By default, myDBR will use the AD user's sAMAccountName attribute as the username in myDBR. One can change that definition in user/defaults.php by overriding the $mydbr_defaults['active_directory']['mydbr_username'] value. The default value is {sAMAccountName}. myDBR will replace attribute names wrapped in {} with the corresponding values in the user's record in AD. To use the user's email as the username, one can use the mail attribute {mail} (or {userPrincipalName}).

To configure myDBR's Active Directory-authentication in the Active Directory server, the following groups need to be defined:

All of the predefined group names can be customized in mydbr/.

myDBR determines if the user in Active Directory is a myDBR user by checking if the user belongs to any of the groups listed in Active Directory group 'myDBR Groups' or is a direct member of 'myDBR Groups'.

All user group handling is done inside Active Directory. When a user logs in her/his groups are checked against the Active Directory provided group list.

If one has a setup where users defined in multiple separate (different users) Active Directories need to be using myDBR, one can define additional Active Directory entry points. If more than one is defined, the user's login screen will show a popup of available Active Directories. One can name the default Active Directory in mydbr/ with the definition:

$mydbr_defaults['active_directory']['visible_name'] = 'Primary one';

To add additional Active Directories, one can use the `$mydbr_defaults['active_directory']['extra_domains']` array in mydbr/. Each array element represents a Active Directory. To make sure user names will be unique inside myDBR, make sure to use different mydbr_username-values for each AD. The format allows also additional text in the field. For example value 'US1:{sAMAccountName}' might produce a username 'US1:user'. All array fields are mandatory.

$mydbr_defaults['active_directory']['extra_domains'] = array(
  array(
    'domain_controller' => 'hostname',
    'username' => 'username',
    'password' => 'password',
    'accont_suffix' => 'ad_us.yourcompany.com',
    'base_dn' => 'OU=your_organization,DC=ad_us,DC=yourcompany,DC=com',
    'visible_name' => 'US users',
    'mydbr_username' => '{userPrincipalName}'
  )
);

One can map the Active Directory users to myDBR Organization, by defining the $mydbr_defaults['active_directory']['organization_ext_id'] value. The value can be constant account_suffix or any of the fields in user's AD record.

$mydbr_defaults['active_directory']['organization_ext_id'] = 'account_suffix';