Skip to content

LDAP authentication

LDAP authentication verifies MRBS users against an LDAP directory such as OpenLDAP or Microsoft Active Directory.

$auth["type"] = "ldap";
$auth["session"] = "php";

The PHP LDAP extension must be installed.

Connection settings

Configure the directory servers, protocol version, transport security, base distinguished name, and search filters in config.inc.php. Copy the relevant LDAP settings from systemdefaults.inc.php before changing them.

Prefer encrypted transport:

  • LDAPS where supported; or
  • LDAP with StartTLS.

Install and verify the directory server's certificate chain. Do not disable verification to work around a certificate problem.

User lookup

The login name is located using the configured user attribute and filter. Directory layouts differ, so test with:

  • a normal user;
  • an administrator;
  • a user outside the allowed organizational unit;
  • a disabled account; and
  • a username containing valid non-ASCII characters, if applicable.

Groups and administrators

MRBS can use directory attributes and group membership to identify or describe users. Ensure nested-group behavior matches your directory and document which groups grant MRBS administration.

Attribute mapping

Optional mappings can retrieve email addresses and display names:

$ldap_get_user_email = true;
$ldap_email_attrib = 'mail';
$ldap_name_attrib = 'cn';

Attribute names and returned formats vary between LDAP implementations.

Troubleshooting safely

LDAP debug options can expose directory details. Enable them only for a limited test, restrict access to the output, and disable them immediately afterward.

When login fails, check transport and certificates before changing search filters or credentials.