diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php
index c7cab469d..6ae49e7bc 100644
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -2240,6 +2240,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
$required_settings = array('authsource', 'authorize_url', 'token_url', 'client_id', 'client_secret', 'redirect_url', 'userinfo_url', 'client_scopes');
break;
case "ldap":
+ $_data['host'] = (!empty($_data['host'])) ? str_replace(" ", "", $_data['host']) : "";
$_data['port'] = (!empty($_data['port'])) ? intval($_data['port']) : 389;
$_data['username_field'] = (!empty($_data['username_field'])) ? strtolower($_data['username_field']) : "mail";
$_data['attribute_field'] = (!empty($_data['attribute_field'])) ? strtolower($_data['attribute_field']) : "";
@@ -2356,7 +2357,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
$options[LDAP_OPT_X_TLS_REQUIRE_CERT] = LDAP_OPT_X_TLS_NEVER;
}
$provider = new \LdapRecord\Connection([
- 'hosts' => [$_data['host']],
+ 'hosts' => explode(",", $_data['host']),
'port' => $_data['port'],
'base_dn' => $_data['basedn'],
'username' => $_data['binddn'],
@@ -2450,7 +2451,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
$options[LDAP_OPT_X_TLS_REQUIRE_CERT] = LDAP_OPT_X_TLS_NEVER;
}
$provider = new \LdapRecord\Connection([
- 'hosts' => [$settings['host']],
+ 'hosts' => explode(",", $settings['host']),
'port' => $settings['port'],
'base_dn' => $settings['basedn'],
'username' => $settings['binddn'],
diff --git a/data/web/lang/lang.en-gb.json b/data/web/lang/lang.en-gb.json
index 5c9c1b21b..c9a7f9dfa 100644
--- a/data/web/lang/lang.en-gb.json
+++ b/data/web/lang/lang.en-gb.json
@@ -225,6 +225,7 @@
"iam_description": "Configure an external Provider for Authentication
User's mailboxes will be automatically created upon their first login, provided that an attribute mapping has been set.",
"iam_extra_permission": "For the following settings to work, the mailcow client in Keycloak needs a Service account and the permission to view-users.",
"iam_host": "Host",
+ "iam_host_info": "Enter one or more LDAP hosts, separated by commas.",
"iam_import_users": "Import Users",
"iam_mapping": "Attribute Mapping",
"iam_bindpass": "Bind Password",
diff --git a/data/web/templates/admin/tab-config-identity-provider.twig b/data/web/templates/admin/tab-config-identity-provider.twig
index e5103d970..e2cc56838 100644
--- a/data/web/templates/admin/tab-config-identity-provider.twig
+++ b/data/web/templates/admin/tab-config-identity-provider.twig
@@ -9,7 +9,9 @@
{{ lang.admin.iam_description|raw }}