| Authentication | Users | Password |
|---|---|---|
| ✔ | ✔ | ✔ |
LL::NG can use an LDAP directory to:
This works with every LDAP v2 or v3 server, including Active Directory.
LL::NG is compatible with LDAP password policy:
In Manager, go in General Parameters > Authentication modules and choose LDAP for authentication, users and/or password modules.
The authentication level given to users authenticated with this module.
ldap+tls://server and to use LDAPS, set ldaps://server instead of server name.ldap+tls://server/verify=none&capath=/etc/ssl. You can also use caFile and caPath parameters.
(&(uid=$user)(objectClass=inetOrgPerson)))(&(mail=$mail)(objectClass=inetOrgPerson)))
(&(sAMAccountName=$user)(objectClass=person))
And this as mail filter:
(&(mail=$mail)(objectClass=person))
password modify instead of standard modify operation.Standards attributes, like uid, cn or mail, are often enough to configure access rules and headers.
But sometimes other data are needed (in particular to use extended functions):
Of course, standard LDAP attributes can be used to store these data, but LL::NG also provides an LDAP schema extension to manage them.
Extended attributes and object classes use this prefix: 1.3.6.1.4.1.10943.10.2.
The prefix 1.3.6.1.4.1.10943 is owned by LINAGORA (See http://www.iana.org/assignments/enterprise-numbers).
Just add this file to OpenLDAP schemas by including it in slapd.conf:
include /usr/share/lemonldap-ng/ressources/sso.schema
This will provide the auxiliary object class ssoUser with attributes:
You can add this object class to any entry of your directory.