#### {t}LDAP Authentication{/t}

{t escape="no"}Eventum can be used with an LDAP directory service for centralized authentication. To enable this feature, set the following option in config.php:{/t}

      {literal}define('APP_AUTH_BACKEND', 'LDAP_Auth_Backend');{/literal}

{t}The following parameters need to be configured to enable LDAP integration:{/t}

{t}Host{/t}
  {t}The host name or IP address of the LDAP server{/t}
{t}Port{/t}
  {t}The TCP port of the LDAP directory service. The default LDAP port is 389.{/t}
{t}Bind DN{/t}
  {t}The DN of the LDAP principal used for directory lookups{/t}
{t}Bind PW{/t}
  {t}The password for the principal specified as Bind DN{/t}
{t}Base DN{/t}
  {t}The path of the LDAP container to be used when looking up user accounts{/t}
{t}User ID attribute{/t}
  {t}The name of an LDAP attribute containing the DN (or its user-specific part) of an LDAP account. This is used as bind DN when checking the entered password. If unsure leave blank to use the default value "uid".{/t}
{t}User DN{/t}
  {t escape="no"}The DN used for verifying the entered user password. The placeholder `%UID` will be replaced with the value of the User ID attribute. Multiple DNs to be tried may be separated with | characters.{/t}
{t}User Filter (optional){/t}
  {t escape="no"}LDAP filter to be used when searching for an account matching the Eventum login name. The placeholder `{literal}{username}{/literal}` will be replaced with the entered login name. If unsure leave blank.{/t}
{t}Customer ID attribute (optional){/t}
  {t}The name of an LDAP attribute containing the customer ID for a user{/t}
{t}Contact ID attribute (optional){/t}
  {t}The name of an LDAP attribute containing the contatct ID for a user{/t}
{t}DN for active users (optional){/t}
  {t escape="no"}The path of an LDAP container containing active accounts. This is used by the `ldapsync` utility to update or create Eventum users. Leave blank to skip that step.{/t}
{t}DN for inactive users (optional){/t}
  {t escape="no"}The path of an LDAP container containing inactive accounts. This is used by the `ldapsync` utility to disable accounts. Leave blank to skip that step. {/t}
{t}Create Users{/t}
  {t}Automatically create Eventum users for successfully authenticated LDAP accounts{/t}
{t}Default Roles{/t}
  {t}The default set of roles for automatically created Eventum users{/t}

#### {t}Integration with Microsoft Active Directory{/t}

{t}Active Directory uses a few non-standard attribute names, so it requires some special configuration:{/t}

{t}Port{/t} | {t}389 (local domain) or 3268 (global catalog){/t}
{t}User ID attribute{/t} | `userPrincipalName`
{t}User DN{/t} | `%UID`
{t}User Filter{/t} | `{literal}(|(mail={username})(userPrincipalName={username})){/literal}`