LDAP

Phase 1 preview — pages render fixture data only; no changes are saved.

LDAP is enabled. The saved configuration is complete. This is a preview: no sign-in uses it yet.

Connection

Enable LDAP sign-in

When on, people sign in against the directory; a first successful sign-in creates the local user.

LDAP server

Must start with ldap:// or ldaps://. Include the port in the URL (for example ldaps://host:636).

Use STARTTLS

Ignore server certificate errors

Unsafe: accepts any certificate. Use only to diagnose a trust problem.

Client certificate

None stored

Client certificate key

Not configured

Write-only. Must be saved together with the certificate.

Bind username

The DN the service account binds as. Leave empty only when using a client certificate (SASL EXTERNAL).

Bind password

Configured

Write-only. The stored password is never shown; leave blank to keep it.

Search & sign-in

Base bind DN

Where searches start. Must not equal the bind username.

LDAP filter

Must not start with an opening bracket (for example objectClass=person).

Username field

Lower-case only: samaccountname, not sAMAccountName.

Authentication filter query

Used to find a person at sign-in, for example samaccountname= . Not uid=samaccountname.

Active Directory

Changes how the sign-in DN and the active state are derived.

Attribute mapping

Directory attribute names that fill each user field. Leave a field blank to skip it.

First name

The attribute holding the first name is required.

Last name

Display name

Employee number

Phone

Mobile

Job title

Department

Location

Manager

Address

City

State

Postal code

Country

Active flag

Blank: Active Directory uses the account-control flags; otherwise the active state is left unchanged.

Invert the active flag

For directories where the flag means disabled.

Sync & login

Store the entered password locally

On: the password typed at sign-in is saved (hashed) so local login keeps working. Off: no local password is kept.

Default permission group

Newly created LDAP users are added to this group.

Custom forgot-password URL

Where "forgot password" points when passwords are managed in the directory.

Cancel Saving settings is not available in Phase 1 — this screen previews the current configuration.

Good to know

Both the test login and the test sync read the SAVED settings, so settings must be saved first. They are limited to five attempts a minute.

A sync is run with the snipeit:ldap-sync command (or from the Users screen); it is not scheduled automatically.

The older single-page form and the wizard edit the same settings; the wizard is the one the settings hub links to.