Hi Michael,
Jap 
So habe ich es verstanden und sie schreiben auch, dass Datenbankänderungen rückwärtskompatibel sein sollen, siehe: MRBS: Documentation : UPGRADE
Ja, hab ich:
/**********************
* LDAP configuration *
*********************/
$auth["type"] = "ldap";
// Many of the LDAP parameters can be specified as arrays, in order to
// specify multiple LDAP directories to search within. Each item below
// will specify whether the item can be specified as an array. If any
// parameter is specified as an array, then EVERY array configuration
// parameter must have the same number of elements. You can specify a
// parameter as an array as in the following example:
//
// $ldap_host = array('localhost', 'otherhost.example.com');
// Where is the LDAP server.
// This can be an array.
$ldap_host = "10.0.0.1";
// If you have a non-standard LDAP port, you can define it here.
// This can be an array.
$ldap_port = 389;
// If you do not want to use LDAP v3, change the following to false.
// This can be an array.
$ldap_v3 = true;
// If you want to use TLS, change the following to true.
// This can be an array.
$ldap_tls = false;
// Support configuring a TLS client certificate/key from within MRBS.
// Requires PHP 7.1.0 or later
//$ldap_client_cert = 'path-to-cert.crt';
//$ldap_client_key = 'path-to-key.key';
// LDAP base distinguish name.
// This can be an array.
// Works: OU=mlm,OU=Students,OU=default-school,OU=SCHOOLS,DC=linuxmuster,DC=lan
$ldap_base_dn = "OU=SCHOOLS,DC=linuxmuster,DC=lan";
// Attribute within the base dn that contains the username
// This can be an array.
$ldap_user_attrib = "sAMAccountName";
// If you need to search the directory to find the user's DN to bind
// with, set the following to the attribute that holds the user's
// "username". In Microsoft AD directories this is "sAMAccountName"
// This can be an array.
$ldap_dn_search_attrib = "sAMAccountName";
// If you need to bind as a particular user to do the search described
// above, specify the DN and password in the variables below
// These two parameters can be arrays.
// BINDUSER!
$ldap_dn_search_dn = "CN=global-binduser,OU=Management,OU=GLOBAL,DC=linuxmuster,DC=lan"; // Any compliant LDAP
// $ldap_dn_search_dn = "searchuser@example.com"; // A form which could work for AD LDAP
$ldap_dn_search_password = "<Dein LDAP binduser Passwort>";
// 'auth_ldap' extra configuration for ldap configuration of who can use
// the system
// If it's set, the $ldap_filter will be used to determine whether a
// user will be granted access to MRBS
// This can be an array.
// An example for Microsoft AD:
// HIER
$ldap_filter = "|(memberof=CN=role-student,OU=Groups,OU=GLOBAL,DC=linuxmuster,DC=lan)(memberof=CN=role-teacher,OU=Groups,OU=GLOBAL,DC=linuxmuster,DC=lan)";
// If you need to filter a user by the group a user is in with an LDAP
// directory which stores group membership in the group object
// (like OpenLDAP) then you need to search for the groups they are
// in. If you want to do this, define the following two variables, an
// an appropriate $ldap_filter. e.g.:
// $ldap_filter_base_dn = "ou=Groups,dc=example,dc=com";
// $ldap_filter_user_attr = "member";
// $ldap_filter = "cn=MRBS Users";
// If you need to disable client referrals, this should be set to true.
// Note: Active Directory for Windows 2003 forward requires this.
// $ldap_disable_referrals = true;
// LDAP option for dereferencing aliases
// LDAP_DEREF_NEVER = 0 - (default) aliases are never dereferenced.
// LDAP_DEREF_SEARCHING = 1 - aliases should be dereferenced during the search
// but not when locating the base object of the search.
// LDAP_DEREF_FINDING = 2 - aliases should be dereferenced when locating the base object but not during the search.
// LDAP_DEREF_ALWAYS = 3 - aliases should be dereferenced always.
//$ldap_deref = LDAP_DEREF_ALWAYS;
// Set to true to tell MRBS to look up a user's email address in LDAP.
// Utilises $ldap_email_attrib below
$ldap_get_user_email = true;
// The LDAP attribute which holds a user's email address
// This can be an array.
$ldap_email_attrib = 'mail';
// The LDAP attribute which holds a user's name. Another common attribute
// to use (with Active Directory) is 'displayname'.
// This can be an array.
$ldap_name_attrib = 'displayName';
// The DN of the LDAP group that MRBS admins must be in. If this is defined
// then the $auth["admin"] is not used.
// This can be an array.
$ldap_admin_group_dn = 'CN=role-teacher,OU=Groups,OU=GLOBAL,DC=linuxmuster,DC=lan';
// The LDAP attribute that holds group membership details. Used with
// $ldap_admin_group_dn, above.
// This can be an array.
$ldap_group_member_attrib = 'memberof';
// Set to true if you want MRBS to call ldap_unbind() between successive
// attempts to bind. Unbinding while still connected upsets some
// LDAP servers
$ldap_unbind_between_attempts = false;
// By default MRBS will suppress "invalid credentials" error messages when binding
// in order to avoid the log filling up with warning messages when a user enters
// an incorrect username/password combination. Set this to FALSE if you want these
// errors to be logged, eg in order to be able spot brute force attack attempts.
$ldap_suppress_invalid_credentials = true;
// Output debugging information for LDAP actions
$ldap_debug = false;
Damit sollten sich Schüler und Lehrer anmelden können und die Lehrer sind Admins.
(Ldap Binduser passwort musst du noch ersetzen)
Ich denke, ich werde mich mal an eine Dokumentation für alle LDAP Anbindungen setzten.
VG,
Dorian
