If an LDAP server is available in the church, users can be authenticated against it. This eliminates the need for separate passwords in ChurchTools, allowing the user to use their password for the entire system environment.
Alternativ dazu kann ChurchTools auch selber einen LDAP-Service zur Verfügung stellen, gegen den dann andere Systeme authentifiziert werden können.
Process #
ChurchTools first connects via user:password@server to gain access to the content of the LDAP server. Then the user is searched for using their email or username, and finally, an attempt is made to authenticate the user.
If successful, it checks whether the user is already registered in ChurchTools. If not, the user is newly created.
Setup #
ChurchTools supports access to the LDAP server via LDAP, LDAP with START-TLS, or LDAPS. If you want to use your own LDAP server, our support can set it up for you in your ChurchTools. The following data is required for this:
; The URI of the LDAP server as well as the username and password for accessing the LDAP server.
ldap_config[server]="ldap://ldapserver.de:389"
; alternative with START-TLS:
ldap_config[server]="ldap://ldapserver.de:389"
ldap_config[tls]=1
; alternative with LDAPS:
ldap_config[server]="ldaps://ldapserver.de:636"
ldap_config[user]="uid=XXX,cn=users,dc=churchtools,dc=de"
ldap_config[password]=XXX
; Base DN of all users in which the filter below should be applied.
ldap_config[basedn]="cn=users,dc=churchtools,dc=de"
; Filter to search for the correct user based on email or username.
ldap_config[filter_mail]="(mail=%u)"
ldap_config[filter_username]="(uid=%u)"
; LDAP fields for the individual attributes in people. The values after “=” are the field names returned by the LDAP server.
ldap_config[mail]=mail
ldap_config[givenname]=givenname
ldap_config[name]=sn
ldap_config[username]=uid
; If a user is not already listed in people, they will be created. In this step, you define their department, status, and location.
ldap_config[create_dep]=1
ldap_config[create_status]=1
ldap_config[create_station]=0; (station = location)
