About LDAP-Lyceum
The LDAP-Lyceum plugin (http://source.ibiblio.org/svn/lyceum-addons/plugins/ldap-lyceum/) replaces the standard lyceum login with an LDAP login. All users apart from the admin user are verified against an LDAP server. Users still need to be created in Lyceum using the normal registration process.
Important
Note that it is an all or nothing change - either all users are verified against the Lyceum database or all users are verified against an LDAP server. Also be sure that the username in Lyceum matches the username in the LDAP server.
Credit
This is based almost completely on work by Patrick Cavit, who in turn gives credit to Alistair Young and his LDAP Plugin.
How to setup
- Download the plugin source and place it in the src/lyceum/wp-content/systemplugins/ directory.
- Update the settings in the file src/lyceum/wp-content/systemplugins/ldap-config.php (see below for details).
- Login as 'admin' for your Lyceum install.
- Under 'System Settings' follow the first link 'system-wide plugins'.
- Activate the LDAP plugin.
- Finished - register a user and test that you are verifying against your LDAP server.
ldap-config.php
USELDAP - this should always be 'true' if you want to verify against your LDAP server. If its 'false' then standard verification will occur.
LDAPSALT - set this to a secret string that is unique for your install. The string is used as a salt to reduce the likelihood that an attacker will be able to impersonate one of your logged-in users. Note: the LDAP password is not stored anywhere (incl. in a cookie) by the plugin.
LDAPSERVER - this is the hostname of your LDAP server (e.g. ldap.uni.edu.au). For secure LDAP add the protocol (e.g. ldaps://ldap.uni.edu.au). Note: you will need help from clever techos to get secure LDAP working from PHP.
LDAPOU - this is the 'OU'/Organisation Unit part of the LDAP binding string. e.g. 'ou=People,o=uni.edu.au'
LDAPCN - this is the 'CN'/Common Name part of the LDAP binding string - joined with the 'DN'/Domain Name part of the binding. The CN part is only needed when your LDAP server requires a login to bind. e.g. 'dc=uni,dc=edu,dc=au' (non-login required) and 'cn=admin,dc=uni,dc=edu,dc=au' (login with user admin required).
LDAPPASS - this is the password for use when your LDAP server requires a login to bind. Only set this if you are sure you need one.
Help & Comments
Contact me (Michael Harmer - michael.harmer AT anu.edu.au) for help and if you have any comments/bugs. I'm not a LDAP expert by any means so I'm probably not useful when it comes to binding string advice - see you friendly local admin for such things.
