Auth_Container_LDAP

$a1 = new Auth("LDAP", array(
   'host' => 'localhost',
   'port' => '389',
   'version' => 3,
   'basedn' => 'o=netsols,c=de',
   'userattr' => 'uid'
   'binddn' => 'cn=admin,o=netsols,c=de',
   'bindpw' => 'password'
   ));

$a2 = new Auth('LDAP', array(
   'url' => 'ldaps://ldap.netsols.de',
   'basedn' => 'o=netsols,c=de',
   'userscope' => 'one',
   'userdn' => 'ou=People',
   'groupdn' => 'ou=Groups',
   'groupfilter' => '(objectClass=posixGroup)',
   'memberattr' => 'memberUid',
   'memberisdn' => false,
   'group' => 'admin'
   ));

$a3 = new Auth('LDAP', array(
   'host' => 'ldap.netsols.de',
   'port' => 389,
   'version' => 3,
   'referrals' => false,
   'basedn' => 'dc=netsols,dc=de',
   'binddn' => 'cn=Jan Wagner,cn=Users,dc=netsols,dc=de',
   'bindpw' => 'password',
   'userattr' => 'samAccountName',
   'userfilter' => '(objectClass=user)',
   'attributes' => array(''),
   'group' => 'testing',
   'groupattr' => 'samAccountName',
   'groupfilter' => '(objectClass=group)',
   'memberattr' => 'member',
   'memberisdn' => true,
   'groupdn' => 'cn=Users',
   'groupscope' => 'one',
   );

When talking to a Microsoft ActiveDirectory server you have to use 'samaccountname' as the 'userattr' and follow special rules to translate the ActiveDirectory directory names into 'basedn'. The 'basedn' for the default 'Users' folder on an ActiveDirectory server for the ActiveDirectory Domain (which is not related to its DNS name) "win2000.example.org" would be: "CN=Users, DC=win2000, DC=example, DC=org" where every component of the domain name becomes a DC attribute of its own. If you want to use a custom users folder you have to replace "CN=Users" with a sequence of "OU" attributes that specify the path to your custom folder in reverse order. So the ActiveDirectory folder "win2000.example.org\Custom\Accounts" would become "OU=Accounts, OU=Custom, DC=win2000, DC=example, DC=org"

It seems that binding anonymously to an Active Directory is not allowed, so you have to set binddn and bindpw for user searching.

LDAP Referrals need to be set to false for AD to work sometimes.

Note also that if you want an encrypted connection to an MS LDAP server, then, on your webserver, you must specify "TLS_REQCERT never" in /etc/ldap/ldap.conf or in the webserver user's ~/.ldaprc (which may or may not be read depending on your configuration).