Connecting DiLer to linuxmuster.net: User Sync, LDAP, and Admin Experience
Two open-source tools, one school network
If your school already runs linuxmuster.net as its server backbone, connecting a second platform is mostly a question of authentication. linuxmuster.net (LMN) stores every account in a Samba4-based Active Directory, queryable over standard LDAP. That’s the same foundation used to hook in Moodle and Nextcloud — and the most natural starting point for DiLer.
How linuxmuster.net handles users
User provisioning in LMN is handled by Sophomorix. It reads student and staff lists from CSV exports produced by your school administration software, then creates, moves, and deletes accounts in the AD. Once accounts exist, external services authenticate against that AD over LDAP.
The standard pattern for any external service is:
- Create a dedicated read-only bind user in the LMN school console for the service you’re connecting — something like
diler-binduser. - Open port 636 (LDAPS) through the OPNsense firewall to the LMN server.
- Point the external application at
ldaps://your-server-hostnamewith those bind-user credentials. - Accept or import the server certificate into the external service’s trust store.
This is exactly how the officially documented Moodle and Nextcloud integrations work. A separate service account per application keeps things clean — if one service is compromised, you rotate just that one credential.
What DiLer is
DiLer (Digitale Lernumgebung) is an open-source school platform that started in 2011, aimed primarily at Gemeinschaftsschulen — the German community school model built around competency-based, self-directed learning. Its headline feature is Kompetenzraster: competency grids where students log and track their own progress across skill areas.
Beyond that it covers a school diary, internal messaging, calendar and timetable, parent access, and reporting. There’s a free Community Edition and a paid Partner Edition. The Partner Edition adds phone and chat support, a moderated forum, and training sessions. Community Edition is a workable starting point for most school admins — but expect to self-diagnose edge cases.
Syncing users: LDAP or CSV?
This is where things get less clear-cut. DiLer’s publicly accessible documentation doesn’t spell out LDAP configuration the way Moodle’s does, so the first step is checking DiLer’s admin backend or source code to confirm whether LDAP authentication is supported at all.
Two approaches, in priority order:
- LDAP bind against the LMN Samba4 AD. If DiLer supports LDAP, this is the cleanest option. Same pattern as Moodle: read-only bind user in LMN, LDAPS on port 636 through the firewall, DiLer pointed at the AD. Students and teachers log in with their existing school credentials — no second password, no manual account creation.
- CSV export from Sophomorix. Sophomorix can export user lists, and DiLer accepts CSV imports. More manual — you’ll need to re-import after each class change or new intake — but it works without any LDAP setup and lets you get DiLer running while you investigate the LDAP path.
If CSV becomes your long-term solution, automate it. A shell script triggered after each Sophomorix run can export the user list and push it to DiLer’s import, so you’re not doing this by hand every September and every mid-year shuffle.
Admin experience
DiLer is self-hosted, and installation targets a standard Linux web server environment. The interface is clearly teacher-first. The admin side is functional, just not particularly modern — some settings take a few clicks to locate.
The Kompetenzraster tooling is well thought out for schools that actually use competency-based progression. Teachers and pedagogy coordinators can create and edit competency grids through the frontend without touching any database or config file. That matters once you hand daily administration to non-IT staff.
Updates on the Community Edition are manual deployments. No one-click upgrade path — plan a maintenance window and read the changelog before touching production. The Partner Edition gets more dedicated testing, which starts to matter if DiLer becomes central to daily school operations.
Running DiLer on a separate VM or container — not on the LMN server itself — is the sensible architecture. It only needs LDAPS access to the AD; it doesn’t need to sit inside the main school LAN segment to authenticate against it.