* @copyright ©2014-2014 Andreas Heigl * @license http://www.opesource.org/licenses/mit-license.php MIT-License * @version 0.0 * @since 19.12.14 * @link https://github.com/heiglandreas/authLdap */ ?>
Caveat: The LDAP-extension is not loaded! Without that extension it is not possible to query an LDAP-Server! Please have a look at the PHP-Installation page

AuthLDAP Options

General Usage of authLDAP

/>
/>
/>

Shall we prohibit authenticating already in WordPress created users using LDAP? If you enable this, LDAP-Users with the same user-ID as existing WordPress-Users can no longer take over the WordPress-Users account. This also means that LDAP-Users with the same User-ID as existing WordPress-Users will not be able to authenticate anymore! Accounts that have been taken over already will not be affected by this setting.

This should only be checked if you know what you are doing!

/>
/>

Search LDAP for user's groups and map to Wordpress Roles.

General Server Settings

The URI for connecting to the LDAP-Server. This usualy takes the form <scheme>://<user>:<password>@<server>/<path> according to RFC 1738.

In this case it schould be something like ldap://uid=adminuser,dc=example,c=com:secret@ldap.example.com/dc=basePath,dc=example,c=com.

If your LDAP accepts anonymous login, you can ommit the user and password-Part of the URI

You can use the pseudo-schema env to provide your LDAP-URI from an environment-variable. So if you have your LDAP-URI in a variable called LDAP_URI you can enter env:LDAP_URI in this field and at runtime the appropriate value will be taken from the Environment-variable LDAP_URI. If the varialbe is not set, then the value will be empty.

You can also provide different parts of the LDP-URI from environment variables by providing %env:[VARIABLENAME]% within your LDAP-URI. So if you want to provide the password from an Environment-variable LDAP_PASSWORD your LDAP-URI looks like ldap://uid=adminuser,dc=example,c=com:%env:LDAP_PASSWORD%@ldap.example.com/dc=basePath,dc=example,c=com

Caveat!
If you are using Environment-variables for parts of the LDAP-URL then those must not be URL-Encoded!
Otherwise the different parts must be URL-Encoded!

A separator that separates multiple LDAP-URIs from one another. You can use that feature to try to authenticate against multiple LDAP-Servers as long as they all have the same attribute-settings. The first LDAP-Server the user can authenticate against will be used to handle the user.

/>

Use StartTLS for encryption of ldap connections. This setting is not to be used in combination with ldaps connections (ldap:// only).

Please provide a valid filter that can be used for querying the LDAP for the correct user. For more information on this feature have a look at http://andreas.heigl.org/cat/dev/wp/authldap

This field should include the string %s that will be replaced with the username provided during log-in

If you leave this field empty it defaults to (uid=%s)

Settings for creating new Users


Which Attribute from the LDAP contains the Full or the First name of the user trying to log in.

This defaults to name

If the above Name-Attribute only contains the First Name of the user you can here specify an Attribute that contains the second name.

This field is empty by default

Please give the Attribute, that is used to identify the user. This should be the same as you used in the above Filter-Option

This field defaults to uid

Which Attribute holds the eMail-Address of the user?

If more than one eMail-Address are stored in the LDAP, only the first given is used

This field defaults to mail

If your users have a personal page (URI) stored in the LDAP, it can be provided here.

This field is empty by default

Here you can select the default role for users. If you enable LDAP Groups below, they will take precedence over the Default Role.

Existing users will retain their roles unless overriden by LDAP Groups below.

Groups for Roles

/>

If role determined by LDAP Group differs from existing Wordpress User's role, use LDAP Group.

This is the base dn to lookup groups.

If empty the base dn of the LDAP URI will be used

This is the attribute that defines the Group-ID that can be matched against the Groups defined further down

This field defaults to gidNumber

This attribute defines the separator used for the Group-IDs listed in the Groups defined further down. This is useful if the value of Group-Attribute listed above can contain a comma (for example, when using the memberof attribute)

This field defaults to , (comma)

Here you can add the filter for selecting groups for ther currentlly logged in user

The Filter should contain the string %s which will be replaced by the login-name of the currently logged in user

Alternatively the string %dn% will be replaced by the DN of the currently logged in user. This can be helpfull if group-memberships are defined with DNs rather than UIDs

This field defaults to (&(objectClass=posixGroup)(memberUid=%s))

Role - group mapping

get_names() as $group => $vals) : $aGroup=$authLDAPGroups[$group]; ?>

What LDAP-Groups shall be matched to the -Role?

Please provide a coma-separated list of values

This field is empty by default