Installing AOLserver LDAP support (openldap and nsldap). Install openldap and nsldap using the document Malte created Next, modify your config.tcl file as directed in the nsldap README. Here's what the relevant additions should look like:

# LDAP authentication
ns_param   nsldap             ${bindir}/nsldap.so

...

ns_section "ns/ldap/pool/ldap"
ns_param user "cn=Administrator, cn=Users, dc=mydomain, dc=com"
ns_param password "password"
ns_param host "directory.mydomain.com"
ns_param connections 1
ns_param verbose On

ns_section "ns/ldap/pools"
ns_param ldap ldap

ns_section "ns/server/${server}/ldap"
ns_param pools *
ns_param defaultpool ldap
   

To verify that this is all working, restart Aolserver and ensure that you see something like this in your error.log:

[10/Jan/2006:11:11:07][22553.3076437088][-main-] Notice: modload: loading '/usr/local/aolserver/bin/nsldap.so'
[10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: allowing * -> pool ldap
[10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: adding pool ldap to the list of allowed pools
[10/Jan/2006:11:11:08][22553.3076437088][-main-] Debug: nsldap: Registering LDAPCheckPools (600)
    

auth-ldap + driver installation. Next, visit the software installation page in acs-admin and install the auth-ldap package. Your OpenACS installation now has all the code required to authenticate using nsldap, so now you need to configure your site's authentication to take advantage of it. To add the authentication driver to your OpenACS instance, go to: Main Site, Site-Wide Administration, and then AuthenticationHere's some sample Authentication Driver values:Name=Active Directory, Short Name=AD, Enabled=Yes, Authentication=LDAP, Password Management=LDAPYou may wish to push this new authority to the top of the list so it will become the default for users on the login screen.Next, you have to configure the authentication driver parameters by going to: Main Site, Site-Wide Administration, Authentication, Active Directory, and then ConfigureParameters that match our example will look like:UsernameAttribute=sAMAccountNMame, BaseDN= cn=Users,dc=mydomain,dc=com, InfoAttributeMap=first_names=givenName;last_name=sn;email=mail, PasswordHash=N/A

Code Tweaks for Bind. Bind-style authentication is not supported via configuration parameters, so we will have to modify the tcl authentication routine to provide this behavior.You'll have to modify the existing ./packages/auth-ldap/tcl/auth-ldap-procs.tcl file to support bind authentication.First toggle ldap bind support.Change this:

# LDAP bind based authentication ?
set ldap_bind_p 0
if {$ldap_bind_p==1} {
...
    

to this:

# LDAP bind based authentication ?
set ldap_bind_p 1

if {$ldap_bind_p==1} {
...
    

Then change the bind to first do a search to resolve to account name provided by the user to a fully qualified domain name (FQDN), which the LDAP server uses as a primary key.Change this:

set lh [ns_ldap gethandle]

if {[ns_ldap bind $lh "cn=$cn" "$password"]} {
    set result(auth_status) ok
}    
    

to this

set lh [ns_ldap gethandle]

set fdn [lindex [lindex [ns_ldap search $lh -scope subtree $params(BaseDN) "($params(UsernameAttribute)=$username)" dn] 0] 1]

if {[ns_ldap bind $lh $fdn $password]} {
    set result(auth_status) ok
}