allways the same user).

===Using LDAPS (LDAP + SSL)===
====Enabling LDAPS on the LDAP server side====

* [[Active_Directory#MS_Active_Directory_.2B_SSL|Enabling LDAPS on MS Active Directory ]]

====Enabling LDAPS on the client side (Moodle server)====

* If you are running Moodle on MS Windows, you need to tell PHP's OpenLDAP extension to disable SSL server certificate checking. You must create a directory called ''C:\OpenLDAP\sysconf''. In this directory, create a file called ''ldap.conf'' with the following content:

TLS_REQCERT never

* If you are running Moodle on Linux or any other Unix-like operating system, and you want to disable SSL server certificate checking, you need to edit the OpenLDAP client configuration file (usually /etc/ldap.conf or /etc/ldap/ldap.conf or even /etc/openldap/ldap.conf) and make sure you have a line like the following one:

TLS_REQCERT never

Now you should be able to use '''ldaps://''' when connecting to your LDAP server.

If you have the certificate of the LDAPS server as a file and want to check the certificate for the connection, copy the certificate file to an arbitary directory (e.g. /etc/ldap/certificate.pem) on your client and change the content of the ''ldap.conf'' as follows:

TLS_REQCERT demand
TLS_CACERT /etc/ldap/certificate.pem

When the requested server certificate is bad or not provided, the connection to the LDAPS server is immediately terminated.

[[LDAP_authentication#Table of Contents|Table of Contents]]

==Appendices==
===ldap auth_user_create() only suports Novell===

After configuring user authentication with ldap I realized ldap only support edir (Novell) when combining ldap an email user confirmation. For example in my case (I use openldap) I have the following error after filling the user form:

auth: ldap auth_user_create() does not support selected usertype:"rfc2307" (..yet)

=== Setting Resource Limits RedHat Directory Server ===

Operational attributes can be set for the bind user DN using the command-line.
One can simply use ldapmodify to add the following attributes:

{| border="1" cellspacing="0" cellpadding="5"
! Attribute Name
! Description
|-
| nsLookThroughLimit
| Specifies how many entries are examined for a search operation. Giving this attribute a value of -1 indicates that there is no limit.
|-
| nsSizeLimit
| Specifies the maximum number of entries the server returns to a client application in response to a search operation. Giving this attribute a value of -1 indicates that there is no limit.
|-
| nsTimeLimit
| Specifies the maximum time the server spends processing a search operation. Giving this attribute a value of -1 indicates that there is no time limit.
|-
| nsIdleTimeout
| Specifies the time a connection to the server can be idle before the connection is dropped. The value is given in seconds. Giving this attribute a value of -1 indicates that there is no limit.
|}

<pre> LDAP Console Command-Line

ldapmodify -h redhat_dir_server -p 389 -D "cn=directory manager" -w secretpwd

dn: uid=MoodleAdmin,ou=system,dc=myschool,dc=edu
changetype: modify
add:nsSizeLimit
nsSizeLimit: 1000
</pre>

[[LDAP_authentication#Table of Contents|Table of Contents]]

==See also==

* [[NTLM_authentication]]
* [[Active_Directory]]
* [[LDAP enrolment]]
* [http://download.moodle.org/download.php/docs/en/how-to_guides/ldap_auth_and_enrolment_set-up.pdf LDAP auth and enrolment set-up guide] (PDF 227KB)

Using Moodle:
*[http://moodle.org/mod/forum/view.php?id=42 User authentication forum]
*[http://moodle.org/mod/forum/discuss.php?d=32168 PHP LDAP module does not seem to be present] forum discussion
* [http://moodle.org/mod/forum/discuss.php?d=140901 Syncronisation with AUTH_LDAP_SYNC_USERS.PHP produces fewer accounts than it should] forum discussion

[[Category:Authentication]]

[[es:LDAP_authentication]]
[[fr:Utiliser un serveur LDAP]]
[[ja:LDAP認証]]
[[zh:LDAP认证]]
[[de:Authentifizierung über LDAP]]

LDAP authentication

2010-03-26T11:11:47Z

Molmos: typo - choosed -> chose

{{Moodle 1.9}}
Location: Settings link in ''Administration > Users > [[Authentication]] > LDAP Server''

This document describes how to set up Lightweight Directory Access Protocol (LDAP) authentication in Moodle. We cover the basic, advanced and some trouble shooting sections to assist the user in the installation and administrating LDAP in Moodle.
==Table of Contents==
__TOC__
==Basic Scenario==
The simple and straightforward approach for most installations.

===Assumptions===

# Your Moodle site is located at '''http://your.moodle.site/'''
# You have configured your PHP installation with the LDAP extension. It is loaded and activated, and it shows when you go to '''http://your.moodle.site/admin/phpinfo.php''' (logged in as user 'admin').
# Your LDAP server has '''192.168.1.100''' as its IP address.
# You are not using LDAP with SSL (also known as LDAPS) in your settings. This might prevent certain operations from working (e.g., you cannot update data if you are using MS Active Directory -- MS-AD from here on --), but should be OK if you just want to authenticate your users.
# You don't want your users to change their passwords the first time they log in into Moodle.
# You are using a single domain as the source of your authentication data in case you are using MS-AD (more on this in the Appendices).
# You are using a top level distinguished name (DN) of '''dc=my,dc=organization,dc=domain''' as the root of your LDAP tree.
# You have a non-privileged LDAP user account you will use to bind to the LDAP server. This is not necessary with certain LDAP servers, but MS-AD requires this and it won't hurt if you use it even if your LDAP server doesn't need it. Make sure '''this account and its password don't expire''', and make this password as strong as possible. Remember you only need to type this password once, when configuring Moodle, so don't be afraid of making it as hard to guess as possible. Let's say this user account has a DN of '''cn=ldap-user,dc=my,dc=organization,dc=domain''', and password '''hardtoguesspassword'''.
# All of your Moodle users are in an organizational unit (OU) called '''moodleusers''', which is right under your LDAP root. That OU has a DN of '''ou=moodleusers,dc=my,dc=organization,dc=domain'''.
# You '''don't''' want your LDAP users' passwords to be stored in Moodle at all.

[[LDAP_authentication#Table of Contents|Table of Contents]]

===Configuring Moodle authentication===

Log in as an admin user and go to Administration >> Users >> Authentication >> Manage authentication. In the table that appears, enable the "LDAP Server" authentication option (click on the closed eye to make it open) and then click on the associated 'Settings' link. You will get a page similar to this one:

[[Image:auth_ldap_config_screenshot.jpg|center]]

Now, you just have to fill in the values. Let's go step by step.

[[LDAP_authentication#Table of Contents|Table of Contents]]

====LDAP Server Settings====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Host URL
| As the IP of your LDAP server is 192.168.1.100, type "'''ldap://192.168.1.100'''" (without the quotes), or just "'''192.168.1.100'''" (some people have trouble connecting with the first syntax, specially on MS Windows servers).
|-
| Version
| Unless you are using a really old LDAP server, '''version 3''' is the one you should choose.
|-
| LDAP Encoding
| Specify encoding used by LDAP server. Most probably utf-8.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Bind settings====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Hide passwords
| As you '''don't''' want to store the users's password in Moodle's database, choose '''Yes''' here.
|-
| Distinguished Name
| This is the distinguished name of the bind user defined above. Just type "'''cn=ldap-user,dc=my,dc=organization,dc=domain'''" (without the quotes).
|-
| Password
| This is the bind user password defined above. Type "'''hardtoguesspassword'''" (without the quotes).
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====User lookup settings====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| User type
| Choose:
* '''Novel Edirectory''' if your LDAP server is running Novell's eDdirectory.
* '''posixAccount (rfc2307)''' if your LDAP server is running a RFC-2307 compatible LDAP server (choose this is your server is running OpenLDAP).
* '''posixAccount (rfc2307bis)''' if your LDAP server is running a RFC-2307bis compatible LDAP server.
* '''sambaSamAccount (v.3.0.7)''' if your LDAP server is running with SAMBA's 3.x LDAP schema extension and you want to use it.
* '''MS ActiveDirectory''' if your LDAP server is running Microsoft's Active Directory (MS-AD)
|-
| Contexts
| The DN of the context (container) where all of your Moodle users are found. Type '''ou=moodleusers,dc=my,dc=organization,dc=domain''' here.
|-
| Search subcontexts
| If you have any sub organizational units (subcontexts) hanging from '''ou=moodleusers,dc=my,dc=organization,dc=domain''' and you want Moodle to search there too, set this to '''yes'''. Otherwise, set this to '''no'''.
|-
| Dereference aliases
| Sometimes your LDAP server will tell you that the real value you are searching for is in fact in another part of the LDAP tree (this is called an alias). If you want Moodle to 'dereference' the alias and fetch the real value from the original location, set this to '''yes'''. If you don't want Moodle to dereference it, set this to '''no'''. If you are using MS-AD, set this to '''no'''.
|-
| User attribute
| The attribute used to name/search users in your LDAP tree. This option takes a default value based on the ''User type'' value you chose above. So unless you need something special, you don't need to fill this in.

By the way, it's usually '''cn''' (Novell eDirectory and MS-AD) or '''uid''' (RFC-2037, RFC-2037bis and SAMBA 3.x LDAP extension), but if you are using MS-AD you could use '''sAMAccountName''' (the pre-Windows 2000 logon account name) if you need too.
|-
| Member attribute
| The attribute used to list the members of a given group. This option takes a default value based on the ''User type'' value you choosed above. So unless you need something special, you don't need to fill this in.

By the way, the usual values are '''member''' and '''memberUid'''.
|-
| Member attribute uses dn
| Whether the member attribute contains distinguished names (1) or not (0).This option takes a default value based on the ''User type'' value you choosed above. So unless you need something special, you don't need to fill this in.
|-
| Object class
| The type of LDAP object used to search for users. This option takes a default value based on the ''User type'' value you choosed above. So unless you need something special, you don't need to fill this in.

Here are the default values for each of the ''ldap_user_type'' values:
* '''User''' for Novel eDirectory
* '''posixAccount''' for RFC-2037 and RFC-2037bis
* '''sambaSamAccount''' for SAMBA 3.0.x LDAP extension
* '''user''' for MS-AD
If you get an error about a problem with updating the ldap server (even if you have specified not to write changes back to the ldap server) try setting the ldap object class to * - see http://moodle.org/mod/forum/discuss.php?d=70566 for a discussion on this problem
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Force change password====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Force change password
| Set this to ''Yes'' if you want to force your users to change their password on the first login into Moodle. Otherwise, set this to ''no''. Bear in mind the password they are forced to change is the one stored in your LDAP server.

As you don't want your users to change their passwords in their first login, leave this set to ''No''
|-
| Use standard Change Password Page
|
* Setting this to ''Yes'' makes Moodle use it's own standard password change page, everytime users want to change their passwords.
* Setting this to ''No'' makes Moodle use the the page specified in the field called "Password change URL" (see below).

Bear in mind that changing your LDAP passwords from Moodle might require a LDAPS connection (this is actually a requirement for MS-AD). In addition to that, the bind user specified above must have the rights needed to change other users' passwords.

Also, code for changing passwords from Moodle for anything but Novell eDirectory and Active Directory is almost not tested, so this may or may not work for other LDAP servers.
|-
| Password Format
| Specify how the new password is encrypted before sending it to the LDAP server: Plain text, MD5 hash or SHA-1 hash. MS-AD uses plain text, for example.
|-
| Password change URL
| Here you can specify a location at which your users can recover or change their username/password if they've forgotten it. This will be provided to users as a button on the login page and their user page. if you leave this blank the button will not be printed.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====LDAP password expiration settings====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Expiration
|
* Setting this to ''No'' will make Moodle not to check if the password of the user has expired or not.
* Setting this to ''LDAP'' will make Moodle check if the LDAP password of the user has expired or not, and warn her a number of days before the password expires.

Current code only deals with Novell eDirectory LDAP server and MS-AD.

So unless you have Novell eDirectory server or MS-AD, choose ''No'' here.
|-
| Expiration warning
| This value sets how many days in advance of password expiration the user is warned that her password is about to expire.
|-
| Expiration attribute.
| The LDAP user attribute used to check password expiration. This option takes a default value based on the ''User type'' value you choosed above. So unless you need something special, you don't need to fill this in.
|-
| Grace logins
| This setting is specific to Novell eDirectory. If set to ''Yes'', enable LDAP gracelogin support. After password has expired the user can login until gracelogin count is 0.

So unless you have Novell eDirectory server and want to allow gracelogin support, choose ''No'' here.
|-
| Grace login attribute
| This setting is currently not used in the code (and is specific to Novell eDirectory).

So you don't need to fill this in.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Enable user creation====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Create users externally
| New (anonymous) users can self-create user accounts on the external LDAP server and confirm them via email. If you enable this, remember to also configure module-specific options for user creation and to fill in some instructions in ''auth_instructions'' field in Administration >> Users >> Authentication >> Manage authentication. Otherwise the new users won't be able to self-create new accounts.

As of now, only Novell eDirectory and MS-AD can create users externally.
|-
| Context for new users
| Specify the context where users are created. This context should be different from other users' contexts to prevent security issues.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Course creation====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Creators
| The DN of the group that contains all of your Moodle creators. This is typically a posixGroup with a "memberUid" attribute for each user you want to be a creator. If your group is called ''creators'', type '''cn=creators,ou=moodleusers,dc=my,dc=organization,dc=domain''' here. Each memberUid attribute contains the CN of a user who is authorized to be a creator. Do not use the user's full DN (e.g., not '''memberUid: cn=JoeTeacher,ou=moodleusers,dc-my,dc=organizations,dc=domain''', but rather '''memberUid: JoeTeacher''').

In eDirectory, the objectClass for a group is (by default) not '''posixGroup''' but '''groupOfNames,''' whose member attribute is '''member,''' not '''memberUid,''' and whose value is the full DN of the user in question. Although you can probably modify Moodle's code to use this field, a better solution is just to add a new '''objectClass''' attribute of '''posixGroup''' to your creators group and put the CNs for each creator in a '''memberUid''' attribute.

In MS Active Directory, you will need to create a security group for your creators to be part of and then add them all. If your ldap context above is 'ou=staff,dc=my,dc=org' then your group should then be 'cn=creators,ou=staff,dc=my,dc=org'. If some of the users are from other contexts and have been added to the same security group, you'll have to add these as separate contexts after the first one using the same format.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Cron synchronization script====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Removed ext user
| Specify what to do with internal user account during mass synchronization when user was removed from external source. Only suspended users are automatically revived if they reappear in ext source.
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====NTLM SSO====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| Enable
| If you want to use NTLM SSO (see details at [[NTLM_authentication]]), choose ''Yes'' here. Otherwise, choose ''No''.
|-
| Subnet
| Specify the subnets of the clients that will use NTLM SSO (see details at [[NTLM_authentication]]).
|-
| MS IE Fast Path?
| If all of you clients (or most of them) are using MS Internet Explorer, you can set this option to bypasses certain steps of the SSO login and speed up login times. This only works with MS Internet Explorer, but deals with other browsers in a sensible way (they are automatically sent to the plain login page).
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

====Data Mapping====
{| border="1" cellspacing="0" cellpadding="5"
! Field name
! Value to fill in
|-
| First name
| The name of the attribute that holds the first name of your users in your LDAP server. This is usually '''givenName''' or '''displayName'''

This setting is optional
|-
| Surname
| The name of the attribute that holds the surname of your users in your LDAP server. This is usually '''sn'''.

This setting is optional
|-
| Email address
| The name of the attribute that holds the email address of your users in your LDAP server. This is usually '''mail'''.

This setting is optional
|-
| City/town
| The name of the attribute that holds the city/town of your users in your LDAP server. This is usully '''l''' (lowercase L) or '''localityName''' (not valid in MS-AD).

This setting is optional
|-
| Country
| The name of the attribute that holds the couuntry of your users in your LDAP server. This is usully '''c''' or '''countryName''' (not valid in MS-AD).

This setting is optional
|-
| Language
| '''preferredLanguage'''

This setting is optional
|-
| Description
| '''description'''

This setting is optional
|-
| Webpage
| This setting is optional
|-
| ID Number
|

This setting is optional
|-
| Institution
|

This setting is optional
|-
| Department
| The name of the attribute that holds the department name of your users in your LDAP server. This is usully '''departmentNumber''' (for posixAccount and maybe eDirectory) or '''department''' (for MS-AD).

This setting is optional
|-
| Phone 1
| The name of the attribute that holds the telephone number of your users in your LDAP server. This is usually '''telephoneNumber'''.

This setting is optional
|-
| Phone 2
| The name of the attribute that holds an additional telephone number of your users in your LDAP server. This can be '''homePhone''', '''mobile''', '''pager''', '''facsimileTelephoneNumber''' or even others.

This setting is optional
|-
| Address
| The name of the attribute that holds the street address of your users in your LDAP server. This is usully '''streetAddress''' or '''street'.

This setting is optional
|}

[[LDAP_authentication#Table of Contents|Table of Contents]]

===Setting up regular automatic synchronisation using cron===
There is a script located at /auth/ldap/auth_ldap_sync_users.php which will create or suspend/delete (see the setting above) all LDAP accounts automatically. Ideally, this is called from the command line once a day during a quiet time using exactly the same procedure as the standard [[Cron|cron]] job (so you will end up with two cron entries). It is important, however, to make sure that all of the above LDAP settings are working properly before you try this, as well as backing up your database and moodledata folders. Poor LDAP configuration could lead to users being wrongly deleted.

If you find that the script is not running through all of your users properly and you have MS Active Directory + over 1000 users, this is because by default, MS AD only sends back 1000 users at a time. Follow the instructions [http://support.microsoft.com/kb/315071 here] to set the MaxPageSize setting to a number higher than your total number of users (both now and in future) to fix it.

[[LDAP_authentication#Table of Contents|Table of Contents]]

==Active Directory help==
[[Active Directory]] is Microsoft's directory service. It is included in Windows 2000 Server and later versions of their operating system. For more information about subjects below, '''[[Active Directory|please go here]]'''.

*Warning: The PHP LDAP module does not seem to be present
*LDAP-module cannot connect any LDAP servers
*Getting correct CNs for Contexts and Creators
*Getting the right user_attribute
*Installing ldp.exe Server Tool
*Example Active Directory Configuration
*Child Domains and the Global Catalog in MS Active Directory
*Enabling the Global Catalog
*Active Directory with Moodle 1.8
*MS Active Directory + SSL

==Advanced Scenarios - Multiple servers or locations==
For larger installations with multiple LDAP servers, or multiple locations (contexts) in a LDAP tree.

===Using multiple LDAP Servers===
Entering more than one name in the ldap_host_url field can provide some sort of resilience to your system. Simply use the syntax :
ldap://my.first.server ; ldap://my.second.server ; ...

Of course, this will only work if all the servers share the same directory information, using a replication or synchronization mecanism once introduced in eDirectory and now generalized to the main LDAP-compatible directories.

There is one drawback in Moodle 1.5 - 1.6 implementation of LDAP authentication : the auth_ldap_connect() function processes the servers sequentially, not in a round robin mode. Thus, if the primary server fails, you will have to wait for the connection to time out before switching to the following one.

===Using multiple user locations (contexts) in your LDAP tree===
There is no need to use multiple user locations if your directory tree is flat, i.e. if all user accounts reside in a '''ou=people,dc=my,dc=organization,dc=domain''' or '''ou=people,o=myorg''' container.

At the opposite, if you use the ACL mecanism to delegate user management, there are chances that your users will be stored in containers like '''ou=students,ou=dept1,o=myorg''' and '''ou=students,ou=dept2,o=myorg''' ...

Then there is an alternative :
* Look at the '''o=myorg''' level with the ldap_search_sub attribute set to '''yes'''.
* Set the ldap_context to '''ou=students,ou=dept1,o=myorg ; ou=students,ou=dept2,o=myorg'''.

Choosing between these two solutions supposes some sort of benchmarking, as the result depends heavily on the structure of your directory tree '''and''' on your LDAP software indexing capabilities. Simply note that there is a probability in such deep trees that two users share the same ''common name'' (cn), while having different ''distinguished names''. Then only the second solution will have a deterministic result (returning allways the same user).

===Using LDAPS (LDAP + SSL)===
====Enabling LDAPS on the LDAP server side====

* [[Active_Directory#MS_Active_Directory_.2B_SSL|Enabling LDAPS on MS Active Directory ]]

====Enabling LDAPS on the client side (Moodle server)====

* If you are running Moodle on MS Windows, you need to tell PHP's OpenLDAP extension to disable SSL server certificate checking. You must create a directory called ''C:\OpenLDAP\sysconf''. In this directory, create a file called ''ldap.conf'' with the following content:

TLS_REQCERT never

* If you are running Moodle on Linux or any other Unix-like operating system, and you want to disable SSL server certificate checking, you need to edit the OpenLDAP client configuration file (usually /etc/ldap.conf or /etc/ldap/ldap.conf or even /etc/openldap/ldap.conf) and make sure you have a line like the following one:

TLS_REQCERT never

Now you should be able to use '''ldaps://''' when connecting to your LDAP server.

If you have the certificate of the LDAPS server as a file and want to check the certificate for the connection, copy the certificate file to an arbitary directory (e.g. /etc/ldap/certificate.pem) on your client and change the content of the ''ldap.conf'' as follows:

TLS_REQCERT demand
TLS_CACERT /etc/ldap/certificate.pem

When the requested server certificate is bad or not provided, the connection to the LDAPS server is immediately terminated.

[[LDAP_authentication#Table of Contents|Table of Contents]]

==Appendices==
===ldap auth_user_create() only suports Novell===

After configuring user authentication with ldap I realized ldap only support edir (Novell) when combining ldap an email user confirmation. For example in my case (I use openldap) I have the following error after filling the user form:

auth: ldap auth_user_create() does not support selected usertype:"rfc2307" (..yet)

=== Setting Resource Limits RedHat Directory Server ===

Operational attributes can be set for the bind user DN using the command-line.
One can simply use ldapmodify to add the following attributes:

{| border="1" cellspacing="0" cellpadding="5"
! Attribute Name
! Description
|-
| nsLookThroughLimit
| Specifies how many entries are examined for a search operation. Giving this attribute a value of -1 indicates that there is no limit.
|-
| nsSizeLimit
| Specifies the maximum number of entries the server returns to a client application in response to a search operation. Giving this attribute a value of -1 indicates that there is no limit.
|-
| nsTimeLimit
| Specifies the maximum time the server spends processing a search operation. Giving this attribute a value of -1 indicates that there is no time limit.
|-
| nsIdleTimeout
| Specifies the time a connection to the server can be idle before the connection is dropped. The value is given in seconds. Giving this attribute a value of -1 indicates that there is no limit.
|}

<pre> LDAP Console Command-Line

ldapmodify -h redhat_dir_server -p 389 -D "cn=directory manager" -w secretpwd

dn: uid=MoodleAdmin,ou=system,dc=myschool,dc=edu
changetype: modify
add:nsSizeLimit
nsSizeLimit: 1000
</pre>

[[LDAP_authentication#Table of Contents|Table of Contents]]

==See also==

* [[NTLM_authentication]]
* [[Active_Directory]]
* [[LDAP enrolment]]
* [http://download.moodle.org/download.php/docs/en/how-to_guides/ldap_auth_and_enrolment_set-up.pdf LDAP auth and enrolment set-up guide] (PDF 227KB)

Using Moodle:
*[http://moodle.org/mod/forum/view.php?id=42 User authentication forum]
*[http://moodle.org/mod/forum/discuss.php?d=32168 PHP LDAP module does not seem to be present] forum discussion
* [http://moodle.org/mod/forum/discuss.php?d=140901 Syncronisation with AUTH_LDAP_SYNC_USERS.PHP produces fewer accounts than it should] forum discussion

[[Category:Authentication]]

[[es:LDAP_authentication]]
[[fr:Utiliser un serveur LDAP]]
[[ja:LDAP認証]]
[[zh:LDAP认证]]
[[de:Authentifizierung über LDAP]]

Conditional activities

2009-12-14T23:32:53Z

Molmos: /* Enabling the use of conditional activities */

{{Moodle 2.0}}
Conditional activities is a new standard feature in Moodle 2.0 onwards, which enables teachers to restrict the availability of any activity according to certain conditions such as dates, grade obtained, or activity completion. Each activity can also have conditions which need to be met before it is considered complete.

Please see the following demonstration videos:
*[http://cvs.moodle.org/contrib/docs/en/conditional_activities/conditional-students.swf?view=co Conditional activities student view video]
*[http://cvs.moodle.org/contrib/docs/en/conditional_activities/conditional-editing.swf?view=co Conditional activities editing view video]

:''TIP:'' Previous users of activity locking or conditional activities should note there are some new terms in 2.0. The activity setting menu uses "Restrict availability", which is more robust than the previous activity locking conditions. The activity setting menu also has a new functionality called "Activity completion". Both these menu settings must be enabled by the administrator.

==Enabling the use of conditional activities==
[[Image:Conditional activities settings.png|thumb|Teacher view of an activity setting for: Restrict availability and activity completion]]
To use conditional activities, the feature must be enabled by an administrator by checking the enable availability box in ''Administration > Advanced features''. A Restrict availability section will appear for teachers on the edit activity page.

The basic conditional setting is in the '''Restrict availability''' area of an activity setting. It is asking for the conditions when the activity should be visible. This can be based upon dates, and/or score ranges of other activities and/or if other activities are considered completed (see completion tracking below).

==Enabling the use of activity completion tracking==

To use completion tracking, the feature must be enabled by an administrator by checking the enable completion box in ''Administration > Advanced features''. An Activity completion section will appear for teachers on the edit activity page.

Essentially this asks the teacher what is necessary for this activity to be considered complete. It is found in the activity setting's "'''Activity completion'''" This condition can then be checked in the restrict condition area in another activity setting (see restrict availability condition above).

==Tricks and techniques==

With a bit of lateral thinking, you can achieve some interesting results beyond the most obvious uses of the system. Here are some examples.

===Project allocation===

Imagine that you let students choose one of two projects. Each project has its own activities (a forum for all the people doing that project, resources with information about the project, etc). You want it to hide all the activities that a student isn't doing.

This can already be achieved in Moodle using the [[Groupings]] system. However, conditional activities gives another way to set this up which might be preferable in some cases. Here's how:

# Create two forums called 'Frog project sign-up forum' and 'Zombie project sign-up forum'.
# Set both forums to be automatically marked complete once the user makes 1 post.
# Set each forum to be conditionally available only if the other forum is NOT complete.
# Create other activities for the frog and zombie projects. For each Frog activity, set it to be conditionally available only if the Frog sign-up forum is marked complete. For each Zombie activity, set it to be conditionally available only if the Zombie sign-up forum is marked complete.

When a student first visits the site, they see the frog and zombie sign-up forums and none of the project activities. As soon as they post in one of the forums, the other forum will disappear, and all the activities for their preferred project will appear. (If they want to change their mind, they can delete their forum post so that it isn't marked complete any more, and it'll be back to square one.)

==Discussion: Should you really use conditional activities?==

Conditional activities are a way for you to force your students to do things in a certain order. Is that really what you want? The answer will depend on your particular circumstances, but it is worth taking a moment to reflect upon the degree to which conditional activities are appropriate for your course.

===Cautions===
It is certainly good course design to make it clear to your students what they are expected to do next, to give good guidance. But do you need to use force? Might it not be better to leave students in control of their own learning and just use labels and layout, rather than locks and keys to suggest the best path?

===New adaptive learning paths===
This may allow the teacher to separate students by a range of performance they have achieved. For example, after a quiz any one of three different lessons might appear to a student, depending upon their score. The teacher can have one for low scores, one for high scores and one for average score ranges. The teacher could have a short quiz like survey, with 7 questions asking the student to give their feelings on a 1 to 5 scale. A range of scores would reveal different activities. Students who liked dark colors might get the black and gray activities revealed, those who liked light colors might get the white and gray activities.

On the other hand, you may have to design a certified training course that requires approval from unenlightened government regulators. Conditional activities will assure them that the trainees have been exposed to everything in the course, in a fixed order, and that the trainees must meet certain quantifiable standards from time to time before being allowed to proceed in the course. Correct use and explanation of conditional activities may ensure validation of your course.

==See also==

*[[Development:Conditional activities]]
*[[Development:Conditional activities Adding module support]]
*[[Conditional activities FAQ]]

[[Category:Conditional activities]]

Conditional activities

2009-12-14T23:29:40Z

Molmos:

{{Moodle 2.0}}
Conditional activities is a new standard feature in Moodle 2.0 onwards, which enables teachers to restrict the availability of any activity according to certain conditions such as dates, grade obtained, or activity completion. Each activity can also have conditions which need to be met before it is considered complete.

Please see the following demonstration videos:
*[http://cvs.moodle.org/contrib/docs/en/conditional_activities/conditional-students.swf?view=co Conditional activities student view video]
*[http://cvs.moodle.org/contrib/docs/en/conditional_activities/conditional-editing.swf?view=co Conditional activities editing view video]

:''TIP:'' Previous users of activity locking or conditional activities should note there are some new terms in 2.0. The activity setting menu uses "Restrict availability", which is more robust than the previous activity locking conditions. The activity setting menu also has a new functionality called "Activity completion". Both these menu settings must be enabled by the administrator.

==Enabling the use of conditional activities==
[[Image:Conditional activities settings.png|thumb|Teacher view of an activity setting for: Restrict availability and activity completion]]
To use conditional activities, the feature must be enabled by an administrator by checking the enable availability box in ''Administration > Advanced features''. A Restrict availability section will appear for teachers on the edit activity page.

The basic conditional setting is in the '''Restrict availability''' area of an activity setting. It is asking for the conditions when the activity should be visible. This can be based upon dates,and/or score ranges of other activities and/or if other activities are considered completed (see completion tracking below).

==Enabling the use of activity completion tracking==

To use completion tracking, the feature must be enabled by an administrator by checking the enable completion box in ''Administration > Advanced features''. An Activity completion section will appear for teachers on the edit activity page.

Essentially this asks the teacher what is necessary for this activity to be considered complete. It is found in the activity setting's "'''Activity completion'''" This condition can then be checked in the restrict condition area in another activity setting (see restrict availability condition above).

==Tricks and techniques==

With a bit of lateral thinking, you can achieve some interesting results beyond the most obvious uses of the system. Here are some examples.

===Project allocation===

Imagine that you let students choose one of two projects. Each project has its own activities (a forum for all the people doing that project, resources with information about the project, etc). You want it to hide all the activities that a student isn't doing.

This can already be achieved in Moodle using the [[Groupings]] system. However, conditional activities gives another way to set this up which might be preferable in some cases. Here's how:

# Create two forums called 'Frog project sign-up forum' and 'Zombie project sign-up forum'.
# Set both forums to be automatically marked complete once the user makes 1 post.
# Set each forum to be conditionally available only if the other forum is NOT complete.
# Create other activities for the frog and zombie projects. For each Frog activity, set it to be conditionally available only if the Frog sign-up forum is marked complete. For each Zombie activity, set it to be conditionally available only if the Zombie sign-up forum is marked complete.

When a student first visits the site, they see the frog and zombie sign-up forums and none of the project activities. As soon as they post in one of the forums, the other forum will disappear, and all the activities for their preferred project will appear. (If they want to change their mind, they can delete their forum post so that it isn't marked complete any more, and it'll be back to square one.)

==Discussion: Should you really use conditional activities?==

Conditional activities are a way for you to force your students to do things in a certain order. Is that really what you want? The answer will depend on your particular circumstances, but it is worth taking a moment to reflect upon the degree to which conditional activities are appropriate for your course.

===Cautions===
It is certainly good course design to make it clear to your students what they are expected to do next, to give good guidance. But do you need to use force? Might it not be better to leave students in control of their own learning and just use labels and layout, rather than locks and keys to suggest the best path?

===New adaptive learning paths===
This may allow the teacher to separate students by a range of performance they have achieved. For example, after a quiz any one of three different lessons might appear to a student, depending upon their score. The teacher can have one for low scores, one for high scores and one for average score ranges. The teacher could have a short quiz like survey, with 7 questions asking the student to give their feelings on a 1 to 5 scale. A range of scores would reveal different activities. Students who liked dark colors might get the black and gray activities revealed, those who liked light colors might get the white and gray activities.

On the other hand, you may have to design a certified training course that requires approval from unenlightened government regulators. Conditional activities will assure them that the trainees have been exposed to everything in the course, in a fixed order, and that the trainees must meet certain quantifiable standards from time to time before being allowed to proceed in the course. Correct use and explanation of conditional activities may ensure validation of your course.

==See also==

*[[Development:Conditional activities]]
*[[Development:Conditional activities Adding module support]]
*[[Conditional activities FAQ]]

[[Category:Conditional activities]]