LDAP authentication

This document describes how to set up LDAP authentication in Moodle. You can find a Basic Scenario, where everything is simple and straightforward, and that should be enough for most installations. If your installation is a little bigger and you are using multiple LDAP servers, or multiple locations (contexts) for your users in your LDAP tree, then have a look at the Advanced Scenarios.

Basic Scenario

Assumptions

1. Your Moodle site is located at http://your.moodle.site/
2. You have configured your PHP installation with the LDAP extension. It is loaded and activated, and it shows when you go to http://your.moodle.site/admin/phpinfo.php (logged in as user 'admin').
3. Your LDAP server has 192.168.1.100 as its IP address.
4. You are not using LDAP with SSL (also known as LDAPS) in your settings. This might prevent certain operations from working (e.g., you cannot update data if you are using MS Active Directory -- MS-AD from here on --), but should be OK if you just want to authenticate your users.
5. You are using a single domain as the source of your authentication data in case you are using MS-AD (more on this in the Appendices).
6. You are using a top level distinguished name (DN) of dc=my,dc=organization,dc=domain as the root of your LDAP tree.
7. You have a non-privileged LDAP user account you will use to bind to the LDAP server. This is not necessary with certain LDAP servers, but MS-AD requires this and it won't hurt if you use it even if your LDAP server doesn't need it. Make sure this account and its password don't expire, and make this password as strong as possible. Remember you only need to type this password once, when configuring Moodle, so don't be afraid of making it as hard to guess as possible. Let's say this user account has a DN of cn=ldap-user,dc=my,dc=organization,dc=domain, and password hardtoguesspassword.
8. All of your Moodle users are in an organizational unit (OU) called moodleusers, which is right under you LDAP root. That OU has a DN of ou=moodleusers,dc=my,dc=organization,dc=domain.
9. You don't want your LDAP users' passwords to be stored in Moodle at all.

Configuring Moodle authentication

Log in as an admin user and go to Administration >> Users >> Authentication. In the drop down listbox titled "Choose an authentication method" select "Use an LDAP Server". You will get a page similar to this one:

Now, you just have to fill in the values. Let's go step by step.

Field name	Value to fill in
ldap_host_url	As the IP of your LDAP server is 192.168.1.100, type "ldap://192.168.1.100" (without the quotes).
ldap_version	Unless you are using a really old LDAP server, version 3 is the one you should choose.
ldap_preventpassindb	As you don't want to store the users's password in Moodle's database, choose Yes here.
ldap_bind_dn	This is the distinguished name of the bind user defined above. Just type "cn=ldap-user,dc=my,dc=organization,dc=domain" (without the quotes).
ldap_bind_pw	This is the bind user password defined above. Type "hardtoguesspassword" (without the quotes).
ldap_user_type	Choose: Novel Edirectory if your LDAP server is running Novell's Edirectory. posixAccount (rfc2307) if your LDAP server is running a RFC-2307 compatible LDAP server (choose this is your server is running OpenLDAP). posixAccount (rfc2307bis) if your LDAP server is running a RFC-2307bis compatible LDAP server. sambaSamAccount (v.3.0.7) if your LDAP server is running with SAMBA's 3.x LDAP schema extension and you want to use it. MS ActiveDirectory if your LDAP server is running Microsoft's Active Directory.
ldap_contexts	The DN of the context (container) where all of your Moodle users are found. Type ou=moodleusers,dc=my,dc=organization,dc=domain here.
ldap_search_sub
ldap_opt_deref
ldap_user_attribute
ldap_memberattribute
ldap_objectclass
Force change password
Use standard Change Password Page
ldap_expiration
ldap_expiration_warning
ldap_exprireattr
ldap_gracelogins
ldap_graceattr
ldap_create_context
ldap_creators

Appendices

Talk about Global Catalog servers and MS Active Directory.

See also

• Using Moodle: User authentication forum