LDAP settings/en - Revision history

FuzzyBot: Updating to match new version of source page

2026-06-30T08:41:07Z

Updating to match new version of source page

← Older revision		Revision as of 10:41, 30 June 2026
Line 1:		Line 1:
	<languages />		<languages />

	{{Alert\|title=Attention\|text=This feature allows LimeSurvey survey administrators to '''import participants''' via LDAP. If you need a LDAP Authentication, please refer to [[Authentication plugins#LDAP\|AuthLDAP plugin]].}}		{{Alert\|title=Attention\|text=This feature allows LimeSurvey survey administrators to '''import participants''' via LDAP. If you need a LDAP Authentication for administrators, please refer to [[Authentication plugins#LDAP\|AuthLDAP plugin]].}}

	__TOC__		__TOC__

FuzzyBot: Updating to match new version of source page

2026-06-29T14:30:06Z

Updating to match new version of source page

← Older revision		Revision as of 16:30, 29 June 2026
Line 1:		Line 1:
	<languages />		<languages />

	{{Alert\|title=Attention\|text=This feature allows LimeSurvey survey administrators to import ~~tokens~~ via LDAP. If you need a LDAP Authentication, please refer to [[Authentication plugins#LDAP\|AuthLDAP plugin]].}}		{{Alert\|title=Attention\|text=This feature allows LimeSurvey survey administrators to '''import participants''' via LDAP. If you need a LDAP Authentication, please refer to [[Authentication plugins#LDAP\|AuthLDAP plugin]].}}

	__TOC__		__TOC__

C schmitz: Text replacement - " enclose="div"" to ""

2022-02-16T13:00:08Z

Text replacement - " enclose="div"" to ""

← Older revision		Revision as of 15:00, 16 February 2022
Line 127:		Line 127:
	In some cases it is not as easy to query an active directory so here is a sample configuration for getting some infomations of an active directory:		In some cases it is not as easy to query an active directory so here is a sample configuration for getting some infomations of an active directory:

	<syntaxhighlight lang="php~~" enclose="div~~">		<syntaxhighlight lang="php">
	//Connection to the active directory Server:		//Connection to the active directory Server:
	$serverId=0;		$serverId=0;
Line 170:		Line 170:

	Another example User query:		Another example User query:
	<syntaxhighlight lang="php~~" enclose="div~~">		<syntaxhighlight lang="php">
	$ldap_queries[$query_id]['userfilter'] = '(&('''objectCategory=Person''')(objectClass='''user''')(!('''userAccountControl=514''')))'; // AD doesn't recognise enabled accounts in the normal way, so instead, we check users are not disabled		$ldap_queries[$query_id]['userfilter'] = '(&('''objectCategory=Person''')(objectClass='''user''')(!('''userAccountControl=514''')))'; // AD doesn't recognise enabled accounts in the normal way, so instead, we check users are not disabled
	</syntaxhighlight>		</syntaxhighlight>
Line 177:		Line 177:
	Example group query:		Example group query:

	<syntaxhighlight lang="php~~" enclose="div~~">		<syntaxhighlight lang="php">
	$ldap_queries[$query_id]['groupfilter'] = '(&(objectClass='''group''')(cn=Domain Admins))'; // AD doesn't use the standard attribute name for groups, so use this example instead.		$ldap_queries[$query_id]['groupfilter'] = '(&(objectClass='''group''')(cn=Domain Admins))'; // AD doesn't use the standard attribute name for groups, so use this example instead.
	</syntaxhighlight>		</syntaxhighlight>

	Find more information about the Active Directory LDAP structure on [https://technet.microsoft.com/en-us/library/bb727030.aspx Active Directory Architecture] and [https://msdn.microsoft.com/en-us/library/cc223122.aspx Active Directory Technical Specification].		Find more information about the Active Directory LDAP structure on [https://technet.microsoft.com/en-us/library/bb727030.aspx Active Directory Architecture] and [https://msdn.microsoft.com/en-us/library/cc223122.aspx Active Directory Technical Specification].

FuzzyBot: Updating to match new version of source page

2019-10-27T11:55:06Z

Updating to match new version of source page

← Older revision		Revision as of 13:55, 27 October 2019
Line 182:		Line 182:

	Find more information about the Active Directory LDAP structure on [https://technet.microsoft.com/en-us/library/bb727030.aspx Active Directory Architecture] and [https://msdn.microsoft.com/en-us/library/cc223122.aspx Active Directory Technical Specification].		Find more information about the Active Directory LDAP structure on [https://technet.microsoft.com/en-us/library/bb727030.aspx Active Directory Architecture] and [https://msdn.microsoft.com/en-us/library/cc223122.aspx Active Directory Technical Specification].

	~~=LDAP configuration examples=~~

	~~=== Example settings AD2008 & 2.05+ ===~~

	~~'''Settings working with Active Directory 2008 and 2.05+ (build 140520) with AuthLDAP plugin.'''~~

	~~==== Authentication with LDAP and ''userPrincipalName'' attribute ====~~

	~~'''Note''': Authentication with ''userPrincipalName'' attribute (ie: firstname.lastname@example.intra). Create a LimeSurvey user with the same name as a AD(active directory) user account :~~

	*''Username'': '''firstname.lastname@example.intra'''
	*Ldap server - e.g. ldap://ldap.mydomain.com: ldap://ldap.mydomain.com;
	*Port number (default when omtopicitted is 389);
	*LDAP version (LDAPv2 = 2), e.g. 3: 3;
	*Username prefix cn= or uid=: cn=;
	*Username suffix e.g. @mydomain.com or remaining part of ldap query: ,OU=people,DC=mydomain,DC=com;
	*Create a LimeSurvey administrator with the same name as a AD(active directory) user account;
	*Log in using the AD credentials (username and password).

	~~===Example settings AD2008 & 2.05+===~~

	~~'''Settings working with Active Directory 2008 and 2.05+ (build 140520) with AuthLDAP plugin '''.~~

	~~====Authentication with LDAP and ''userPrincipalName'' attribute====~~

	~~'''Note''': Authentication with ''userPrincipalName'' attribute (ie: firstname.lastname@example.intra). Create a LimeSurvey user with the same name as the AD(active directory) user account:~~

	*''Username'': '''firstname.lastname@exaom: ldap://ldap.mydomain.com
	*Port number (default when omtopicitted is 389):
	*LDAP version (LDAPv2 = 2), e.g. 3: 3
	*Username prefix cn= or uid=: cn=
	*Username suffix e.g. @mydomain.com or remaining part of ldap query: ,OU=people,DC=mydomain,DC=com
	*Create a LimeSurvey administrator with the same name as a AD(active directory) user account.
	*Log in using the AD credentials(username and password).

	~~=== Example settings AD2008 & 2.05+ ===~~

	~~'''Settings working with Active Directory 20tra:'''~~

	*''Full name'': '''Firstname LASTNAME'''

	~~Then configure the plugin:~~
	*''Plugin Manager > LDAP > Configure'';
	*''Ldap server e.g. ldap://ldap.example.intra'': '''ldap://ldap.example.intra''';
	*''Port number (default when omitted is 389)'': '''389''';
	*''LDAP version (LDAPv2 = 2), e.g. 3'': '''LDAPv3''';
	*''Username prefix cn= or uid=: cn='': '''empty''';
	*''Username suffix e.g. @example.intra or remaining part of ldap query'': '''empty''';

	~~Log in using the AD credentials (username: '''firstname.lastname@example.intra''' and password).~~

	~~==== Authentication with LDAP and ''sAMaccountName'' attribute ====~~

	~~'''Note''': Authentication with ''sAMaccountName'' attribute (ie: firstname.lastname). Create a LimeSurvey user with the same name as the AD(active directory) user account :~~
	*''Username'': '''firstname.lastname''';
	*''Email'': '''firstname.lastname@example.intra''';
	*''Full name'': '''Firstname LASTNAME'''.

	~~Then configure the plugin : ''Plugin Manager > LDAP > Configure''.~~
	*''Ldap server e.g. ldap://ldap.example.com'': '''ldap://ldap.example.intra''';
	*''Port number (default when omitted is 389)'': '''389''';
	*''LDAP version (LDAPv2 = 2), e.g. 3'': '''LDAPv3''';
	*''Username prefix cn= or uid=: cn='': '''empty''';
	*''Username suffix e.g. @example.com or remaining part of ldap query'': '''@example.intra'''.

	~~Log in using the AD credentials (username: '''firstname.lastname''' and password).~~

	~~==== Authentication with LDAPS and ''sAMaccountName'' attribute ====~~

	~~'''Note''': Authentication with ''sAMaccountName'' attribute (ie: firstname.lastname). Create a LimeSurvey user with the same name as an AD (active directory) user account:~~
	*''Username'': '''firstname.lastname''';
	*''Email'': '''firstname.lastname@example.intra''';
	*''Full name'': '''Firstname LASTNAME''';
	~~Then configure the plugin : ''Plugin Manager > LDAP > Configure''.~~
	*''Ldap server e.g. ldap://ldap.example.com'': '''ldaps://ldap.example.intra''';
	*''Port number (default when omitted is 389)'': '''636''';
	*''LDAP version (LDAPv2 = 2), e.g. 3'': '''LDAPv3''';
	*''Username prefix cn= or uid=: cn='': '''empty''';
	*''Username suffix e.g. @example.intra or remaining part of ldap query'': '''@example.intra'''.

	~~Log in using the AD credentials (username: '''firstname.lastname''' and password).~~

	~~=== Example settings OpenLDAP & 2.05+ ===~~

	~~'''Settings working with OpenLDAP and 2.05+ (git version Feb. 2015) with AuthLDAP plugin '''.~~

	~~==== Authentication with LDAP and ''uid'' attribute ====~~

	~~'''Note''': Authentication with ''uid'' attribute. Create a LimeSurvey user with the same name as a the LDAP user account.~~

	~~Then configure the plugin : ''Plugin Manager > LDAP > Configure''.~~

	* ''Ldap server e.g. ldap://ldap.mydomain.com'': '''ldap://ldap.mydomain.com''';
	* ''Port number (default when omitted is 389)'': '''(389 or leave blank)''';
	* ''LDAP version (LDAPv2 = 2), e.g. 3'': '''LDAPv3''';
	* ''Select true if referrals must be followed (use false for ActiveDirectory)'': '''(leave blank)''';
	* ''Check to enable Start-TLS encryption When using LDAPv3'': '''False''';
	* ''Select how to perform authentication'': '''Search and bind''';
	* ''Attribute to compare to the given login can be uid, cn, mail, ...'': '''uid''';
	* ''Base DN for the user search operation'': '''ou=people,dc=mydomain,dc=com''';
	* ''Optional extra LDAP filter to be ANDed to the basic (searchuserattribute=username) filter. Don't forget the outmost enclosing parentheses'': '''(leave blank)''';
	* ''Optional DN of the LDAP account used to search for the end-user's DN. An anonymous bind is performed if empty.'': '''cn=admin,dc=mydomain,dc=com''';
	* ''Password of the LDAP account used to search for the end-user's DN if previoulsy set.'': '''password''' (appears!);
	* ''Check to make default authentication method'': '''(as you wish)'''.

	~~Log in using the LDAP credentials (username: '''user''' and password).~~

	~~==== Authentication with OpenLDAP, ''uid'' attribute, and group restriction [2.62+] ====~~

	Some applications require a separate LDAP query (beyond the user search and bind to check password) to determine if the user has sufficient authorization. For example, let's assume that LDAP has a <code>Groups</code> OU that includes an entry identified by <code>cn=limeusers</code> and our policy is that for a user to be authorized to use LimeSurvey that entry must include an attribute of the form <code>memberUid=<i>username</i></code> where ''username'' is the username (uid) entered by the user attempting to login. To configure LDAP for that, set up basic ''uid'' authentication as above and then set the following additional (optional) parameters:

	* ''Optional base DN for group restriction'': <code>ou=Groups,dc=mydomain,dc=com</code>
	* ''Optional filter for group restriction'': <code>(&(cn=limeusers)(memberUid=$username))</code>

	~~Note:~~
	~~# <code>$username</code> is a magic value (in the context of the filter parameter) that is replaced by the username entered by the user when logging in.~~
	# Although intended for testing group membership as above, this optional "group restriction" capability can be used to add any authorization check that can be expressed as a separate filtered search like this.
	~~# Before specifying a group restriction this way, verify that basic LDAP authentication is working correctly.~~
	~~# If either of the group restriction parameters is empty, then the group restriction step will not be applied.~~

FuzzyBot: Updating to match new version of source page

2018-04-29T19:25:04Z

Updating to match new version of source page

← Older revision		Revision as of 21:25, 29 April 2018
Line 1:		Line 1:
	<languages />		<languages />

	{{Alert\|title=Attention\|text=This feature allows LimeSurvey survey administrators to import tokens via LDAP. If you need a LDAP Authentication, please refer to [[~~Plugin manager~~#~~Developing an authentication plugin~~\|AuthLDAP plugin]].}}		{{Alert\|title=Attention\|text=This feature allows LimeSurvey survey administrators to import tokens via LDAP. If you need a LDAP Authentication, please refer to [[Authentication plugins#LDAP\|AuthLDAP plugin]].}}

	__TOC__		__TOC__

FuzzyBot: Updating to match new version of source page

2018-02-08T19:10:03Z

Updating to match new version of source page

← Older revision		Revision as of 21:10, 8 February 2018
Line 29:		Line 29:
	** Don't forget that for 'ldaps' or 'start-tls' encryption, the webserver must be able to check the LDAP server's certificate. Thus, you need to define your Certificate Authority in your openldap library (usually this is done in the /etc/openldap/ldap.conf file under linux).		** Don't forget that for 'ldaps' or 'start-tls' encryption, the webserver must be able to check the LDAP server's certificate. Thus, you need to define your Certificate Authority in your openldap library (usually this is done in the /etc/openldap/ldap.conf file under linux).
	*'''$ldap_server<nowiki>[</nowiki>$serverId]<nowiki>[</nowiki>'referrals']:''' It is a boolean parameter that defines if referrals must be followed or not (use false for ActiveDirectory);		*'''$ldap_server<nowiki>[</nowiki>$serverId]<nowiki>[</nowiki>'referrals']:''' It is a boolean parameter that defines if referrals must be followed or not (use false for ActiveDirectory);
	*'''$ldap_server<nowiki>[</nowiki>$serverId]<nowiki>[</nowiki>'encoding']:''' It is an optional parameter which gives the encoding used by the LDAP directory to store strings. You usually do not need to setup this parameter as the default assumed encoding, 'utf-8', is the standard encoding for LDAP directories. However, if you're using Active Directory and having problems importing accentuated strings, then try to setup this parameter to the encoding used in you area (for instance 'cp850' for West Europe). You can refer to the "Character set of the file" drop-down list in the [[Survey_participants#Import_participants_from_a_CSV_file Import Token from CSV file]] GUI to have the full list of supported encodings.		*'''$ldap_server<nowiki>[</nowiki>$serverId]<nowiki>[</nowiki>'encoding']:''' It is an optional parameter which gives the encoding used by the LDAP directory to store strings. You usually do not need to setup this parameter as the default assumed encoding, 'utf-8', is the standard encoding for LDAP directories. However, if you're using Active Directory and having problems importing accentuated strings, then try to setup this parameter to the encoding used in you area (for instance 'cp850' for West Europe). You can refer to the "Character set of the file" drop-down list in the [[Survey_participants#Import_participants_from_a_CSV_file\|Import Token from CSV file]] GUI to have the full list of supported encodings.

	Next, you need to define what authentication is needed to gain access to the directory. If 'anonymous' access is allowed, do NOT set the two following parameters, otherwise set them accordingly:		Next, you need to define what authentication is needed to gain access to the directory. If 'anonymous' access is allowed, do NOT set the two following parameters, otherwise set them accordingly:

FuzzyBot: Updating to match new version of source page

2018-02-08T18:45:03Z

Updating to match new version of source page

← Older revision		Revision as of 20:45, 8 February 2018
Line 1:		Line 1:
	<languages />		<languages />

	{{Alert\|title=Attention\|text=This feature allows LimeSurvey survey administrators to import tokens ~~via~~ via LDAP. If you need a LDAP Authentication, please refer to [[Plugin manager#Developing an authentication plugin\|AuthLDAP plugin]].}}		{{Alert\|title=Attention\|text=This feature allows LimeSurvey survey administrators to import tokens via LDAP. If you need a LDAP Authentication, please refer to [[Plugin manager#Developing an authentication plugin\|AuthLDAP plugin]].}}

	__TOC__		__TOC__

FuzzyBot: Updating to match new version of source page

2018-02-03T18:35:05Z

Updating to match new version of source page

Show changes

FuzzyBot: Importing a new version from external source

2017-01-25T10:42:20Z

Importing a new version from external source

← Older revision		Revision as of 12:42, 25 January 2017
Line 9:		Line 9:
	To use this feature you have to enable LDAP support in config.php and configure LDAP parameters in config/ldap.php.		To use this feature you have to enable LDAP support in config.php and configure LDAP parameters in config/ldap.php.

	~~<div class="simplebox"><center>'''! Attention !'''</center><br />~~ To be able to use LDAP you have to make sure the LDAP module is installed in your PHP. Please refer to the [http://de.php.net/manual/en/ldap.installation.php PHP LDAP module documentation] how to install this extension.~~</div>~~		{{Alert\|To be able to use LDAP you have to make sure the LDAP module is installed in your PHP. Please refer to the [http://de.php.net/manual/en/ldap.installation.php PHP LDAP module documentation] how to install this extension.}}

FuzzyBot: Importing a new version from external source

2017-01-25T10:41:00Z

Importing a new version from external source

← Older revision		Revision as of 12:41, 25 January 2017
Line 7:		Line 7:
	==General==		==General==

	~~Currently LDAP is used for the "Import Tokens From LDAP query" feature but it may be extended in the future to add support for LDAP authentication.~~ To use this feature you have to enable LDAP support in config.php and configure LDAP parameters in config/ldap.php.		To use this feature you have to enable LDAP support in config.php and configure LDAP parameters in config/ldap.php.

	<div class="simplebox"><center>'''! Attention !'''</center><br /> To be able to use LDAP you have to make sure the LDAP module is installed in your PHP. Please refer to the [http://de.php.net/manual/en/ldap.installation.php PHP LDAP module documentation] how to install this extension.</div>		<div class="simplebox"><center>'''! Attention !'''</center><br /> To be able to use LDAP you have to make sure the LDAP module is installed in your PHP. Please refer to the [http://de.php.net/manual/en/ldap.installation.php PHP LDAP module documentation] how to install this extension.</div>