if ($passwd != Auth::hashPassword($password)) {
return false;
} else {
return true;
}

by your module call:

if ($passwd != Auth::hashPassword($password)) {
return(LDAPAuthenticator::ldap_authenticate($email, $password));
} else {
return true;
}

so it now attempts local authentication before LDAP.

I also modified the LDAPAuthenticator by taking out the BIND_DN and BIND_PASSWORD bits, as my LDAP server allows anonymous lookup of the user’s dn (OpenLDAP on RHEL5/Centos5). I suspect this will be valid for most implementations. And I found I do not need the LDAP_PORT setting: ldap:// will use port 389, ldaps:// will use port 636.

Tip: When using multiple, synchronized LDAP servers, you can specify those in the LDAP_HOST parameter like:

define(”LDAP_HOST”, ‘ldaps://ldapserver1.example.com,ldaps://ldapserver2.example.com’);

If ldapserver1 is down, automatic failover to ldapserver2 will occur (use ‘bind_policy soft’ in ldap.conf).

I try to use your piece of code with some headaches.. now, I run this with two modifications:
LDAP_BIND_DN wiritten in Netbios form “DOMAIN\Administrator”

setting option ldap_set_option($server, LDAP_OPT_REFERRALS, 0);
in order to search from the root DN (usually, in small domains one user is searched in the entire domain)

I´m thinking the manner to add “automagically” the users in the database… if finally i do that, don´t worry , I´ll send you the mods.

Thanks for all!

Yep, you got me. Thanks for pointing this out. I have corrected it in both the post and the tarball.

Glad you found it useful.

Thanks for this hack. It was a useful one indeed.

(Cortesía de Google Translate)