---
title: "LDAP for Active Directory"
slug: "example-configure-ldap-for-active-directory"
updated: 2025-06-26T21:28:48Z
published: 2025-06-26T21:28:48Z
canonical: "docs.processmaker.com/example-configure-ldap-for-active-directory"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.processmaker.com/llms.txt
> Use this file to discover all available pages before exploring further.

# LDAP for Active Directory

Configure LDAP settings for Microsoft Active Directory.

## Overview

The LDAP for Microsoft [Active Directory](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-domain-services) configuration allows ProcessMaker Platform users to log on by authenticating directly into a Microsoft Active Directory server.

## Considerations when Configuring LDAP for Active Directory

Consider the following:

- For security reasons, do not use anonymous connections.
- ProcessMaker Platform does not support sub-groups or sub-departments. Therefore, user groups cannot be organized hierarchically, and nested groups or departments cannot be created.

## Configure LDAP for Microsoft Active Directory

Follow these steps to configure LDAP for Microsoft [Active Directory](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-domain-services):

1. [View your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings). The **LDAP** tab displays.
2. Enable the **Enabled** toggle key to always synchronize your Active Directory whenever your hierarchy of entities changes to keep ProcessMaker Platform synchronized.
3. From the **Synchronization Schedule** setting, set at which interval to synchronize with your Active Directory server. Consider that when setting this interval, the more users, groups, and/or departments your Active Directory server contains, the more time ProcessMaker Platform requires to synchronize your Active Directory server. Follow these steps:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Synchronization Schedule** setting. The **Synchronization Schedule** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/4fed750d-88c9-4b6e-8d9f-fcac63b76396.png)
  2. In the **Quantity** setting, enter how many times to synchronize for each configured frequency. **1** is the default setting.
  3. In the **Frequency** setting, select the frequency in which to synchronize from the following options:

    - **Minutes** (default setting)
    - **Hours**
    - **Days**
  4. Click **Save**. The following message displays: **The setting was updated.**
4. From the **Type** setting, select to which LDAP server type ProcessMaker Platform connects to synchronize as follows:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Type** setting. The **Type** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/2e914b44-1ab8-430d-a3c9-7b4b4d8d6bf9.png)
  2. Select the **Active Directory** option**.**
  3. Click **Save**. The following message displays: **The setting was updated.**
5. From the **Server Address** setting and the **Server Port** setting configure as follows:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Server Address** setting. The **Server Address** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/c91bf7ee-7a82-4d06-921b-6736f9df0d55.png)
  2. Enter the Active Directory IP address or hostname to which ProcessMaker Platform synchronizes.
  3. Click **Save**. The following message displays: **The setting was updated.**
  4. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Server Port** setting. The **Server Port** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/e6624b35-0127-47a3-a75c-8933cdf14ea4.png)
  5. Enter the port number the Active Directory server uses. By default, Active Directory uses port 389.
  6. Click **Save**. The following message displays: **The setting was updated.**
6. Active Directory uses Transport Security Layer (TLS) to connect to the Authentication Source. Then enable the **TLS** toggle key. The following message displays: **The setting was updated.**
7. From the **Certificate** setting, upload the Active Directory certificate file that will be stored on ProcessMaker Platform. For more information about how to get your Active Directory certificate, see [Obtain an Active Directory certificate](https://learn.microsoft.com/en-us/system-center/scom/obtain-certificate-windows-server-and-operations-manager?view=sc-om-2022&tabs=Enterp%2CEnter#request-a-certificate-using-a-request-file).
8. Active Directory uses [distinguished names](/v1/docs/ldap-settings#ldap-distinguished-names) (dn) to identify users, groups, and other types of entities.

The distinguished name describes entities starting from the specific and moving to the general in the hierarchy of entities. For example: `cn=John Doe,ou=managers,ou=regionalbranch,dc=acme,dc=com `Then, configure distinguished names as follows:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Base DN** setting. The **Base DN** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/fa4c6e08-2959-4480-83b9-7b702a01996e.png)
  2. Enter each DC of the Base DN following the guidelines above.
  3. Click **Save**. The following message displays: **The setting was updated.**
9. Enter Active Directory credentials as follows:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Username** setting. The **Username** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/2dabcf98-b512-4136-89e6-f2726f725767.png)
  2. Enter the username to log on to the Active Directory server.
  3. Click **Save**. The following message displays: **The setting was updated.**
  4. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Password** setting. The **Password** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/f93e8270-bd70-4e98-84c9-7be9d4029462.png)
  5. Enter the password to log on to the Active Directory server.
  6. Click **Save**. The following message displays: **The setting was updated.**
10. Select which groups and departments to synchronize as ProcessMaker Platform groups. Ensure to have the correct previous settings to select groups and departments:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Groups To Import** setting. The **Groups To Import** screen displays the Active Directory groups on your Active Directory server. If your Active Directory server contains no Active Directory groups, this screen displays no groups with which to synchronize.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/f482d291-4667-44c3-bba9-690fcafa6547.png)
  2. Enable the toggle key for each Active Directory group to synchronize as ProcessMaker Platform groups.
  3. Click **Save**. The following message displays: **The setting was updated.**
  4. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Departments to Import** setting. The **Departments To Import** screen displays the Active Directory departments on your Active Directory server. If your Active Directory server contains no Active Directory departments, this screen displays no departments with which to synchronize.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/d95a65df-7343-48cd-8723-04f31303bac1.png)
  5. Enable the toggle key for each Active Directory department to synchronize as ProcessMaker Platform groups.
  6. Click **Save**. The following message displays: **The setting was updated.**
11. From the **User Identifier** setting, enter the Active Directory parameter used to identify users as follows:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **User Identifier** setting. The **User Identifier** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/6aed4e89-937c-46c3-aed3-dc91120f2926.png)
  2. Enter `samaccountname` that identifies Active Directory users in ProcessMaker Platform. If unsure, enter `*`. Synchronization is slower because all object classes are evaluated.
  3. Click **Save**. The following message displays: **The setting was updated.**
12. From the **Group Identifier** setting, enter the Active Directory parameter used to identify groups as follows:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Group Identifier** setting. The **User Identifier** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/e203861e-2f36-45f1-9732-2e072f6e1f08.png)
  2. Enter `cn` that identifies Active Directory groups in ProcessMaker Platform. If unsure, enter `*`. Synchronization is slower because all object classes are evaluated.
  3. Click **Save**. The following message displays: **The setting was updated.**
13. From the **Variable Map** setting, map ProcessMaker Platform user properties to Active Directory attributes as follows:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Variable Map** setting. The **Variable Map** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/6a87e2b1-060e-46f8-8cb9-bf44bdbbc7f2.png)
  2. Follow these guidelines to map a ProcessMaker Platform user properties to an Active Directory attribute:

    1. Click the **+Add** button. A new row displays the existing mapped user properties.
    2. In the **ProcessMaker Property** setting, enter the ProcessMaker Platform user property to which to map the Active Directory attribute. Select the properties in the following order:

      1. email
      2. firstname
      3. lastname
      4. username
    3. In the **LDAP Attribute** setting, enter the Active Directory attribute from which to map to the ProcessMaker Platform user property. Enter attributes in the following order:

      1. mail
      2. givenname
      3. sn
      4. samaccountname
    4. Click **Save**. The following message displays: **The setting was updated.**
14. From the **Chunk Size For User Import** setting, enter the number of users that will be imported simultaneously as follows:
  1. Click the **Edit** icon![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/35d3224a-1d80-470f-ba12-5ca154d51cb7.png)for the **Chunk Size For User Import** setting. The **Chunk Size For User Import** screen displays.

![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/2825c39b-5785-43ec-9326-cb8a85ee8ac2.png)
  2. Enter the number of users. It is recommended 500 as the maximum.
  3. Click **Save**. The following message displays: **The setting was updated.**