LDAP authentication: Difference between revisions
(Partial edit. More on this later.) |
(A little bit more info. Take it easy.) |
||
Line 47: | Line 47: | ||
|- | |- | ||
| ldap_user_type | | ldap_user_type | ||
| | | Choose: | ||
* '''Novel Edirectory''' if your LDAP server is running Novell's Edirectory. | |||
* '''posixAccount (rfc2307)''' if your LDAP server is running a RFC-2307 compatible LDAP server (choose this is your server is running OpenLDAP). | |||
* '''posixAccount (rfc2307bis)''' if your LDAP server is running a RFC-2307bis compatible LDAP server. | |||
* '''sambaSamAccount (v.3.0.7)''' if your LDAP server is running with SAMBA's 3.x LDAP schema extension and you want to use it. | |||
* '''MS ActiveDirectory''' if your LDAP server is running Microsoft's Active Directory. | |||
|- | |- | ||
| ldap_contexts | | ldap_contexts | ||
| | | The DN of the context (container) where all of your Moodle users are found. Type '''ou=moodleusers,dc=my,dc=organization,dc=domain''' here. | ||
|- | |- | ||
| ldap_search_sub | | ldap_search_sub | ||
Line 109: | Line 114: | ||
| | | | ||
|} | |} | ||
==Advanced Scenarios== | ==Advanced Scenarios== |
Revision as of 21:39, 14 February 2006
This document describes how to set up LDAP authentication in Moodle. You can find a Basic Scenario, where everything is simple and straightforward, and that should be enough for most installations. If your installation is a little bigger and you are using multiple LDAP servers, or multiple locations (contexts) for your users in your LDAP tree, then have a look at the Advanced Scenarios.
Basic Scenario
Assumptions
- Your Moodle site is located at http://your.moodle.site/
- You have configured your PHP installation with the LDAP extension. It is loaded and activated, and it shows when you go to http://your.moodle.site/admin/phpinfo.php (logged in as user 'admin').
- Your LDAP server has 192.168.1.100 as its IP address.
- You are not using LDAP with SSL (also known as LDAPS) in your settings. This might prevent certain operations from working (e.g., you cannot update data if you are using MS Active Directory -- MS-AD from here on --), but should be OK if you just want to authenticate your users.
- You are using a single domain as the source of your authentication data in case you are using MS-AD (more on this in the Appendices).
- You are using a top level distinguished name (DN) of dc=my,dc=organization,dc=domain as the root of your LDAP tree.
- You have a non-privileged LDAP user account you will use to bind to the LDAP server. This is not necessary with certain LDAP servers, but MS-AD requires this and it won't hurt if you use it even if your LDAP server doesn't need it. Make sure this account and its password don't expire, and make this password as strong as possible. Remember you only need to type this password once, when configuring Moodle, so don't be afraid of making it as hard to guess as possible. Let's say this user account has a DN of cn=ldap-user,dc=my,dc=organization,dc=domain, and password hardtoguesspassword.
- All of your Moodle users are in an organizational unit (OU) called moodleusers, which is right under you LDAP root. That OU has a DN of ou=moodleusers,dc=my,dc=organization,dc=domain.
- You don't want your LDAP users' passwords to be stored in Moodle at all.
Configuring Moodle authentication
Log in as an admin user and go to Administration >> Users >> Authentication. In the drop down listbox titled "Choose an authentication method" select "Use an LDAP Server". You will get a page similar to this one:
Now, you just have to fill in the values. Let's go step by step.
Field name | Value to fill in |
---|---|
ldap_host_url | As the IP of your LDAP server is 192.168.1.100, type "ldap://192.168.1.100" (without the quotes). |
ldap_version | Unless you are using a really old LDAP server, version 3 is the one you should choose. |
ldap_preventpassindb | As you don't want to store the users's password in Moodle's database, choose Yes here. |
ldap_bind_dn | This is the distinguished name of the bind user defined above. Just type "cn=ldap-user,dc=my,dc=organization,dc=domain" (without the quotes). |
ldap_bind_pw | This is the bind user password defined above. Type "hardtoguesspassword" (without the quotes). |
ldap_user_type | Choose:
|
ldap_contexts | The DN of the context (container) where all of your Moodle users are found. Type ou=moodleusers,dc=my,dc=organization,dc=domain here. |
ldap_search_sub | |
ldap_opt_deref | |
ldap_user_attribute | |
ldap_memberattribute | |
ldap_objectclass | |
Force change password | |
Use standard Change Password Page | |
ldap_expiration | |
ldap_expiration_warning | |
ldap_exprireattr | |
ldap_gracelogins | |
ldap_graceattr | |
ldap_create_context | |
ldap_creators | |
Advanced Scenarios
Using multiple LDAP Servers
Using multiple user locations (contexts) in your LDAP tree
Appendices
Talk about Global Catalog servers and MS Active Directory.