A directory rarely keeps everything worth suggesting in one branch: people
sit in a people branch, meeting rooms and other bookable resources in a
separate one. Searching a single subtree misses them, and widening the base
to the domain root drags every service and role account into the list.
base_dn now accepts several branches separated by '|', which cannot appear
unescaped in a DN — an existing single-branch value parses to a one-element
list and behaves exactly as before. A branch that fails to answer is logged
with its own DN and no longer discards the whole lookup.
Since multiple LDAP attributes are supported for the user name/email,
there's no harm in having defaults that are a bit more flexible
(for example, "givenName" is commonly only the users first name,
while a full name is usually preferable as an email recipient).
ldap_connect(<host>, <port>) is deprecated and ldap_connect(<uri>) is
more expressive (for example, by allowing the use of SSL to be
mandatory using a ldaps:// URL).
While the LDAP search is case insensitive, the array which is returned from
ldap_get_entries() will only use lowercase. This means that if one
configures the plugin to look for e.g. "givenName", no results
will be returned.
The plugin currently supports SSL (by using a ldaps:// URI as the
hostname of the LDAP server) and unencrypted LDAP. This patch
also adds StartTLS support, which is used by many LDAP servers.
