[line
135]
Storage driver for fetching login data from LDAP
This class is heavily based on the DB and File containers. By default it connects to localhost:389 and searches for uid=$username with the scope "sub". If no search base is specified, it will try to determine it via the namingContexts attribute. It takes its parameters in a hash, connects to the ldap server, binds anonymously, searches for the user, and tries to bind as the user with the supplied password. When a group was set, it will look for group membership of the authenticated user. If all goes well the authentication was successful.
Parameters:
host: localhost (default), ldap.netsols.de or 127.0.0.1 port: 389 (default) or 636 or whereever your server runs url: ldap://localhost:389/ useful for ldaps://, works only with openldap2 ? it will be preferred over host and port binddn: If set, searching for user will be done after binding as this user, if not set the bind will be anonymous. This is reported to make the container work with MS Active Directory, but should work with any server that is configured this way. This has to be a complete dn for now (basedn and userdn will not be appended). bindpw: The password to use for binding with binddn scope: one, sub (default), or base basedn: the base dn of your server userdn: gets prepended to basedn when searching for user userattr: the user attribute to search for (default: uid) useroc: objectclass of user (for the search filter) (default: posixAccount) groupdn: gets prepended to basedn when searching for group groupattr : the group attribute to search for (default: cn) groupoc : objectclass of group (for the search filter) (default: groupOfUniqueNames) memberattr : the attribute of the group object where the user dn may be found (default: uniqueMember) memberisdn: whether the memberattr is the dn of the user (default) or the value of userattr (usually uid) group: the name of group to search for debug: Enable/Disable debugging output (default: false)
To use this storage container, you have to use the following syntax:
<?php ...
$a = new Auth("LDAP", array( 'host' => 'localhost', 'port' => '389', 'basedn' => 'o=netsols,c=de', 'userattr' => 'uid' 'binddn' => 'cn=admin,o=netsols,c=de', 'bindpw' => 'password'));
$a2 = new Auth('LDAP', array( 'url' => 'ldaps://ldap.netsols.de', 'basedn' => 'o=netsols,c=de', 'scope' => 'one', 'userdn' => 'ou=People', 'groupdn' => 'ou=Groups', 'groupoc' => 'posixGroup', 'memberattr' => 'memberUid', 'memberisdn' => false, 'group' => 'admin' ));
$a3 = new Auth('LDAP', array( 'host' => 'ad.netsols.de', 'basedn' => 'dc=netsols,dc=de', 'userdn' => 'ou=Users', 'binddn' => 'cn=Jan Wagner,ou=Users,dc=netsols,dc=de', 'bindpw' => '*******', 'userattr' => 'samAccountName', 'useroc' => 'user', 'debug' => true ));
The parameter values have to correspond to the ones for your LDAP server of course.
When talking to a Microsoft ActiveDirectory server you have to use 'samaccountname' as the 'userattr' and follow special rules to translate the ActiveDirectory directory names into 'basedn'. The 'basedn' for the default 'Users' folder on an ActiveDirectory server for the ActiveDirectory Domain (which is not related to its DNS name) "win2000.example.org" would be: "CN=Users, DC=win2000, DC=example, DC=org' where every component of the domain name becomes a DC attribute of its own. If you want to use a custom users folder you have to replace "CN=Users" with a sequence of "OU" attributes that specify the path to your custom folder in reverse order. So the ActiveDirectory folder "win2000.example.org\Custom\Accounts" would become "OU=Accounts, OU=Custom, DC=win2000, DC=example, DC=org'
It seems that binding anonymously to an Active Directory is not allowed, so you have to set binddn and bindpw for user searching,
Example a3 shows a tested example for connenction to Windows 2000 Active Directory
