Roles and Settings

Roles

The LDAP login handler creates and updates users and user groups; it never creates roles or assigns them. What an LDAP user may do comes only from the roles assigned to the groups the handler places the user in, and to the groups above them.

A user whose groups carry no role cannot do anything after signing in, even though the directory accepted the password. So:

• assign a role with the basic policies (for example user/login for the siteaccess, content/read) to the group of LDAPGroupRootNodeId, or to a group above it, so that every group the handler creates there inherits it;
• assign the same to the default group of LDAPUserGroup[], so that users whose group mapping finds nothing can still sign in;
• assign further roles to the groups that need more, under Users > Roles and policies.

Groups the handler creates (with GetGroupsTree, or UseGroupAttribute and LDAPCreateMissingGroups=enabled) appear on their first use; assign their roles after that, or create the groups yourself beforehand with the names the directory uses.

Settings

The handler is configured in settings/ldap.ini, group [LDAPSettings]; put your values in settings/override/ldap.ini.append.php. It is used only when LDAP is listed in site.ini [UserSettings] LoginHandler[].

Each setting is described, with its shipped value, in the settings of ldap.ini and in the comments of settings/ldap.ini.