Configuring Ampache for LDAP authentication

Setting up LDAP is fairly straight-forward, assuming your LDAP server is already configured properly (a topic outside the scope of this document–a good tutorial on authentication with LDAP can be found at http://times.usefulinc.com/2005/09/25-ldap).

To configure LDAP, add the following to your /config/ampache.cfg.php and fill in all of the ldap_* configuration values.

auth_methods = "ldap"

The above example does not include MySQL authentication support. Ampache can have multiple authentication methods at the same time. It will try them in the order they are listed until a match is found. If you would like it to try ldap first, and then fall back on mysql simply set auth_methods as follows.

auth_methods = "ldap,mysql" 

• “undefined function ldap_connect()” when logging on: make sure PHP's LDAP libraries are installed and accessible ('sudo apt-get install php5-ldap' in Ubuntu Feisty). Once the libraries are installed, you may need to restart Apache if it is already running. ('sudo /etc/init.d/apache2 restart' in Feisty)

• Specifying an ldap_objectclass value other than “*” may cause authentication to fail–check this value if you are getting authentication failure messages from the login page.

• To allow multiple authentication sources, use multiple 'auth_methods' statements–the variable name is somewhat misleading, it is NOT an array or comma-separated list of values. To authenticate with both ldap and mysql, use both 'auth_methods = “ldap”' and 'auth_mthods = “mysql”' in your config file. This is recommended, as it will allow authentication against a MySQL database in the event the LDAP server cannot be reached, or vice versa.

• The auto_user variable DOES apply to the autocreation of LDAP users in Ampache's database, but the possible values are incorrectly specified (in Ampache version 3.3.3.4, at least). Valid values for auto_user are “0” for guest, “25” for user, and “100” for admin.

• When setting the value of ldap_filter, the config file states “For OpenLDAP use “uid””. In the large majority of cases this is correct, but it is worth verifying that the uid field does indeed exist in your LDAP configuration if you are having trouble authenticating.

• If your LDAP server uses SSL/TLS, you may have problems connecting.