LDAP Login

Gentics Content.Node is able to authenticate users using LDAP.

1 Configuration

Enable the following features:

node.conf

// features to enable ldap
$FEATURE["ldap"] = true;
$FEATURE["ldap_login"] = true;

// configure LDAP server connection
$LDAP_LOGIN["server"] = "localhost"; // mandatory
$LDAP_LOGIN["login"] = "";
$LDAP_LOGIN["pw"] = "";
$LDAP_LOGIN["basedn"] = "o=gentics"; // mandatory
$LDAP_LOGIN["filter"] = "|(employeeType=cms)(employeeType=admin)";
// if binddn is set to 1 Gentics Content.Node will try to search for
// the user and bind with the found DN and the password provided
// by the user
$LDAP_LOGIN["binddn"] = 1;

// map ldap attributes to user attributes using these settings
$LDAP_LOGIN_FIELDS["login"] = "uid";
$LDAP_LOGIN_FIELDS["pw"] = "";
$LDAP_LOGIN_FIELDS["firstname"] = "givenName";
$LDAP_LOGIN_FIELDS["lastname"] = "sn";
$LDAP_LOGIN_FIELDS["email"] = "mail";
// "group" may contain a CMS group id or a LDAP field name that
// contains the CMS group id or a string that exactly matches
// a single group's description in the CMS
$LDAP_LOGIN_FIELDS["group"] = 1;
$LDAP_LOGIN_FIELDS["isdefaultgroup"] = true;

2 Advanced Groups

Another feature enables you to have users defined as attributes of LDAP groups.

node.conf

$LDAP_LOGIN_FIELDS["advancedgroups"] = true;
$LDAP_LOGIN_FIELDS["groupfilter"] = "(&(objectclass=groupofUniqueNames)(cn=CMS*))"

Using “(cn=CMS*)” filters for the prefix of the desired group (in this case “CMS”) while objectclass will restrict for an attribute to speed up the search process. First all matching groups will be loaded. Then the user who tries to log on will be searched from the resulting set of groups and added to the corresponding CMS group. LDAP group names will will be mapped to CMS group description, eg. a user of group “(cn=CMS-Superadmin)” will be mapped to a CMS group having “CMS-Superadmin” as it’s description.