Loading...
 

LDAP Authentication tab

Overview
Tiki can authenticate users using a LDAP (Active Directory) server
To Access
From the Login Admin page, click the LDAP tab.
  • Note that the PHP ldap module must be installed for LDAP authentication to work. See PHP LDAP Module for more information.



Option Description Default
Create user if not registered in Tiki If a user was externally authenticated, but not found in the Tiki user database, Tiki will create an entry in its user database.
If this option is disabled, this user wouldn’t be able to log in.
Create the user | Deny access		 Create the user
Require admin validation for LDAP users When externally authenticated user is created in Tiki database either allow immediate login or create in disabled state that requires an administrator to approve the account before user can login to Tiki. Disabled
Create user if not in LDAP If a user was authenticated by Tiki’s user database, but not found on the LDAP server, Tiki will create an LDAP entry for this user.
As of this writing, this is not yet implemented, and this option will probably not be offered in future. 		Disabled
Use Tiki authentication for Admin log-in If this option is set, the user “admin” will be authenticated by only using Tiki’s user database and not via LDAP. This option has no effect on users other than “admin”. Enabled
Use Tiki authentication for users created in Tiki If this option is set, users that are created using Tiki are not authenticated via LDAP. This can be useful to let external users (ex.: partners or consultants) access Tiki, without being in your main user list in LDAP. Disabled
Host The hostnames, ip addresses or URIs of your LDAP servers. Separate multiple entries with Whitespace or ‘,’. If you use URIs, then the settings for Port number and SSL are ignored. Example: “localhost ldaps://master.ldap.example.org:63636” will try to connect to localhost unencrypted and if if fails it will try the master LDAP server at a special port with SSL. None
Port The port number your LDAP server uses (389 is the default, 636 if you check SSL). None
Write LDAP debug Information in Tiki Logs Write debug information to Tiki logs (Admin -> Tiki Logs, Tiki Logs have to be enabled).
Do not enable this option for production sites.		 Disabled
Use SSL (ldaps) Disabled
Use TLS Disabled
LDAP Bind Type
  • Active Directory bind will build a RDN like username@example.com where your basedn is (dc=example, dc=com) and username is your username
  • Plain bind will build a RDN username
  • Full bind will build a RDN like userattr=username, userdn, basedn where userattr is replaced with the value you put in ‘User attribute’, userdn with the value you put in ‘User DN’, basedn with the value with the value you put in ‘base DN’
  • OpenLDAP bind will build a RDN like cn=username, basedn
  • Anonymous bind will build an empty RDN

Default: Anonymous Bind | Full: userattr=username,UserDN,BaseDN | OpenLDAP: cn=username,BaseDN | Active Directory (username@domain) | Plain Username		 Default: Anonymous Bind
Search scope Used after authentication for getting user and group information.
Subtree | One level | Base object		 Subtree
Base DN None
User DN None
User attribute Uid
User OC InetOrgPerson
Realname attribute Synchronize Tiki user attributes with the LDAP values. DisplayName
Country attribute Synchronize Tiki user attributes with the LDAP values. None
Email attribute Synchronize Tiki user attributes with the LDAP values. None
Admin user None
Admin password None


List Slides
Export PDF
Handouts
Exit Slideshow
LDAP Authentication tab Related Topics Support forum Bug reports and feature requests Overview Tiki can authenticate users using a LDAP (Active Directory) server To Access From the Login Admin page, click the LDAP tab. Note that the PHP ldap module must be installed for LDAP authentication to work. See PHP LDAP Module for more information. Option Description Default Create user if not registered in Tiki If a user was externally authenticated, but not found in the Tiki user database, Tiki will create an entry in its user database. If this option is disabled, this user wouldn’t be able to log in. Create the user | Deny access Create the user Require admin validation for LDAP users When externally authenticated user is created in Tiki database either allow immediate login or create in disabled state that requires an administrator to approve the account before user can login to Tiki. Disabled Create user if not in LDAP If a user was authenticated by Tiki’s user database, but not found on the LDAP server, Tiki will create an LDAP entry for this user. As of this writing, this is not yet implemented, and this option will probably not be offered in future. Disabled Use Tiki authentication for Admin log-in If this option is set, the user “admin” will be authenticated by only using Tiki’s user database and not via LDAP. This option has no effect on users other than “admin”. Enabled Use Tiki authentication for users created in Tiki If this option is set, users that are created using Tiki are not authenticated via LDAP. This can be useful to let external users (ex.: partners or consultants) access Tiki, without being in your main user list in LDAP. Disabled Host The hostnames, ip addresses or URIs of your LDAP servers. Separate multiple entries with Whitespace or ‘,’. If you use URIs, then the settings for Port number and SSL are ignored. Example: “localhost ldaps://master.ldap.example.org:63636” will try to connect to localhost unencrypted and if if fails it will try the master LDAP server at a special port with SSL. None Port The port number your LDAP server uses (389 is the default, 636 if you check SSL). None Write LDAP debug Information in Tiki Logs Write debug information to Tiki logs (Admin -> Tiki Logs, Tiki Logs have to be enabled). Do not enable this option for production sites. Disabled Use SSL (ldaps) Disabled Use TLS Disabled LDAP Bind Type Active Directory bind will build a RDN like username@example.com where your basedn is (dc=example, dc=com) and username is your username Plain bind will build a RDN username Full bind will build a RDN like userattr=username, userdn, basedn where userattr is replaced with the value you put in ‘User attribute’, userdn with the value you put in ‘User DN’, basedn with the value with the value you put in ‘base DN’ OpenLDAP bind will build a RDN like cn=username, basedn Anonymous bind will build an empty RDN Default: Anonymous Bind | Full: userattr=username,UserDN,BaseDN | OpenLDAP: cn=username,BaseDN | Active Directory (username@domain) | Plain Username Default: Anonymous Bind Search scope Used after authentication for getting user and group information. Subtree | One level | Base object Subtree Base DN None User DN None User attribute Uid User OC InetOrgPerson Realname attribute Synchronize Tiki user attributes with the LDAP values. DisplayName Country attribute Synchronize Tiki user attributes with the LDAP values. None Email attribute Synchronize Tiki user attributes with the LDAP values. None Admin user None Admin password None