Moodle Accounts in LDAP

Maintained by Stephan Robotta

This plugin displays a report page and matches user accounts in Moodle with an LDAP directory in the organisation. Various filters can be used to select users. The report may also be exported. Via a cli script non existent users in LDAP may be suspended in Moodle. In addition the plugins contains a scheduled task and a cli script that checks for new accounts in LDAP and creates a corresponding user account in Moodle. This is helpful when new users should be enroled in courses but haven't yet logged into Moodle and have an account created during the login process.

Free

Download for free

Supports Moodle 4.1-5.2 See all versions

Latest release: 1 month ago

Installations: 23

Downloads (last 90 days): 49

Frankenstyle name: report_ldapaccounts

Reports

Use cases

The plugin was developed to serve the following use cases in our institution.

Suspend user

The use case for the need of this plugin was that the Moodle authentication is done via Shibboleth (an SSO service). If the user is authenticated via the SSO provider and the identity service of the institution, the user is redirected to Moodle together with some information who he is. He then is logged in or even created. A LDAP directory may work here as the identity provider for Shibboleth but there is no direct connection from/to Moodle.

Whenever a user drops out of the institution the identity provider will not allow to log him in anymore. However, the account in Moodle is still active and emails may be sent out to the users email address.

Therefore, this plugin contains a mechanism to detect such users and disable or delete them from Moodle once they do not exist in the LDAP anymore. The CLI script should automate the process e.g. at each start of a new term.

Create new accout

Another use case where the plugin comes in use, is the creation of accounts whenever a new user appears in the LDAP. In general, an account is automatically created once the new user tries to login via SSO and the user does not yet have an account in Moodle. However, teachers or administration staff cannot enrol a user into a course unless the user has not yet tried a login. With the automatic creation of the account once the user exists in the LDAP directory (the IDS), the user is automatically created and can already enrolled into courses without having him to become active to login.

The synchronization of the user accounts is done via a Moodle Scheduled Task but can also be done via a command line script. New users are searched via the property createTimestamp, a standard field that exists in LDAP. After a run the current time is stored in a Moodle plugin setting and the next time only newer created accounts are queried in LDAP.