To enable Active Directory authentication, the following settings must be configured in the Environment settings:

By default, myDBR will use the AD user's sAMAccountName attribute as the username in myDBR. One can change that definition in user/defaults.php by overriding the $mydbr_defaults['active_directory']['mydbr_username'] value. The default value is {sAMAccountName}. myDBR will replace attribute names wrapped in {} with the corresponding values in the user's record in AD. To use the user's email as the username, one can use the mail attribute {mail} (or {userPrincipalName}).

If you have a setup where users from multiple, separate Active Directories (with different user bases) need to access myDBR, you can define additional Active Directory entry points. When more than one is defined, the login screen will display a dropdown allowing the user to select the appropriate Active Directory. You can set the name of the default Active Directory in mydbr/ with the following definition:

      $mydbr_defaults['active_directory']['visible_name'] = 'Primary one';
      

To add additional Active Directories, use the $mydbr_defaults['active_directory']['extra_domains'] array in mydbr/. Each array element represents one Active Directory. To ensure usernames remain unique within myDBR, assign different mydbr_username values for each AD. The format also allows custom prefixes or text in the field. For example, the value 'US1:{sAMAccountName}' might result in a username like 'US1:user'. All array fields are required.

      $mydbr_defaults['active_directory']['extra_domains'] = array(
        array(
          'domain_controller' => 'hostname',
          'username' => 'username',
          'password' => 'password',
          'accont_suffix' => 'ad_us.yourcompany.com',
          'base_dn' => 'OU=your_organization,DC=ad_us,DC=yourcompany,DC=com',
          'visible_name' => 'US users',
          'mydbr_username' => '{userPrincipalName}'
        )
      );
      

One can map the Active Directory users to myDBR Organization, by defining the $mydbr_defaults['active_directory']['organization_ext_id'] value. The value can be constant account_suffix or any of the fields in user's AD record.

      $mydbr_defaults['active_directory']['organization_ext_id'] = 'account_suffix';
      

Users can log in to myDBR using either their sAMAccountName or email address.

To use Active Directory over SSL, you need to define the Domain Controller using the format ldaps://hostname:port (the default port is 636). If you encounter issues connecting to Active Directory over SSL, ensure that your web server has access to the LDAP configuration file ldap.conf (see the PHP documentation for ldap_connect). Make sure the configuration file includes the Active Directory Root CA certificate specified with the TLS_CACERT directive.

To test if the issue is caused by PHP not recognizing the AD's certificate, you can temporarily bypass the certificate check by adding the following line to your code:

      putenv('LDAPTLS_REQCERT=never');
      

This disables certificate validation and can help identify whether the SSL issue is related to certificate trust.

The following settings must be configured in the Environment settings for Azure OpenID:

myDBR will generate the Redirect URI, which must be set in the App Registrations section of the Azure Portal.

myDBR will use the subject claim (sub) from the OpenID identifier as the user's username

Group names like Finance[OrgID:ext_id_xx], will be created as Finance in myDBR and user is added to an organization with matching organizations external_id (ext_id_xx).