Configure a server#
LDAP Servers stores connection configurations. Other modules bind and search through those entities. One physical directory can have several configurations (different bind users, base DNs, or purposes).
Admin: Configuration → People → LDAP → Servers
(/admin/config/people/ldap/server). After you create a server, use
Test on that entity.
Start with a service account bind. It is the usual production setup and is required to provision entries back into LDAP.
Connection#
| Setting | Notes |
|---|---|
| Address | Hostname only. Do not prefix ldap:// or ldaps://. |
| Port | Typically 389 (LDAP / STARTTLS) or 636 (LDAPS). |
| Encryption | none, ssl (ldaps://), or tls (STARTTLS). |
| Timeout | Seconds to wait for the network and query. |
Linux LDAP libraries often fail with self-signed certificates. Prefer certificates the OS trust store accepts.
Bind methods#
| Method | When to use |
|---|---|
service_account |
Default. Bind DN + password for searches and provisioning. |
user |
Bind as the logging-in user. DN must match cn=[username],[base dn]. Only useful during login. |
anon_user |
Anonymous search to find the user DN, then bind as that user. |
anon |
No credentials. Rarely works on encrypted connections. |
Service account credentials should be a dedicated directory account with the least privilege you can grant.
Users and identifiers#
Set these from your directory schema, not from guesswork:
- Authentication name attribute (
user_attr): value people type at login (cn,uid,sAMAccountName, …). The form stores these names in lowercase. - Account name attribute: Drupal username if it differs from the authentication name.
- Email attribute and optional email template.
- Persistent unique ID (
unique_persistent_attr): used to recognize the same person across renames and for orphan detection. Mark it binary when the directory stores a binary GUID.
Base DNs are a list: people, groups, or other branches you search.
Groups#
Configure group object class, membership attributes, nesting, and optional groups derived from the user DN when you will use Authorization or group-based logic. You can mark groups unused if this site never maps directory groups.
After save#
The server list should show the configuration as available. If it does not, the usual causes are bind DN/password, port, encryption, or certificates. Use the server Test form with the testing username and DN you stored on the entity.
Example OpenLDAP values for the in-repo sample directory are in Hogwarts.