You can configure your Cloud Platform website to communicate with the LDAP (Lightweight Directory Access Protocol) infrastructure on your internal network and access the directory information it contains. Use LDAP only if you do not require a web-friendly single sign-on (SSO) system (such as SimpleSAML).
Enable LDAP: Main steps
To enable communication between your LDAP infrastructure and your Cloud Platform application:
Make sure that your code repository contains a properly installed and enabled LDAP integration module for your application that matches your installed version of Drupal:
(Optional) Get EIPs for your Cloud Platform environments
Depending on how your LDAP infrastructure is configured, you may need to allowlist your Cloud Platform Production or non-Production environments or both. Since the IP address of a Cloud Platform infrastructure can change at any time, this may require one or more static IP addresses, using Elastic IP (EIP) assignments. To get EIPs assigned to your Cloud Platform environment’s Drupal infrastructure, create a Support ticket.
The best practice in a production environment is to use SSL and certificate validation for communication between your LDAP infrastructure and your Cloud Platform website, as described in Configuring LDAPS. Initially, however, configure your system to not require certificate validation.
Turn off SSL/TLS certificate validation in ldap.conf
Create an ldap.conf file that includes this line:
TLS_REQCERT never
You can put this file anywhere that your application can access. The best place is in your application’s codebase, at the same level, but not in your application’s docroot. For example, you could create a directory named ldap and put the ldap.conf file there.
Specify the location of your ldap.conf file with an environment variable, LDAPCONF. For example, add a line like this to your settings.php file:
putenv('LDAPCONF=../ldap/ldap.conf');
Temporary alternative to creating a ldap.conf file
As a simpler alternative, instead of creating an ldap.conf file, you can add this line to your settings.php file, but it must be removed before enabling LDAP on your production website:
putenv('LDAPTLS_REQCERT=never');
This line instructs LDAP to ignore the certificate request when connecting to a remote LDAP infrastructure. Until the line is removed, your application will not bind with the remote infrastructure, though connection tests with openssl will appear successful.
Test your connection to the LDAP infrastructure
Test whether your application can connect to the LDAP infrastructure. Connect to your infrastructure with SSH, and enter a command similar to the following:
After you have confirmed that your website can connect to the LDAP infrastructure, set up secure communication with LDAPS, as described in Configuring LDAPS.
Using LDAP with a Cloud Platform application
You can configure your Cloud Platform website to communicate with the LDAP (Lightweight Directory Access Protocol) infrastructure on your internal network and access the directory information it contains. Use LDAP only if you do not require a web-friendly single sign-on (SSO) system (such as SimpleSAML).
Enable LDAP: Main steps
To enable communication between your LDAP infrastructure and your Cloud Platform application:
Make sure that your code repository contains a properly installed and enabled LDAP integration module for your application that matches your installed version of Drupal:
(Optional) Get EIPs for your Cloud Platform environments
Depending on how your LDAP infrastructure is configured, you may need to allowlist your Cloud Platform Production or non-Production environments or both. Since the IP address of a Cloud Platform infrastructure can change at any time, this may require one or more static IP addresses, using Elastic IP (EIP) assignments. To get EIPs assigned to your Cloud Platform environment’s Drupal infrastructure, create a Support ticket.
The best practice in a production environment is to use SSL and certificate validation for communication between your LDAP infrastructure and your Cloud Platform website, as described in Configuring LDAPS. Initially, however, configure your system to not require certificate validation.
Turn off SSL/TLS certificate validation in ldap.conf
Create an ldap.conf file that includes this line:
TLS_REQCERT never
You can put this file anywhere that your application can access. The best place is in your application’s codebase, at the same level, but not in your application’s docroot. For example, you could create a directory named ldap and put the ldap.conf file there.
Specify the location of your ldap.conf file with an environment variable, LDAPCONF. For example, add a line like this to your settings.php file:
putenv('LDAPCONF=../ldap/ldap.conf');
Temporary alternative to creating a ldap.conf file
As a simpler alternative, instead of creating an ldap.conf file, you can add this line to your settings.php file, but it must be removed before enabling LDAP on your production website:
putenv('LDAPTLS_REQCERT=never');
This line instructs LDAP to ignore the certificate request when connecting to a remote LDAP infrastructure. Until the line is removed, your application will not bind with the remote infrastructure, though connection tests with openssl will appear successful.
Test your connection to the LDAP infrastructure
Test whether your application can connect to the LDAP infrastructure. Connect to your infrastructure with SSH, and enter a command similar to the following:
After you have confirmed that your website can connect to the LDAP infrastructure, set up secure communication with LDAPS, as described in Configuring LDAPS.
Did not find what you were looking for?
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Did not find what you were looking for?
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Cloud Platform