EXT: LDAP Integration¶

What does it do?¶

This extension enables import/update/deletion of frontend-users from a LDAP-directory, especially W2k actice directory. In this way, TYPO3 can be used as an intranet CMS. Department information can be used to join users to corresponding usergroups.

For each sysfolder holding users multiple LDAP servers can be defined.

Screenshots¶

Installation¶

When you click the extension in the extension manager you may activate some basic (reads: not dependent on a server definition) features of the extension. For instance you may restrict authentication to your directory without a fallback against the TYPO3 user database.

The default settings prevent the extension to do anything! You have to activate it for the frontend and backend separately!

Creation of servers and users¶

To create FE-users and LDAP servers follow the following steps:

Define a SysFolder for storing your FE-users.

When you use the LDAP attribute “department” you can create corresponding usergroups in the SysFolder. A user in the department “Software” for example will then be joined the group “Software”. This way you can apply access rules on pages and content elements depending on the department.

Create a new LDAP server in the above mentioned SysFolder by choosing “new” and selecting “LDAP server”. Fill in the appropriate parameters for your organization.

You may create multiple LDAP servers per SysFolder.

Click on “LDAP Integration” in the “web” section and choose the above mentioned SysFolder. You should see a short summary with the numbers of users both in TYPO3 and in the directory.

Now choose an option from the dropdown menue. You may import new users, update the existing ones (without importing new ones!) or delete users without a corresponding entry in the directory.

FAQ¶

• What is my base DN? In a W2k environment it should be the domain name.
• Which servers support the “memberOf/groupMembership” attribute? Win2k Active Directory and Novell e-directory definitely support this attribute.
• Why can I choose between two Active Directory modes and what is the difference? When authenticating against a Windows domain controller th “old” Windows NT syntax is domainuser, e.g. eumedianorman. With W2k the new format is user@domain , e.g. norman@myserver.local . In most cases it does not matter which format you choose but some users reported problems when using the wrong format.
• Users are imported but their password as I see it in the backend is wrong. Why? The passwords you see in the backend are created randomly. There is no import of passwords but authentication is done everytime against the LDAP server.
• Can I assign users to groups? Yes, currently standard implementations of AD, NDS and OpenLDAP are supported. Additionally you may define own attributes to build your usergroups.
• Can I import user groups automatically? Yes, you can.
• Can I encrypt my connection to the LDAP server? Yes, begin your server definition with “ldaps://”. The default setting for encrypted connections is port 636.You need to compile PHP with SSL support (or load the module under Windows).
• How does the SSO integration work? For single sign on the user's password is encrypted and cached, the key is stored in a cookie. Just tick the checkbox in the extension's settings.

How authentication works¶

When a user tries to log on the extension passes the credentials to the LDAP server(s) and verifies them. When a LDAP server can authenticate the user he is logged on. When you tick the checkbox “Import users automatically” new users (in the directory but not in the TYPO3 database) are imported after authentication. Records of existing users are updated.

For new users imported from the directory random passwords will be inserted!

You may choose whether authentication is done only against your directory or also again the TYPO3 user database.

LDAP support in PHP¶

When using the Windows Quickstart package, you have to do the following to get the extension working (otherwise you will receive a white screen when trying to import/update users):

Copy c:apachephpdllslibsasl.dll to C:WINNTSystem32

Uncomment the ldap line in php.ini (C:apachephpphp.ini)

BE-Login unencrypted¶

The extenson switches the settings for BE-Login to normal if the extension is used for BE authentication. Consider using HTTPS for the BE.