Shall we prohibit authenticating already in WordPress created users using LDAP? If you enable this, LDAP-Users with the same user-ID as existing WordPress-Users can no longer take over the WordPress-Users account. This also means that LDAP-Users with the same User-ID as existing WordPress-Users will not be able to authenticate anymore! Accounts that have been taken over already will not be affected by this setting.
This should only be checked if you know what you are doing!
Search LDAP for user's groups and map to Wordpress Roles.
The URI for connecting to the LDAP-Server. This usualy takes the form <scheme>://<user>:<password>@<server>/<path> according to RFC 1738.
In this case it schould be something like ldap://uid=adminuser,dc=example,c=com:secret@ldap.example.com/dc=basePath,dc=example,c=com.
If your LDAP accepts anonymous login, you can ommit the user and password-Part of the URI
A separator that separates multiple LDAP-URIs from one another. You can use that feature to try to authenticate against multiple LDAP-Servers as long as they all have the same attribute-settings. The first LDAP-Server the user can authenticate against will be used to handle the user.
Use StartTLS for encryption of ldap connections. This setting is not to be used in combination with ldaps connections (ldap:// only).
Please provide a valid filter that can be used for querying the LDAP for the correct user. For more information on this feature have a look at http://andreas.heigl.org/cat/dev/wp/authldap
This field should include the string %s that will be replaced with the username provided during log-in
%s
If you leave this field empty it defaults to (uid=%s)
Which Attribute from the LDAP contains the Full or the First name of the user trying to log in.
This defaults to name
If the above Name-Attribute only contains the First Name of the user you can here specify an Attribute that contains the second name.
This field is empty by default
Please give the Attribute, that is used to identify the user. This should be the same as you used in the above Filter-Option
This field defaults to uid
Which Attribute holds the eMail-Address of the user?
If more than one eMail-Address are stored in the LDAP, only the first given is used
This field defaults to mail
If your users have a personal page (URI) stored in the LDAP, it can be provided here.
Here you can select the default role for users. If you enable LDAP Groups below, they will take precedence over the Default Role.
Existing users will retain their roles unless overriden by LDAP Groups below.
If role determined by LDAP Group differs from existing Wordpress User's role, use LDAP Group.
This is the base dn to lookup groups.
If empty the base dn of the LDAP URI will be used
This is the attribute that defines the Group-ID that can be matched against the Groups defined further down
This field defaults to gidNumber
This attribute defines the separator used for the Group-IDs listed in the Groups defined further down. This is useful if the value of Group-Attribute listed above can contain a comma (for example, when using the memberof attribute)
This field defaults to , (comma)
Here you can add the filter for selecting groups for ther currentlly logged in user
The Filter should contain the string %s which will be replaced by the login-name of the currently logged in user
Alternatively the string %dn% will be replaced by the DN of the currently logged in user. This can be helpfull if group-memberships are defined with DNs rather than UIDs
%dn%
This field defaults to (&(objectClass=posixGroup)(memberUid=%s))
What LDAP-Groups shall be matched to the -Role?
Please provide a coma-separated list of values