For non-anonymous searching, I've added a checkbox under server settings/advanced configuration to allow it to use the credentials of the user trying to log in to perform the initial search.

CommentFileSizeAuthor
#7 ldap_integration.patch2.92 KBlambic
#1 ldap_integration.patch3.47 KBlambic

Comments

lambic’s picture

lambic commented
StatusFileSize
new ldap_integration.patch3.47 KB
miglius’s picture

miglius commented
Issue tags: +ldapauth

In order to authenticate with the LDAP, a user DN in LDAP should be known. User authenticates with the LDAP not with his drupal username, but with his full LDAP DN. Therefore a search in LDAP is made to find out user's DN based on his drupal username. The search can be anonymous or with the credentials saved in the module configuration. The user's username and password cannot be used as the full user's DN in not yet known (the search finds it).

miglius’s picture

miglius commented
Status: Needs review » Needs work
lambic’s picture

lambic commented

It works for us, it's also the way the WordPress LDAP plugin works. It will attempt an anonymous search, and if that fails it will use the bind username/password if it was given, otherwise it will attempt to use the credentials provided by the user. The third option, and the one that works for us, is apparently peculiar to Microsoft AD.

lambic’s picture

lambic commented
Status: Needs work » Needs review
lambic’s picture

lambic commented

Any chance of getting this committed?

lambic’s picture

lambic commented
StatusFileSize
new ldap_integration.patch2.92 KB

I've rerolled this patch against the latest version, I hope we can get this committed sometime.