Governance and security
LDAP and Active Directory
Sync users and nested groups from Active Directory, OpenLDAP or any LDAP directory, and optionally let people sign in with their directory password.
Connect
Settings → SSO & Directory → LDAP / Active Directory → Connect. You need:
- Server URL:
ldaps://dc1.corp.example.com:636(TLS from the start), orldap://…:389with Use StartTLS. Plain LDAP works but is flagged: the bind password and directory data cross the network unencrypted. - CA certificate (PEM) when the server's certificate is issued by your own CA; the system's roots are used otherwise. Verify the server certificate stays on unless you are testing. Set Certificate host name when it differs from the URL host.
- Bind DN and password of a read-only service account (
CN=svc-usertasks,OU=Service Accounts,DC=corp,DC=example,DC=com, orsvc-usertasks@corp.example.comfor Active Directory). - Base DN, optionally separate bases for users and groups.
Test connection connects, binds, reads the base DN and counts users and groups with your filters, showing five mapped users and warnings (no email attribute, no stable id, unencrypted). The connection is tested again when you save.
Directory types and attribute mapping
| Active Directory | OpenLDAP | Other (389 DS, FreeIPA, lldap) | |
|---|---|---|---|
| User filter | (&(objectCategory=person)(objectClass=user)) | (objectClass=inetOrgPerson) | (|(objectClass=inetOrgPerson)(objectClass=person)) |
| Group filter | (objectClass=group) | groupOfNames, groupOfUniqueNames, posixGroup | the same plus group |
| Id | objectGUID | entryUUID | entryUUID |
| Username / email / name | sAMAccountName / mail (else userPrincipalName) / displayName | uid / mail / displayName | the same |
| Disabled users | userAccountControl ACCOUNTDISABLE bit | — (remove them from the filter) | — |
Every filter and attribute can be overridden under TLS, search and attribute mapping options — e.g. a user filter of (&(objectCategory=person)(objectClass=user)(memberOf=CN=UserTasks,OU=Groups,DC=corp,DC=example,DC=com)) syncs one group's members only. Searches are paged (500 entries per page).
Groups
Groups become teams. With Nested groups count as members (the default), members of a nested group are members of the parent: Active Directory resolves this server-side with LDAP_MATCHING_RULE_IN_CHAIN (1.2.840.113556.1.4.1941); other directories by following member / uniqueMember DNs (cycles are safe), and memberUid lists usernames.
Full and delta syncs
The first sync, a daily one, any sync after you change the settings, and Full sync read every user. In between, only users changed since the last run are read: Active Directory by uSNChanged (the cursor is the domain controller's highestCommittedUSN; keep the URL pointing at the same DC), other directories by modifyTimestamp. Groups are read in full on every run. A full sync also deactivates linked users the user filter no longer returns (Deactivate users that leave the directory, on by default) — unless it returned nobody, so a broken filter cannot lock everyone out.
Bind login
With Let users sign in with their directory password (built-in auth only), the organisation's login page checks passwords against the directory:
- the service account finds the entry whose
mail,userPrincipalName(AD) or username equals what was typed (one enabled entry, value escaped); - UserTasks binds as that entry's DN with the password, on a separate connection (an empty password is refused before it reaches the server);
- the linked account — or the account with that email, or a new one when accounts are created automatically — is signed in.
Names the directory doesn't know (and an unreachable directory) fall through to the normal password login, so local accounts such as a break-glass admin keep working. A directory user with a wrong password is refused without trying a local password. Attempts are rate limited per IP and per name.