FileRun can authenticate its users against an LDAP directory instead of its own user database. When a user signs in, FileRun asks the directory to verify the password and reads the user's details from the directory record, creating the FileRun account on the first successful sign-in.
For Microsoft Active Directory, which is LDAP-compliant and uses the same plugin, see Active Directory. That page gives the values specific to AD.
Enable and configure the plugin from the control panel, under Users → Authentication.
Select LDAP from the Enabled plugin list.
Use the
Save and test authenticationbutton before you enable the plugin, and undo your changes if the test does not succeed. Fill inTest usernameandTest passwordat the bottom of the form with the credentials of a real directory account, so the test can perform a complete sign-in.
The hostname or IP address of the directory server. For an encrypted connection, start the value
with ldaps://.
389 for a plain connection, 636 for an ldaps:// one.
The distinguished name of the account FileRun uses to search the directory, for example
cn=read-only-admin,dc=example,dc=com. A read-only account is enough.
If you leave this field empty, FileRun binds anonymously, and the User DN template below is used
instead. Most directories do not allow anonymous access.
The password of the account named in Bind DN.
Used only when Bind DN is left empty. It builds the bind DN out of the username the user
typed in the sign-in form, without the domain. {USERNAME} is replaced with what was typed.
Example: uid={USERNAME},dc=example,dc=com
Your directory's base DN, where the search for the user record starts.
Example: dc=example,dc=com
An additional base DN, searched when the record is not found under the first one. Leave it empty if you have only one.
The filter that identifies the user record. {USERNAME} is replaced with the typed username.
Example: (&(uid={USERNAME})(objectClass=person))
FileRun can read the user's directory groups and mirror them as FileRun groups, which is how a directory decides who reaches which shared folders.
Set this to yes when your groups are organised in a hierarchy and a user's membership is
inherited through it. Enabling this disables Groups search filter.
Used only when the option above is no. It finds the user's groups, together with
Groups member attribute.
Example: (objectClass=groupOfUniqueNames)
The attribute holding the membership, for example memberUid or member, depending on your
directory's schema.
A list of directory group names. A user who is not a member of at least one of them is refused, even when the password is correct. Leave it empty to allow every directory account.
A list of directory group names that are created in FileRun and assigned to the user when the user belongs to them. Leave it empty to import every group the user is a member of.
These fields name the directory attributes FileRun reads to fill in the FileRun account. Only
First name field is required.
First name field — commonly givenNameLast name field — commonly snE-mail field — commonly mailPhone number fieldCompany name fieldWhen set to yes and the directory records carry a homeDirectory attribute, FileRun uses that
path as the user's home folder. It has to be a full local path on the FileRun server, including
the drive letter on Windows.
Leave it at no to assign home folders through a FileRun role instead.
Set to yes to sign in users automatically when they are already authenticated on the local
domain through Windows Integrated Authentication, with no username or password typed. This
requires an IIS server configured for Windows Integrated Authentication, and browsers configured
to trust the domain.
The command cron/users_sync.php reads the directory and updates the FileRun user database from
it. See Command line tools.
An incorrect configuration, or a directory server that stops answering, can leave nobody able to
sign in. Keep Allow local user accounts to log in enabled until you are sure the setup works, so
that the FileRun superuser can still sign in with its own password.
If you are already locked out, follow Disabling the authentication integration.