Configuration of ldapauth module

Once the LDAP Integration module (also referred to as ldapauth module) is installed, it's time to enable the module and configure it.

Enabled the module
• Proceed to Administer >> Site building >> Modules
• In the fieldset titled "Administration", enable the ldapauth module

Configure the module
• Proceed to Administer >> Site Configuration >> LDAP Integration
• Click Configure LDAP Server
• Server Settings
  • Name: Name of the LDAP Configuration. It must be unique
  • LDAP Server: Hostname of the LDAP Server. For e.g. ldap.example.com For Active Directory, this would be the hostname of the AD domain controller. If you have multiple domain controllers, then common practice is to create a DNS Round Robin entry for all of the domain controllers and use that entry (dc.example.com).
  • LDAP Port: Standard LDAP ports are 389 and 636. 389 is standard non-secure port where communications occur in cleartext (analogous to HTTP Port 80). 636 is the standard encrypted LDAP port (analogous to HTTP Port 443.
    If you are using Active Directory, then you must select the encrypted port, 636.
  • Use TLS Encryption: Required for Active Directory. For encrypted communications, select this option. (TLS is the new name for SSL, so if your LDAP server requires "SSL", then you must check this box )
  • Store passwords in encrypted form: This option is used by the optional ldapdata module, which allows for changing of passwords using Drupal. Using this option will cause the LDAP data module to perform MD5 encryption of the passwords before they are sent to LDAP. If your LDAP server natively performs encryption, then it could cause problems.
• Login Procedure
  • Do not store users' passwords during sessions: If you are going to use the ldapdata module and allow users to modify their LDAP entries, this module will need to store the user password during the session, so that it can have write access to the LDAP directory.

    Physically, these passwords are stored in the Drupal's session table in clear text. If the database is well protected, this should not be a problem, but some admins may feel uneasy about this.

    If you are not going to use the ldapdata module, or you are, but only for read-only access, you can safely check this box and get extra security for your system.

  • When logging in, Drupal will look up for the user in:
    • Drupal's own database. If it fails, look in LDAP: Self-explanatory
    • LDAP Directory only: Selecting this option will cause ONLY LDAP accounts to be authenticated and registered, except for the initial admin user (user with uid=1). Drupal's core administration relies on this user, so this user is NEVER authenticated with any database other than the local drupal database
  • Base DNs: In the text area below, enter the base dn to search against when authenticating LDAP users. You can enter multiple DNs, one per line. PHP LDAP performs SUB scope searches by design. So if all of your users are organized under several sub-containers under say for e.g., cn=Users,dc=example,dc=org, then you only need to enter 1 base dn, cn=Users, dc=example, dc=com
    For OpenLDAP etc, an example would be ou=People,dc=example,dc=com
    For Active Directory, an example would be cn=Users,dc=example,dc=com
  • Username Attribute: The attribute in the user's object representing the username.
    For Active Directory, it is sAMAccountName and for most Unix LDAP environments, it is uid
• Advanced Configuration
  The process of authentication starts by establishing an anonymous connection to the LDAP directory and looking up for the user on it. Once this user is found, LDAP authentication is performed on them.

  However, some LDAP configurations (specially common in Active Directory setups) restrict anonymous searches.

  If your LDAP setup does not allow anonymous searches, or these are restricted in such a way that login names for users cannot be retrieved as a result of them, then you have to specify here a DN//password pair that will be used for these searches.

  For security reasons, this pair should belong to an LDAP account with stripped down permissions.Most LDAP and Active Directories do not allow anonymous binds

  • DN for non-anonymous searches: Enter the BINDDN of the account used to bind to the LDAP directory. For e.g. cn=drupalread,ou=Service Accounts,ou=People,dc=example,dc=com
  • Password for non-anonymous searches: Enter the BIND password. Note: This password is stored in cleartext in the drupal database so you must take steps to protect the database

Save the Configuration
Save the configuration and you will be re-directed to the LDAP Integration configuration list page. You can have multiple LDAP servers configured and individually active and de-activate them. Deactivating a config will prevent it from being used by any of the LDAP modules.

NOTE: The LDAP Servers will be consulted in the order they are listed. They are listed in the order they are created. Future releases will include an option to re-order them for authentication.