Skip to content

Latest commit

 

History

History
69 lines (43 loc) · 3.56 KB

README.md

File metadata and controls

69 lines (43 loc) · 3.56 KB
Raw

SilverStripe LDAP module

Build Status Scrutinizer Code Quality codecov SilverStripe supported module

Introduction

This SilverStripe module provides integration with LDAP (Lightweight Directory Access Protocol) servers. It comes with two major components:

  • Synchronisation of Active Directory users and group memberships via LDAP(S)
  • Active Directory authentication via LDAP binding

These components may be used in any combination, also alongside the default SilverStripe authentication scheme.

Installation

Install using Composer:

composer require silverstripe/ldap ^1.0

Requirements

  • PHP 5.6+ with extensions: ldap, openssl, dom, and mcrypt
  • SilverStripe 4.0+
  • An Active Directory server:
    • Active Directory on Windows Server 2008 R2 or greater (AD)
    • OpenLDAP
    • Samba
  • HTTPS endpoint on SilverStripe site
  • SSL/StartTLS encrypted LDAP endpoint on Active Directory

This module has been tested using Samba 4. It has also been tested in previous major releases against:

  • Windows Server 2008 R2 with ADFS 2.0
  • Windows Server 2012 R2 with ADFS 3.0

This module has not been tested on OpenLDAP.

Note: For SilverStripe 3, please see the silverstripe-activedirectory module.

Overview

This module will provide an LDAP authenticator for SilverStripe, which will authenticate via LDAPS against members in your AD server. The module comes with tasks to synchronise data between SilverStripe and AD, which can be run on a cron.

To synchronise further personal details, LDAP synchronisation feature can be used, also included in this module. This allows arbitrary fields to be synchronised - including binary fields such as photos. If relevant mappings have been configured in the CMS the module will also automatically maintain SilverStripe group memberships, which opens the way for an AD-centric authorisation.

Note: If you are looking for SSO with SAML, please see the silverstripe-saml module.

Security

With appropriate configuration, this module provides a secure means of authentication and authorisation.

AD user synchronisation and authentication is hidden behind the backend (server to server communication), but must still use encrypted LDAP communication to prevent eavesdropping (either StartTLS or SSL - this is configurable). If the webserver and the AD server are hosted in different locations, a VPN could also be used to further encapsulate the traffic going over the public internet.

Note that the LDAP protocol does not communicate over HTTP. If this is what you're looking for, you may be interested in SAML instead.

In-depth guides

Changelog

Please see the GitHub releases for changes.