---
# Configure Moodle's auth_ldap plugin. In variant 0 (hybrid) it runs
# in sync-only mode (login = auth_oidc); in variant 1 (LDAP-only) it
# is the primary login plugin. Field mapping is identical between
# variants.
- name: "▶️ Run Moodle DB upgrade for auth_ldap plugin"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
php {{ MOODLE_CLI_DIR }}/upgrade.php --non-interactive
failed_when: false
changed_when: false
- name: "🔧 Configure auth_ldap connection + field mapping"
include_tasks: utils/plugin_config.yml
vars:
moodle_plugin_config_component: auth_ldap
moodle_plugin_config_settings:
host_url: "{{ LDAP.SERVER.URI }}"
ldap_version: 3
start_tls: 0
user_type: "rfc2307"
contexts: "{{ LDAP.DN.OU.USERS }}"
search_sub: 1
user_attribute: "uid"
objectclass: "(objectClass=inetOrgPerson)"
memberattribute: "memberOf"
memberattribute_isdn: 1
bind_dn: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
bind_pw: "{{ LDAP.BIND_CREDENTIAL }}"
creators: "*"
auth_user_create: "{{ MOODLE_OIDC_ENABLED | bool | ternary(0, 1) }}"
removeuser: 1 # 1 = suspend (preserve history); 2 = delete
sync_suspended: 1
field_map_firstname: "givenName"
field_lock_firstname: "locked"
field_updatelocal_firstname: "oncreate"
field_map_lastname: "sn"
field_lock_lastname: "locked"
field_updatelocal_lastname: "oncreate"
field_map_middlename: "initials"
field_lock_middlename: "locked"
field_updatelocal_middlename: "oncreate"
field_map_alternatename: "displayName"
field_lock_alternatename: "locked"
field_updatelocal_alternatename: "oncreate"
field_map_email: "mail"
field_lock_email: "locked"
field_updatelocal_email: "oncreate"
field_map_phone1: "telephoneNumber"
field_lock_phone1: "locked"
field_updatelocal_phone1: "oncreate"
field_map_phone2: "mobile"
field_lock_phone2: "locked"
field_updatelocal_phone2: "oncreate"
field_map_address: "street"
field_lock_address: "locked"
field_updatelocal_address: "oncreate"
field_map_city: "l"
field_lock_city: "locked"
field_updatelocal_city: "oncreate"
field_map_country: "c"
field_lock_country: "locked"
field_updatelocal_country: "oncreate"
field_map_institution: "o"
field_lock_institution: "locked"
field_updatelocal_institution: "oncreate"
field_map_department: "ou"
field_lock_department: "locked"
field_updatelocal_department: "oncreate"
field_map_description: "description"
field_lock_description: "locked"
field_updatelocal_description: "oncreate"
field_map_idnumber: "employeeNumber"
field_lock_idnumber: "locked"
field_updatelocal_idnumber: "oncreate"
field_map_url: "labeledURI"
field_lock_url: "locked"
field_updatelocal_url: "oncreate"
field_map_lang: "preferredLanguage"
field_lock_lang: "locked"
field_updatelocal_lang: "oncreate"
field_map_firstnamephonetic: "infinitoNamePhoneticGiven"
field_lock_firstnamephonetic: "locked"
field_updatelocal_firstnamephonetic: "oncreate"
field_map_lastnamephonetic: "infinitoNamePhoneticFamily"
field_lock_lastnamephonetic: "locked"
field_updatelocal_lastnamephonetic: "oncreate"
field_map_timezone: "infinitoTimezone"
field_lock_timezone: "locked"
field_updatelocal_timezone: "oncreate"
- name: "🟢 Enable auth_ldap plugin"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
php {{ MOODLE_CLI_DIR }}/cfg.php --name=auth --set=ldap
when: not (MOODLE_OIDC_ENABLED | bool)
changed_when: false
- name: "🟢 Variant 0: let auth_oidc own the login page, auth_ldap syncs"
when: MOODLE_OIDC_ENABLED | bool
block:
- name: "🟢 Variant 0: enable both auth_oidc + auth_ldap (oidc primary)"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
php {{ MOODLE_CLI_DIR }}/cfg.php --name=auth --set=oidc,ldap
changed_when: false
- name: "🔑 Hide auth_ldap from login page in variant 0 (OIDC is the only entry point)"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
php {{ MOODLE_CLI_DIR }}/cfg.php --component=auth_ldap
--name=removecontexts --set=1
changed_when: false
- name: "⚡ Trigger auth_ldap sync to pre-provision LDAP users"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
php {{ MOODLE_CLI_DIR }}/scheduled_task.php
--execute='\auth_ldap\task\sync_task'
failed_when: false
changed_when: false
