Hi,

I'd like to limit the logon to only specific LDAP-accounts (based on their e-mail addresses).
Is this possible?

What do I have to put in the 'php filter'-field to only allow LDAP-access to user1@domain.com & user2@domain.com
(something like return $ldap['mail']==user1@domain.com? don't have a clue)

Regards.

Comments

cgmonroe’s picture

cgmonroe commented
Status: Active » Closed (fixed)

Clearing out old support requests - reopen if problem still exists in newest code (dev)

That said:

The "PhP to filter users based on their ldap data" code works as follows:

  • User tries to log in with a name/password
  • The ldap server is searched for a match to the user name
  • If a match is found, the $ldap array is filled with the ldap search results. See: http://php.net/manual/en/function.ldap-get-entries.php for the structure of this array.
  • If filter code defined, it is run with access to the $ldap info. If it returns FALSE, the user is denied. If it is TRUE, the name/password is validated against the server

Best practice for complicated tests would be to create a custom module with a mymodule_ldap_filter( $ldap ) function. This function would perform the checks you need to determine if an ldap user can log in.

Then the filter code would be entered as: return mymodule_ldap_filter( $ldap );

One other thing to note is that the ldapgroups module might be an easier method of doing this. It has an option to deny access to any ldap user who is not a member of a specific group.