This plugin allows us to integrate CrushFTP with your LDAP server, such as the Microsoft Active Directory server, or OpenLDAP, etc.

The settings can br grouped into three major sections, based on functionality:

!!Connectivity and user lookup

[attachments|Clipboard01.png]

__LDAP server URL, fully qualified user name and password__ of an LDAP account used for queries; the account needs read only access on the full LDAP tree. 
The plugin supports __referral chasing__, in case of multiple forests with trust relationship between, can allow this by setting the __Follow referrals__ option.
To use a secure LDAP (__ldaps://__) URL, set either the __Accept any SSL certificate__ option or import the LDAP server public certificate into the Java trust store, __cacerts__.

__Search base location__ needs to be pointed to the root of the LDAP tree or full path to some container OU. LDAP objects outside this path will not be visible to the plugin.

__Search filter__ needs to be some unique LDAP attribute name, like __sAMAccountName__ for plain username or __userPrincipalName__ for the user FQDN as allowed username format. We can also automatically round robin between these if the __On login, make two attempts...__ option is enabled. This field also allows more complex LDAP filter expressions , an example for enabled user accounts only
{{{
(&(objectClass=user)(objectCategory=person)(sAMAccountname=?)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))
}}}

!!Home folder access

Most important, as the user will be denied login in case of an invalid home directory configuration.

__LDAP used for authentication only__, if this option is enabled, the plugin will match the logging in user name against the local user database, in case of a successful match, the user is allowed to log in with it's LDAP password, and the user settings, including it's VFS configuration, is loaded from the local account. This method allows the most fine grained control over each LDAP integrated account, with the cost of being tedious, will need to create for each allowed user a matching account in User Manager (with blank or random password, since that will be ignored anyways).

__LDAP or local home directory__ method is used if the above option is not enabled. The plugin will attempt to grant the user folder access to a path loaded from an LDAP attribute value or assign a local folder path. In this case __local__ doesn't necessarily means a local folder on the CrushFTP server host itself, we do support network share
access via UNC paths or any of the supported remote networking protocols based URLs (FTP, SMB, etc.).

__HomeDirectory field__ , if this contains a valid LDAP attribute name, the plugin will attempt to grant access to the path contained by the attribute as it's value. In case of Microsoft Active DIrectory, this field should be set to __homeDirectory__, in case of Linux SLAPD, to __unixHomeDirectory__, etc. or any arbitrary LDAP attribute containing a single folder path or coma separated list of paths. To disable, set this field value to __NA__ (or any arbitrary value __not__ matching an LDAP attribute name).

__Use local folder if LDAP's HomeDirectory not found__ if this option is enabled, and loading a valid path as per above, failed, the plugin will attempt to grant local folder
access within a root folder pointed to by the __Path__ field value. Set the __Append username to path__ and __Create folder with username__ to create individual, username based 
home directories.