LDAP connector

LDAP connector is a plug-in designed to support login via LDAP or Active Directory, including LDAPS and StartTLS.

How to use

Build

./answer build --with github.com/apache/answer-plugins/connector-ldap

Configuration

  • Name - Display name for the connector shown on the login page
  • Server - LDAP server URL, e.g. ldaps://ldap.example.com:636 or ldap://ldap.example.com:389
  • Base DN - Base DN to search for users, e.g. dc=example,dc=com
  • Bind DN - DN of the service account used to bind and search the directory
  • Bind Password - Password for the bind DN
  • User Attribute - LDAP attribute holding the username, e.g. uid for OpenLDAP or sAMAccountName for Active Directory
  • TLS CA Certificate Path - Optional path to a custom CA certificate, used to verify the LDAP server's certificate (e.g. for a private/internal CA)

If the server URL starts with ldaps://, the connection is established over TLS directly. Otherwise, a plain connection is opened and upgraded via StartTLS.

Users must have a mail attribute set in LDAP, since it is required to create/match the Answer account on login.