The '''Authentication''' settings decide how people sign in to this site.

==Locally Stored Passwords==

This is the default. With '''Locally Stored Passwords''' selected, each account's password is kept on this site in hashed form and is checked here when someone signs in. Creating accounts, changing passwords, and recovering passwords are all handled by this site.

==LDAP==

With '''LDAP''' (Lightweight Directory Access Protocol) selected, a sign-in password is checked against an outside LDAP directory server, such as a company or campus directory, instead of being stored here. A person still has an ordinary account on this site; the directory only confirms the password. The site links a directory sign-in to a local account by '''email address''', so every account that should sign in through LDAP needs the same email address here as it has in the directory.

Choosing LDAP reveals these fields:

• '''LDAP Directory Servers:''' one or more directory servers to check passwords against. Use the '''+''' button to add a server and the '''Remove''' button to take one out. If the first server cannot be reached, the next one is tried.
• '''LDAP Account Suffix:''' the text added after a username to build the name the directory expects, for example @example.com.
• '''LDAP Base DN:''' the base distinguished name a directory search starts from, for example dc=example,dc=com.
• '''Root Username''' and '''Root Password:''' the root account's own directory sign-in. These are used only to switch LDAP on, as described below, and the password is never stored.

==When LDAP Starts Working==

LDAP sign-in only takes over once it is completely set up. Until then the site quietly keeps using locally stored passwords, so no one is locked out, and the Authentication panel lists what still needs attention. The checks are:

• At least one LDAP directory server has been added.
• The LDAP account suffix has been set.
• The LDAP base DN has been set.
• No email address is shared by more than one account. The directory identifies a person by email, so two accounts with the same email cannot be told apart. The '''Download conflicts''' link saves a list of any shared email addresses so you can sort them out.
• The root administrator account has an email address, so an LDAP sign-in can always reach an administrator.

When those pass, switching the method to LDAP makes one more check before going live: the site signs in to the directory as the root account using the root directory username and password you entered, reads the email the directory holds for that account, and confirms it matches the root account's email here. This proves the directory really works and that the administrator will still be able to sign in, so turning LDAP on cannot lock you out. If the directory sign-in fails or the emails do not match, the site stays on locally stored passwords and tells you which check failed; fix it and save again. Once LDAP is active, ordinary saves of this panel keep it active without asking for the root sign-in again.

==Account Recovery==

The '''Account Recovery''' dropdown sets what happens when a user forgets their password:

• '''No User Password Recovery Link''' turns recovery off.
• '''Email Link Password Recovery''' emails the user a reset link.
• '''User Question Password Recovery''' asks the security questions the user set up; use '''Edit Account Recovery Questions''' to choose those questions.

When LDAP is the authentication method, passwords live in the directory rather than on this site, so this site cannot reset them. Account Recovery is therefore turned off and held at '''No User Password Recovery Link''' while LDAP is selected; password resets are handled through the directory instead.