LDAP authentication

Revision as of 01:12, 15 February 2006 by Helen (talk | contribs) (category edits)

Jump to: navigation, search

This document describes how to set up LDAP authentication in Moodle. You can find a Basic Scenario, where everything is simple and straightforward, and that should be enough for most installations. If your installation is a little bigger and you are using multiple LDAP servers, or multiple locations (contexts) for your users in your LDAP tree, then have a look at the Advanced Scenarios.

Basic Scenario


  1. Your Moodle site is located at http://your.moodle.site/
  2. You have configured your PHP installation with the LDAP extension. It is loaded and activated, and it shows when you go to http://your.moodle.site/admin/phpinfo.php (logged in as user 'admin').
  3. Your LDAP server has as its IP address.
  4. You are not using LDAP with SSL (also known as LDAPS) in your settings. This might prevent certain operations from working (e.g., you cannot update data if you are using MS Active Directory -- MS-AD from here on --), but should be OK if you just want to authenticate your users.
  5. You are using a single domain as the source of your authentication data in case you are using MS-AD (more on this in the Appendices).
  6. You are using a top level distinguished name (DN) of dc=my,dc=organization,dc=domain as the root of your LDAP tree.
  7. You have a non-privileged LDAP user account you will use to bind to the LDAP server. This is not necessary with certain LDAP servers, but MS-AD requires this and it won't hurt if you use it even if your LDAP server doesn't need it. Make sure this account and its password don't expire, and make this password as strong as possible. Remember you only need to type this password once, when configuring Moodle, so don't be afraid of making it as hard to guess as possible. Let's say this user account has a DN of cn=ldap-user,dc=my,dc=organization,dc=domain, and password hardtoguesspassword.
  8. All of your Moodle users are in an organizational unit (OU) called moodleusers, which is right under you LDAP root. That OU has a DN of ou=moodleusers,dc=my,dc=organization,dc=domain.
  9. You don't want your LDAP users' passwords to be stored in Moodle at all.

Configuring Moodle authentication

Log in as an admin user and go to Administration >> Users >> Authentication. In the drop down listbox titled "Choose an authentication method" select "Use an LDAP Server". You will get a page similar to this one:

auth ldap config screenshot.jpg

Now, you just have to fill in the values. Let's go step by step.

Field name Value to fill in
ldap_host_url As the IP of your LDAP server is, type "ldap://" (without the quotes).
ldap_version Unless you are using a really old LDAP server, version 3 is the one you should choose.
ldap_preventpassindb As you don't want to store the users's password in Moodle's database, choose Yes here.
ldap_bind_dn This is the distinguished name of the bind user defined above. Just type "cn=ldap-user,dc=my,dc=organization,dc=domain" (without the quotes).
ldap_bind_pw This is the bind user password defined above. Type "hardtoguesspassword" (without the quotes).
ldap_user_type Choose:
  • Novel Edirectory if your LDAP server is running Novell's Edirectory.
  • posixAccount (rfc2307) if your LDAP server is running a RFC-2307 compatible LDAP server (choose this is your server is running OpenLDAP).
  • posixAccount (rfc2307bis) if your LDAP server is running a RFC-2307bis compatible LDAP server.
  • sambaSamAccount (v.3.0.7) if your LDAP server is running with SAMBA's 3.x LDAP schema extension and you want to use it.
  • MS ActiveDirectory if your LDAP server is running Microsoft's Active Directory.
ldap_contexts The DN of the context (container) where all of your Moodle users are found. Type ou=moodleusers,dc=my,dc=organization,dc=domain here.
Force change password
Use standard Change Password Page

Advanced Scenarios

Using multiple LDAP Servers

Using multiple user locations (contexts) in your LDAP tree


Talk about Global Catalog servers and MS Active Directory.

See also