Server¶

The Server tab contains the basic information on the LDAP server. They make sure that ownCloud will be able to connect to LDAP and be able to read data from there. The admin at least needs to provide a hostname. If anonymous access is not possible he will need to provide an account DN and a password, too. ownCloud attempts to auto-detect the port and the base DN.

Server configuration:

ownCloud can be configured to connect to multiple LDAP servers. Using this control you can pick a configuration you want to edit or add a new one. The button Delete Configuration deletes the current configuration.

Host:

The host name of the LDAP server. It can also be a ldaps:// URI, for instance.

It is also possible to pass a port number, which speeds up port detection. It is especially useful, if a custom port is used. ownCloud will move the value to the port field subsequently.

Examples:

• directory.my-company.com
• ldaps://directory.my-company.com
• directory.my-company.com:9876

Port:

The port on which to connect to the LDAP server. The field is disabled in the beginning of a new configuration. The port will be detected automatically, if the LDAP server is running on a standard port. After ownCloud attempted to determine the port, the field will be enabled for user input. A successfully found port will be inserted by ownCloud, of course.

Example:

• 389

User DN:

The name as DN of a user who is able to do searches in the LDAP directory. Leave it empty for anonymous access. It is recommended to have a special system user for ownCloud.

Example:

• uid=owncloudsystemuser,cn=sysusers,dc=my-company,dc=com

Password:

The password for the user given above. Empty for anonymous access.

Base DN:

The base DN of LDAP, from where all users and groups can be reached. Separated Base DNs for users and groups can be set in the Advanced tab. Nevertheless, this field is mandatory. ownCloud attempts to determine the Base DN according to the provided User DN or the provided Host.

Example:

• dc=my-company,dc=com

User Filter¶

The settings in the User Filter tab determine which LDAP users will appear and are allowed to log in into ownCloud. It is also possible to enter a raw LDAP filter.

only those object classes:

ownCloud will determine the object classes that are typically available for (ideally only) user objects in your LDAP. ownCloud will automatically select the object class that returns the highest amount of users. You can select multiple object classes.

only from those groups:

If your LDAP server supports the member-of-overlay in LDAP filters, you can define that only users from one or more certain groups are allowed to appear and log in into ownCloud. By default, no value will be selected. You can select multiple groups.

If your LDAP server does not support the member-of-overlay in LDAP filters, the input field is disabled. Please contact your LDAP administrator.

Edit raw filter instead:

Clicking on this text will toggle the filter mode. Instead of the assisted approach, you can enter the raw LDAP filter directly in the appearing field.

Example:

• objectClass=inetOrgPerson

x users found:

This is an indicator that tells you approximately how many users will be allowed to access ownCloud. The number will update after any change you do.

Login Filter¶

The settings in the Login Filter tab determine which user detail will be compared to the login value entered by the user. It is possible to allow multiple user details. It is also possible to enter a raw LDAP filter.

The user limitation as set up in the previous tab is in effect, unless you manually configure the filter in raw mode.

LDAP Username:

If this value is checked, the login value will be compared to the username in the LDAP directory. The corresponding attribute, usually uid or samaccountname will be detected automatically by ownCloud.

LDAP Email Address:

If this value is checked, the login value will be compared to an email address in the LDAP directory. The email address will be looked for in the mailPrimaryAddress and mail attributes.

Other Attributes:

This multiselect box allows you to select other attributes for the comparison. The list is generated automatically based on the attributes that a user object contains in your LDAP server.

Edit raw filter instead:

Clicking on this text will toggle the filter mode. Instead of the assisted approach, you can enter the raw LDAP filter directly in the appearing field.

The %uid placeholder will be replaced with the login name entered by the user upon login. When you enter the filter manually.

Examples:

• only username: uid=%uid
• username or email address: (|(uid=%uid)(mail=$uid))

Group Filter¶

The settings in the Group Filter tab determine which groups will be available in ownCloud. It does not have any restrictions on logins, this has been dealt with in the prior tabs. It is also possible to enter a raw LDAP filter.

By default, no groups will be available in ownCloud. You actively need to enable groups.

only those object classes:

ownCloud will determine the object classes that are typically available for (ideally only) group objects in your LDAP. ownCloud will only list object classes that return at least one group object. You can select multiple object classes. A typical object class is “group”, or “posixGroup”.

only from those groups:

This setting lets you pick certain groups that shall be available in ownCloud. This field follows a whitelist approach. ownCloud will generate a list of available groups found in your LDAP server. You can select multiple groups.

Edit raw filter instead:

Clicking on this text will toggle the filter mode. Instead of the assisted approach, you can enter the raw LDAP filter directly in the appearing field.

Example:

• objectClass=group
• objectClass=posixGroup

y groups found:

This is an indicator that tells you approximately how many groups will be available in ownCloud. The number will update after any change you do.

Connection Settings¶

LDAP Advanced Settings, section Connection Settings

Configuration Active:

Enables or Disables the current configuration. Disabled configuration will not connect to the LDAP server.

By default, it is turned off. It will be automatically turned on, when using the wizard and the configuration is OK and a test connection successful.

Backup (Replica) Host:

A backup server can be defined here. ownCloud tries to connect to the backup server automatically, when the main host (as specified in basic settings) cannot be reached. It is important that the backup server is a replica of the main server, because the object UUIDs must match.

Example:

• directory2.my-company.com

Backup (Replica) Port:

The port on which to connect to the backup LDAP server. If no port is given, but a host, then the main port (as specified above) will be used.

Example:

• 389

Disable Main Server:

You can manually override the main server and make ownCloud only connect to the backup server. This may be handy for planned downtimes.

Case insensitive LDAP server (Windows):

Whether the LDAP server is running on a Windows host. Usually, it is not necessary to check it, however.

Turn off SSL certificate validation:

Turns off check of valid SSL certificates. Use it – if needed – for testing, only!

Cache Time-To-Live:

A cache is introduced to avoid unnecessary LDAP traffic, for example lookups check whether the users exist on every page request or WebDAV interaction. It is also supposed to speed up the Admin → User page or list of users to share with, once it is populated. Saving the configuration empties the cache (changes are not necessary). The time is given in seconds.

Note that almost every PHP request would require to build up a new connection to the LDAP server. If you require most up-to-dateness it is recommended not to totally switch off the cache, but define a minimum life time of 15s.

Examples:

• ten minutes: 600
• one hour: 3600

Directory Settings¶

LDAP Advanced Settings, section Directory Settings

User Display Name Field:

The attribute that should be used as display name in ownCloud.

• Example: displayName

Base User Tree:

The base DN of LDAP, from where all users can be reached. It needs to be given completely despite to the Base DN from the Basic settings. You can specify multiple base trees, one in each line.

• Example:

  cn=programmers,dc=my-company,dc=com

  cn=designers,dc=my-company,dc=com

User Search Attributes:

These attributes are used when a search for users is done. This happens, for instance, in the share dialogue. By default the user display name attribute as specified above is being used. Multiple attributes can be given, one in each line.

Beware that if an attribute is not available on a user object, the user will neither be listed (e.g. in the share dialogue) nor be able to login. This also affects the display name attribute as specified above. If you override the default, the display name attribute will not be taken into account, unless you specify it as well.

• Example:

  displayName

  mail

Group Display Name Field:

The attribute that should be used as ownCloud group name. ownCloud allows a limited set of characters (a-zA-Z0-9.-_@), every other character will be replaced in ownCloud. Once a group name is assigned, it will not be changed, i.e. changing this value will only have effect to new LDAP groups.

• Example: cn

Base Group Tree:

The base DN of LDAP, from where all groups can be reached. It needs to be given completely despite to the Base DN from the Basic settings. You can specify multiple base trees, one in each line.

• Example:

  cn=barcelona,dc=my-company,dc=com

  cn=madrid,dc=my-company,dc=com

Group Search Attributes:

These attributes are used when a search for groups is done. This happens, for instance, in the share dialogue. By default the group display name attribute as specified above is being used. Multiple attributes can be given, one in each line.

If you override the default, the group display name attribute will not be taken into account, unless you specify it as well.

• Example:

  cn

  description

Group Member association:

The attribute that is used to indicate group memberships, i.e. the attribute used by LDAP groups to refer to their users.

ownCloud detects the value automatically. You should only change it if you have a very valid reason and know what you are doing.

• Example: uniquemember

Special Attributes¶

LDAP Advanced Settings, section Special Attributes

Quota Field:

ownCloud can read an LDAP attribute and set the user quota according to its value. Specify the attribute here, otherwise keep it empty. The attribute shall return human readable values, e.g. “2 GB”.

• Example: ownCloudQuota

Quota Default:

Override ownCloud default quota for LDAP users who do not have a quota set in the attribute given above.

• Example: 15 GB

Email Field:

ownCloud can read an LDAP attribute and set the user email there from. Specify the attribute here, otherwise keep it empty.

Although the wizard offers you to check login by email, the correct email attribute is not detected and you need to specify it manually.

• Example: mail

User Home Folder Naming Rule:

By default, the ownCloud creates the user directory, where all files and meta data are kept, according to the ownCloud user name. You may want to override this setting and name it after an attribute value. The attribute given can also return an absolute path, e.g. /mnt/storage43/alice. Leave it empty for default behavior.

• Example: cn