Authentication Methods

Authentication Methods

Moodle supports multiple authentication methods that determine how users verify their identity when logging in. You can enable multiple authentication plugins simultaneously, and Moodle will try them in the configured order.

Managing Authentication Plugins

Navigate to Site administration > Plugins > Authentication > Manage authentication to view, enable, disable, and reorder authentication plugins. The order matters — Moodle checks each enabled plugin in sequence until one successfully authenticates the user.

Manual Accounts (Default)

The default authentication method where administrators create user accounts manually. Users are stored in the Moodle database with hashed passwords. This is suitable for small sites or as a fallback authentication method.

• Accounts created at Site administration > Users > Add a new user
• Bulk creation via CSV at Site administration > Users > Upload users
• Password hashing uses bcrypt by default

Email-Based Self-Registration

Allows users to create their own accounts by providing an email address. A confirmation email is sent to verify ownership.

1. Enable at Manage authentication > Email-based self-registration
2. Set Self registration to Email-based self-registration at the bottom of the Manage authentication page
3. Configure reCAPTCHA to prevent spam registrations (requires a Google reCAPTCHA key)

LDAP Authentication

Integrates Moodle with LDAP or Active Directory for centralized authentication. Configure at Site administration > Plugins > Authentication > LDAP server:

• Host URL: ldap://ldap.example.com or ldaps://ldap.example.com for secure connections
• Version: LDAP protocol version (use 3)
• Bind DN: Distinguished name for binding to LDAP (e.g., cn=moodle,dc=example,dc=com)
• Bind password: Password for the bind DN
• User type: posixAccount, inetOrgPerson, eduPerson, Active Directory, etc.
• Contexts: Base DN(s) where user accounts are located (e.g., ou=users,dc=example,dc=com)
• Search subcontexts: Whether to search sub-OUs
• User attribute: LDAP attribute containing the username (e.g., uid or sAMAccountName)
• Field mappings: Map LDAP attributes to Moodle user profile fields (first name, last name, email, etc.)

LDAP synchronization can be scheduled via the auth_ldap asksync_task scheduled task, which creates and updates Moodle user accounts from LDAP.

OAuth 2 Authentication

Moodle 4.x includes built-in OAuth 2 support for authentication with external identity providers. Configure at Site administration > Server > OAuth 2 services:

• Google: Login with Google accounts
• Microsoft: Login with Microsoft/Azure AD accounts
• Facebook: Login with Facebook accounts
• Nextcloud: Login with Nextcloud accounts
• Custom: Configure any OAuth 2 / OpenID Connect provider

After creating the OAuth 2 service, enable the OAuth 2 authentication plugin and link it to the service.

SAML Authentication

For SAML 2.0 (Security Assertion Markup Language) integration, install a SAML plugin such as auth_saml2. SAML is commonly used in higher education for single sign-on (SSO) with institutional identity providers. Configuration typically involves:

• Uploading the identity provider (IdP) metadata
• Configuring the service provider (SP) metadata endpoint
• Mapping SAML attributes to Moodle user fields
• Configuring certificate and key files

Shibboleth

Shibboleth is a federated authentication system widely used in academic institutions. Moodle includes a built-in Shibboleth authentication plugin. Prerequisites include a Shibboleth Service Provider (SP) installed on your web server. Configuration involves mapping Shibboleth attributes to Moodle fields and configuring the login/logout URLs.

No Login

The No login authentication method prevents users from logging in. This is useful for suspending accounts without deleting them, or for accounts that should only be accessed via web services.

Authentication Settings (Common)

At the bottom of the Manage authentication page, configure common settings:

• Self registration: Which authentication plugin handles new user registration
• Guest login button: Show or hide the guest login button
• Alternate login URL: Redirect users to a custom login page
• Allowed email domains: Restrict registrations to specific email domains
• Denied email domains: Block registrations from specific domains
• reCAPTCHA: Configure Google reCAPTCHA for self-registration forms