Enable LDAP

[gassganso]

Hi,
I'm trying to activate LDAP to manage acces to PhoneBook.
I already have OpenLDAP server running and it works perfectly with other scripts I'm working with (ie Joomla)
I've modificate files:

/var/www/html/api/reqs/auth.lib.php

[...]
//This variable determines which authentication library is used.
$auth_lib_plugin = \'auth.ldap.lib.php\';
[...]

/var/www/html/api/reqs/auth.ldap.lib.php

[...]
$auth_ldap_domain_controller_hostname = \'xxxx.net\';
$auth_ldap_base_dn                    = \'ou=PhoneBook,dc=xxxx,dc=net\';
$auth_ldap_bind_user_dn               = \'cn=admin,dc=xxxx,dc=net\';
$auth_ldap_bind_user_pass             = \'*********\';

$auth_ldap_api_admin_groups = array(
    \'cn=Admins,ou=Groups,ou=PhoneBook,dc=xxxx,dc=net\'
[...]

After deleting files auth.cfg.php & auth.ldap.cfg.php at path /var/www/html/data/conf/ these files are autocreated again with correct configuration data.

PHP seems to have the modules for LDAP enabled as well:

Additional .ini files parsed	/usr/local/etc/php/conf.d/docker-php-ext-ldap.ini, /usr/local/etc/php/conf.d/docker-php-ext-opcache.ini, /usr/local/etc/php/conf.d/docker-php-ext-sodium.ini

Loaded Modules	core mod_so mod_watchdog http_core mod_log_config mod_logio mod_version mod_unixd mod_access_compat mod_alias mod_auth_basic mod_authn_core mod_authn_file mod_authnz_ldap mod_authz_core mod_authz_host mod_authz_user mod_autoindex mod_deflate mod_dir mod_env mod_filter util_ldap mod_mime prefork mod_negotiation mod_php7 mod_reqtimeout mod_setenvif mod_socache_shmcb mod_ssl mod_status

ldap

LDAP Support	enabled
Total Links	0/unlimited
API Version	3001
Vendor Name	OpenLDAP
Vendor Version	20457

Directive	Local Value	Master Value
ldap.max_links	Unlimited	Unlimited

Question:
What behavior should I expect if my configuration is incorrect?

With this configuration Phonebook works openly without any password. Only db Admin seems to be restricted.
Thank you very much in advance for the given help and for such a good job.
Gustavo.

[krisdb2009]

Only admin access can be restricted via Phone Book config files.
I also would like to mention that you are supposed to modify the auto-generated files, not the *.lib.php files.

If you want to restrict access to the entire Phone Book, I recommend doing this at the webserver level:

https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html

[gassganso]

I will follow that way.
Thank you very much for your response and indications.

[krisdb2009]

Sure, if you have any questions, just let me know!