Enhancements

This page lists how the LDAP login handler changed after its first release, and what remains of the tools of those days. Everything named here as fixed or added is part of Exponential 6.

The data is synchronized at every sign-in

Each time an LDAP user signs in, the handler updates the account from the directory: first name, last name, e-mail address and group placement (unless KeepGroupAssignment=enabled). A location of the user that was removed is created again. This was fixed in the 4.x releases (issues 15530 and 15485).

The ldapusermanage.php cronjob was removed

The 4.x releases shipped cronjobs/ldapusermanage.php, which synchronized the accounts with the directory in the background. Once the data was updated at every sign-in it was no longer needed, and Exponential 6 does not ship it. An account is brought up to date the next time its user signs in.

Removing an LDAP user so that the next sign-in creates it again also updates its data, but loses its relations, the objects it owns and anything below its node. Do not use it as a way to synchronize.

Groups by DN, and created groups

• LDAPUserGroupAttributeType=dn: the user's group attribute holds the DNs of its groups; the group name is read from each group entry's LDAPGroupNameAttribute.
• LDAPCreateMissingGroups=enabled: with UseGroupAttribute, a group that does not exist is created below LDAPGroupRootNodeId instead of placing the user in the default group. Disabled as shipped.

Both came with the 4.3 release (issue 15490). See LDAP group mapping types.

Upper-case attribute names

LDAPLoginAttribute and LDAPGroupNameAttribute may contain upper-case letters (issue 14389, fixed in the 4.x releases).

The debug trace

LDAPDebugTrace=enabled writes the steps of a sign-in (1/5 to 5/5) to the debug output as notices. It can write the login name and password to the logs: use it on a test system only, and switch it off again.

More

• LDAP login handler and Roles and settings.