LDAP data mapping fails against Active Directory

Re: LDAP data mapping fails against Active Directory

by Iñaki Arenaza -
Number of replies: 0
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

For instance, group membership for domain local and global groups is not replicated to global catalogs by default (only universal groups membership). You can change this by modifying the directory schema, but IIRC Microsoft doesn't do it by default because this can potentially be a large amount of information if you have lots of users and groups.

If you don't want to use the course creators feature of LDAP authentication or don't want to use LDAP enrolments, this should be fine.

By the way, this might have changed in W2008, as I looked at this in W2003 the last time (though my fast reading of tends to confirm my rememberings; specially the phrase "The global catalog stores the membership (the member attribute) of only universal groups. The membership of other groups can be ascertained at the domain level.")

I don't remember how we deal with referrala in Moodle (the usual term is 'referral chasing' in LDAP jargon), but if we don't follow them, then using a global catalog is not going to work when we need group membership (Edit: I've just checked the code, and when we use AD, we disable referral chasing; if we don't, some people have trouble with LDAP and AD; see MDL-10921).

Saludos. Iñaki.

Average of ratings: Useful (1)