A directory rarely keeps everything worth suggesting in one branch: people
sit in a people branch, meeting rooms and other bookable resources in a
separate one. Searching a single subtree misses them, and widening the base
to the domain root drags every service and role account into the list.
base_dn now accepts several branches separated by '|', which cannot appear
unescaped in a DN — an existing single-branch value parses to a one-element
list and behaves exactly as before. A branch that fails to answer is logged
with its own DN and no longer discards the whole lookup.
This is just cosmetic, but the "to use" is superfluous and doesn't match the wording of the other labels (and makes the rendered UI a bit weird by pushing everything to the side).
Since multiple LDAP attributes are supported for the user name/email,
there's no harm in having defaults that are a bit more flexible
(for example, "givenName" is commonly only the users first name,
while a full name is usually preferable as an email recipient).
ldap_connect(<host>, <port>) is deprecated and ldap_connect(<uri>) is
more expressive (for example, by allowing the use of SSL to be
mandatory using a ldaps:// URL).
Use common LDAP terminology and update comments to reflect how the
configuration options work (e.g. that all the LDAP attribute options
are multivalued).
While the LDAP search is case insensitive, the array which is returned from
ldap_get_entries() will only use lowercase. This means that if one
configures the plugin to look for e.g. "givenName", no results
will be returned.
The plugin currently supports SSL (by using a ldaps:// URI as the
hostname of the LDAP server) and unencrypted LDAP. This patch
also adds StartTLS support, which is used by many LDAP servers.
