LDAP Role Mapping

Overview

This document explains how to assign Drupal roles to users based on their LDAP or Active Directory groups. For example, an LDAP group like testGroup can be mapped to a Drupal role such as Developer, automatically assigning the role when users log in with LDAP credentials. The Drupal LDAP/Active Directory Integration module supports Drupal 7, 8, 9, and 10. Role mapping can be applied during LDAP SSO login, user import from LDAP, and Windows SSO or LDAP Gateway login using NTLM/Kerberos.

Download

Pricing Plans

Schedule a Meeting

Installation Steps

Using Composer
Using Drush
Manual Installation

Download the module:
composer require 'drupal/ldap_auth'
Navigate to Extend menu on your Drupal admin console and search for miniOrange Active Directory / LDAP Integration using the search box.
Enable the module by checking the checkbox and click on the Install button.
You can configure the module at:

{BaseURL}/admin/config/people/ldap_auth/ldap_config

Install the module:

drush en ldap_auth
Clear the cache:

drush cr
You can configure the module at:

{BaseURL}/admin/config/people/ldap_auth/ldap_config

Navigate to Extend menu on your Drupal admin console and click on Install new module.
Install the miniOrange Active Directory / LDAP Integration module either by downloading the zip or from the URL of the package (tar/zip).
Click on Enable newly added modules.
Enable this module by checking the checkbox and click on install button.
You can configure the module at:

{BaseURL}/admin/config/people/ldap_auth/ldap_config

Prerequisites

Install the Drupal LDAP / Active Directory Login module.
Setup the above module with your LDAP or Active Directory server. You can also refer to this setup guide for assistance.

You can also follow this setup video to configure the Role Mapping feature.

Configuration Steps

After successfully configuring the module, head to the Mappings tab.
(admin/config/people/ldap_auth/attribute_mapping)
In the Mappings tab, click on the Mapping button.

Expand the LDAP Group to Drupal Role Mapping section.

Drupal LDAP - Expand Role Mapping Section

In the expanded section, you will see the following options:

Enable Role Mapping: Enables mapping of LDAP groups to Drupal roles. This option must be enabled to use role mapping.
Remove all existing roles and add new roles (Optional): Replaces existing Drupal roles with mapped roles from LDAP. If disabled, new roles are added without removing existing ones.
Enable Role Mapping for NTLM Users (Optional): Applies role mapping for users logging in via Windows SSO using NTLM or Kerberos authentication.

Select default role for the users: You can select a default role from this dropdown that will be assigned to your users whenever they login to your Drupal site using their LDAP Server credentials.
In this case as you can see, we have selected Custom Role 1, thus, whenever the user logs in using their LDAP credentials, the Custom Role 1 role will be assigned to them.

Drupal LDAP - Select Default Role for Users

From the LDAP Group Attribute Name dropdown, select the LDAP attribute name under which you will get the user's LDAP groups. Generally, we get the users' LDAP groups under the memberof attribute.
If you want, you can check the LDAP Attribute name for your users' LDAP groups from the attribute list present in the top right section of the tab.

Drupal LDAP - Select LDAP Attribute Name

If you want to assign the Content Editor role in Drupal to users from a particular group in LDAP, then enter the Distinguished Name(DN) of that LDAP group under the Content Editor text field. You can confirm the Group DN Value from the right section of the tab.
In our case, we wished to assign the Content Editor role to the users present in the Editor Group in our LDAP server. So, the configuration would be as shown in the image below:

You can add multiple Group DN by separating them with a semicolon (;). For example, as per the configurations shown in the below image, the users present under the Editor or Testing LDAP group will get the Content Editor role in Drupal upon LDAP Authentication.

Drupal LDAP - Enter Multiple LDAP Group DNs

Similarly, if you also want to assign your Drupal users an Administrator, Custom Role 1 or Custom Role 2 based on if they have the Admin, Tester or Developer LDAP Group, respectively, you can do so by repeating the above-mentioned steps.

Once you are done with the proper configurations, click on the Save Role Mapping button.

Let’s see how LDAP Groups to Drupal Role Mapping works

Let us assume that we want to assign the Custom Role 2 to the users present under the testGroup LDAP Group in your LDAP server. In order to achieve this, our role mapping configurations will look something like this:

Now, login to our Drupal site with a user that has the testGroup LDAP group in our LDAP /Active Directory server. Click on the Log in button.

AAfter the user successfully logs in to our Drupal site using their LDAP credentials, the user will automatically get assigned to the Custom Role 2 in Drupal
We can confirm the above by checking the user’s roles from under the People section of our Drupal site.

That's it. You have successfully configured the LDAP role mapping.

Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again

Contents

LDAP Role Mapping