Home/ Questions/Q 9030953
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T07:36:59+00:00

I am trying to setup the bhLDAPAuthPlugin to authenticate through Active Directory. I am

  • 0

I am trying to setup the bhLDAPAuthPlugin to authenticate through Active Directory. I am having trouble configuring the settings for authentication.

In the adLDAP.php file here are the default settings:

class adLDAP {
    // BEFORE YOU ASK A QUESTION, PLEASE READ THE DOCUMENTATION AND THE FAQ
    // http://adldap.sourceforge.net/documentation.php
    // http://adldap.sourceforge.net/faq.php

    // You can set your default variables here, or when you invoke the class
    var $_account_suffix="@mydomain.local";
    var $_base_dn = "DC=mydomain,DC=local"; 

    // An array of domain controllers. Specify multiple controllers if you 
    // would like the class to balance the LDAP queries amongst multiple servers
    var $_domain_controllers = array ("dc01.mydomain.local");

    // optional account with higher privileges for searching
    // not really that optional because you can't query much as a user
    var $_ad_username=NULL;
    var $_ad_password=NULL;

    // AD does not return the primary group. http://support.microsoft.com/?kbid=321360
    // This tweak will resolve the real primary group, but may be resource intensive. 
    // Setting to false will fudge "Domain Users" and is much faster. Keep in mind though that if
    // someone's primary group is NOT domain users, this is obviously going to bollocks the results
    var $_real_primarygroup=true;

    // Use SSL, your server needs to be setup, please see - http://adldap.sourceforge.net/ldap_ssl.php
    var $_use_ssl=false;

    // When querying group memberships, do it recursively
    // eg. User Fred is a member of Group A, which is a member of Group B, which is a member of Group C
    // user_ingroup("Fred","C") will returns true with this option turned on, false if turned off
    var $_recursive_groups=false;

    // You should not need to edit anything below this line
    //******************************************************************************************

This question may seem abstract, but how do I determine this info?

In the documentation for the plugin, it says the account_suffix should be the domain I am connecting to, but I have found other documentation that lists out the specific parameters like organization such as:

account_suffix = "ou=People, o=domain.edu";

How do I find which to use?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you have access to the Active Directory and permission to run Active Directory Users and Computers, you can figure this out fairly easily.

    First off, AD for backwards compatibility reasons uses ‘domain’ objects, which are dc= in LDAP. So the suffix will likely be in the form of dc=domain,dc=com or the like.

    Your AD admins might have chosen to leave users in the default Users container, which is actually cn=Users and not ou=Users as you might expect.

    Or else they made a series of OU’s for user storage. Totally up to them.

    In ADUC, you can see the layout with the domain name at the very top as the root most node. That will be domain.com or the like, which means dc=domain, dc=com at one end.

    Then look around to see where Users are stored (or at least the ones you expect to use this service) and then for each OU add an ou=whatever to the dc=domain,dc=com.

    • 0