LDAP authentication backend
Presentation
LDAP is the default (and historical) authentication backend. It will do the following LDAP operations:- Bind with managerDN
- Search for user in directory with authFilter to get DN associated with the posted login
- Bind with found DN and posted password
Configuration
Set the authentication backend:authentication => LDAP,
If no authentication backend is configured, LDAP is choosen by default.
You can use the following parameters, in Manager or in portal/index.pl:
- ldapServer: server(s) used to retrive session informations and to valid credentials (localhost by default). More than one server can be set here separated by commas. The servers will be tested in the specifies order. To use TLS, set "ldap+tls://server" and to use LDAPS, set ldaps://server" instead of server name. If you use TLS, you can set any of the Net::LDAP->start_tls() sub like "ldap/tls://server/verify=none&capath=/etc/ssl". You can also use caFile and caPath parameters.
- ldapPort: TCP port used by LDAP server. Can be overriden by an LDAP URI in ldapServer.
- ldapBase: Base of search in the LDAP directory.
- LDAPFilter and AuthLDAPFilter: filter for the search in LDAP directory. Default is (&(uid=$user)(objectClass=inetOrgPerson)).
- managerDn: DN used to connect to LDAP server. By default, anonymous bind is used.
- managerPassword: password to used to connect to ldap server. By default, anonymous bind is used.
- ldapPpolicyControl: set to 1 to use LDAP Password Policy control (see LDAP Password Policy).
Specific configuration for Active Directory
For Active Directory, you have to use a specific filter like:
AuthLDAPFilter => '(&(sAMAccountName=$user)(objectClass=person))',
Active Directory does not support LDAP Password Policy.