Shall we prohibit authenticating already in WordPress created users using LDAP? If you enable this, LDAP-Users with the same user-ID as existing WordPress-Users can no longer take over the WordPress-Users account. This also means that LDAP-Users with the same User-ID as existing WordPress-Users will not be able to authenticate anymore! Accounts that have been taken over already will not be affected by this setting.

This should only be checked if you know what you are doing!

Search LDAP for user's groups and map to Wordpress Roles.

The URI for connecting to the LDAP-Server. This usualy takes the form <scheme>://<user>:<password>@<server>/<path> according to RFC 1738.

In this case it schould be something like ldap://uid=adminuser,dc=example,c=com:secret@ldap.example.com/dc=basePath,dc=example,c=com.

If your LDAP accepts anonymous login, you can ommit the user and password-Part of the URI

You can use the pseudo-schema env to provide your LDAP-URI from an environment-variable. So if you have your LDAP-URI in a variable called LDAP_URI you can enter env:LDAP_URI in this field and at runtime the appropriate value will be taken from the Environment-variable LDAP_URI. If the varialbe is not set, then the value will be empty.

You can also provide different parts of the LDP-URI from environment variables by providing %env:[VARIABLENAME]% within your LDAP-URI. So if you want to provide the password from an Environment-variable LDAP_PASSWORD your LDAP-URI looks like ldap://uid=adminuser,dc=example,c=com:%env:LDAP_PASSWORD%@ldap.example.com/dc=basePath,dc=example,c=com

Caveat!
If you are using Environment-variables for parts of the LDAP-URL then those must not be URL-Encoded!
Otherwise the different parts must be URL-Encoded!

A separator that separates multiple LDAP-URIs from one another. You can use that feature to try to authenticate against multiple LDAP-Servers as long as they all have the same attribute-settings. The first LDAP-Server the user can authenticate against will be used to handle the user.

Use StartTLS for encryption of ldap connections. This setting is not to be used in combination with ldaps connections (ldap:// only).

Please provide a valid filter that can be used for querying the LDAP for the correct user. For more information on this feature have a look at http://andreas.heigl.org/cat/dev/wp/authldap

This field should include the string %s that will be replaced with the username provided during log-in

If you leave this field empty it defaults to (uid=%s)

Which Attribute from the LDAP contains the Full or the First name of the user trying to log in.

This defaults to name

If the above Name-Attribute only contains the First Name of the user you can here specify an Attribute that contains the second name.

This field is empty by default

Please give the Attribute, that is used to identify the user. This should be the same as you used in the above Filter-Option

This field defaults to uid

Which Attribute holds the eMail-Address of the user?

If more than one eMail-Address are stored in the LDAP, only the first given is used

This field defaults to mail

If your users have a personal page (URI) stored in the LDAP, it can be provided here.

This field is empty by default

Here you can select the default role for users. If you enable LDAP Groups below, they will take precedence over the Default Role.

Existing users will retain their roles unless overriden by LDAP Groups below.