--- title: "LDAP Settings" slug: "ldap-settings" updated: 2024-09-22T21:18:40Z published: 2024-09-22T21:18:40Z canonical: "docs.processmaker.com/ldap-settings" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.processmaker.com/llms.txt > Use this file to discover all available pages before exploring further. # LDAP Settings > [!TIP] > [**Plan Availability:**](https://www.processmaker.com/products/pricing/) ![Professional](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Standard.png)![Professional](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Professional.png)![Enterprise](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Enterprise.png) ## What is LDAP? Lightweight Directory Access Protocol (LDAP) is a platform protocol used for directory services authentication. LDAP provides the communication language that your server uses to communicate with other directory services servers. Directory services store the users, passwords, and computer accounts, and share that information with your company entity on the network. The LDAP settings ensure your company users log on by authenticating directly into an LDAP server and then enable synchronization with LDAP to update user information. Configure LDAP settings for the following purposes: - Synchronize users in your organization as ProcessMaker users. - Authenticate the server source. - Configure how users and groups synchronize. - [Log on to ProcessMaker Platform](/v1/docs/participant-basics#log-on-to-processmaker-platform) using your LDAP credentials to have a unified login. - Keep using your LDAP credentials after synchronization even if you change a user password in LDAP. ## LDAP Distinguished Names LDAP uses Distinguished Names (DN) to identify users, groups, and other types of entities. The DN describes entities starting from the specific and moving to the general in the hierarchy of entities. In LDAP and [Active Directory](http://technet.microsoft.com/en-us/library/cc977985.aspx), which is Microsoft's extension of LDAP, Distinguished Names are constructed hierarchically using the following components. | Component and Abbreviation | Usage | Example | | --- | --- | --- | | domain components (DC) | Enter each DC as read left to right, each separated by a comma without spacing between each. | `dc=acme,dc=com` | | organizational units (OU) | Enter each OU, each separated by a comma without spacing between each. | `ou=managers,ou=regionalbranch` | | common names (CN) | Enter each CN, each separated by a comma without spacing between each. | `cn=Louis Canera,cn=John Doe` | Other naming attributes described in [RFC 2253](http://tools.ietf.org/html/rfc2253), such as **o=** for organization name and **c=** for country/region name, are not used in Active Directory, although they are recognized by LDAP. > [!NOTE] > For more information how to construct DNs, see [this LDAP guide](http://www.zytrax.com/books/ldap/apa/dn-rdn.html). ## View LDAP Settings Display all [LDAP](/v1/docs/ldap-settings#what-is-ldap) settings in one location. This makes it easy to manage these settings. **Permissions** Your user account or group membership must have the "Settings: View Settings" permission to view LDAP settings unless your user account has the **Make this user a Super Admin** setting selected. See the [Settings](/v1/docs/permission-descriptions-for-users-and-groups#settings) permissions or ask your Administrator for assistance. Follow these steps to view all LDAP settings to synchronize users in your organization: 1. Ensure that you are [logged on](/v1/docs/participant-basics#log-on-to-processmaker-platform) to ProcessMaker Platform. 2. Click the **Admin** option from the top menu. The **Users** page displays. 3. Click the **Settings** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/b08eb696-ac52-4e94-8bfd-fa99e83a422b.png) from the left sidebar to view all settings. 4. From the **Settings** panel on the left, expand the **Log-in & Auth** section. 5. Select **LDAP** to view the following details: - **Setting:** The **Setting** column displays the LDAP Setting name. - **Configuration:** The **Configuration** column displays the setting value and how it is configured. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/c9360c7d-c623-4c69-a176-ec2c33a01d0f.png) LDAP settings to synchronize users in your organization > [!NOTE] > ### Search for an LDAP Setting > > Follow the next steps to search for a setting: > > 1. In the **Search** setting, enter the **Setting** name to filter settings. > 2. Click the **Search** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/a2bf1b9a-d475-488b-80a4-066af80d1fb8.png) or press enter to view LDAP settings that match your entered text. > > ### View LDAP Logs > > Click the **Logs** button to view LDAP logs. For more information, see [View LDAP Logs](/v1/docs/ldap-settings#view-ldap-logs-1). > > ### Edit an LDAP Setting > > Click the **Edit icon** ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/bf7f3272-70d7-410e-b7cb-17cfc6355c97.png) to change a setting. For more information on different LDAP configurations, see [Configure LDAP Settings](/v1/docs/ldap-settings#configure-ldap-settings). > > ### Copy an LDAP Setting > > Click the **Copy to Clipboard** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/a1c3a233-ccea-4b47-b5ef-c97ba7742d45.png) to copy the value of a setting. > > ### Clear an LDAP Setting > > Click the **Clear** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1da7b07f-9703-42ae-9c86-b80aeff6c01d.png) to clear the value of a setting. ## Configure LDAP Settings > [See an example how to configure LDAP for Active Directory](/v1/docs/example-configure-ldap-for-active-directory). **Permissions** Your user account or group membership must have the "Settings: Update Settings" permission to edit LDAP settings unless your user account has the **Make this user a Super Admin** setting selected. See the [Settings](/v1/docs/permission-descriptions-for-users-and-groups#settings) permissions or ask your Administrator for assistance. Configure the following [LDAP](/v1/docs/ldap-settings#what-is-ldap) settings as necessary: - [Enable directory synchronization via LDAP](/v1/docs/ldap-settings#enable-directory-synchronization-via-ldap). - [Set the LDAP synchronization schedule](/v1/docs/ldap-settings#set-the-ldap-synchronization-schedule). - [Set to which LDAP server type to connect](/v1/docs/ldap-settings#set-to-which-ldap-server-type-to-connect). - [Enter the LDAP server address and port number](/v1/docs/ldap-settings#enter-the-ldap-server-address-and-port-number). - [Enable TLS to connect to LDAP](/v1/docs/ldap-settings#enable-tls-to-connect-to-ldap). - [Enter the domain components for the base DN](/v1/docs/ldap-settings#enter-the-domain-components-for-the-base-dn). - [Enter the credentials to connect to LDAP](/v1/docs/ldap-settings#enter-the-credentials-to-connect-to-ldap). - [Select from which LDAP groups and departments to synchronize](/v1/docs/ldap-settings#select-from-which-ldap-groups-and-departments-to-synchronize). - [Enter the LDAP object class that identifies users](/v1/docs/ldap-settings#enter-the-ldap-object-class-that-identifies-users). - [Enter the LDAP object class that identifies groups](/v1/docs/ldap-settings#enter-the-ldap-object-class-that-identifies-groups). - [Map user properties to LDAP attributes](/v1/docs/ldap-settings#map-user-properties-to-ldap-attributes). ### Enable Directory Synchronization via LDAP Enable directory synchronization between ProcessMaker and your LDAP server. If not enabled, ProcessMaker Platform does not synchronize with your LDAP server. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Enabled** toggle key. This is a required setting to use LDAP with ProcessMaker Platform. ### Set the LDAP Synchronization Schedule Set at which interval to synchronize with your LDAP server. Consider that when setting this interval, the more users, groups, and/or departments your LDAP server contains, the more time ProcessMaker Platform requires to synchronize your LDAP server. Follow these steps to set how often to synchronize between your LDAP server and ProcessMaker Platform: 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Synchronization Schedule** setting. The **Synchronization Schedule** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/91d8c8a7-c906-4518-b185-a9f37af246d3.png) 2. In the **Quantity** setting, enter how many times to synchronize for each configured frequency. **1** is the default setting. 3. In the **Frequency** setting, select the frequency in which to synchronize from the following options: - **Minutes** (default setting) - **Hours** - **Days** 4. Click **Save**. ### Set to Which LDAP Server Type to Connect Follow these steps to select to which LDAP server type ProcessMaker Platform connects to synchronize: 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Type** setting. The **Type** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/6532f73e-7f32-4516-87c4-80596e1784fe.png) 2. Select to which LDAP server type ProcessMaker Platform connects to synchronize: - [**Active Directory**](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-domain-services) (default setting) - [**389 Directory Server**](https://directory.fedoraproject.org/) - [**OpenLDAP**](https://www.openldap.org/) 3. Click **Save**. ### Enter the LDAP Server Address and Port Number Follow these steps to enter the LDAP server address and port to which ProcessMaker Platform synchronizes: 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Server Address** setting. The **Server Address** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/60067a95-79cf-4b63-838a-7196109d616d.png) 2. Enter the IP address or hostname for the LDAP server to which ProcessMaker Platform synchronizes. 3. Click **Save**. 4. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Server Port** setting. The **Server Port** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/b4a04b1c-5495-4d6c-b9a7-3d5d9981933c.png) 5. Enter the port number the LDAP server uses. By default, LDAP uses port 389. If unsure, use one of the following commands depending on your LDAP server's operating system: - **Linux/UNIX:** `netstat -l` and `netstat -lnp` - **Windows:** `netstat -a` and `netstat -ab` commands 6. Click **Save**. ### Enable TLS to Connect to LDAP If your LDAP server uses a Transport Security Layer (TLS) certificate, enable TLS to connect to the LDAP authentication source. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), enable the **TLS** toggle key. The following message displays: **The setting was updated.** ### Enter the Domain Components for the Base DN Enter the Distinguished Name (DN) from the Base object to connect the LDAP server. In most cases, the DN are the domain components (DC) of the DN. For example, the Base DN for `processmaker.com` is `dc=processmaker,dc=com`. For more information how to construct DNs, see [this LDAP guide](http://www.zytrax.com/books/ldap/apa/dn-rdn.html). Follow these steps to enter the domain components (DC) for the base Distinguished Name (DN): 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Base DN** setting. The **Base DN** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/d03e5df5-32fa-4a48-8109-71769387fe4d.png) 2. Enter each DC of the Base DN following the guidelines above. 3. Click **Save**. ### Enter the Credentials to Connect to LDAP Follow these steps to enter the credentials to connect to the LDAP server: 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Username** setting. The **Username** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/dafbad10-135d-417f-b6dc-2d6bc0286fe9.png) 2. Enter the username to log on to the LDAP server. 3. Click **Save**. 4. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Password** setting. The **Password** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/28302922-9701-4f1d-96d9-bae09842eb0c.png) 5. Enter the password to log on to the LDAP server. 6. Click **Save**. The following message displays: **The setting was updated.** ### Select from Which LDAP Groups and Departments to Synchronize Select which LDAP groups and departments to synchronize as ProcessMaker Platform groups. During synchronization, the following occurs: - ProcessMaker Platform groups that do not exist are created. - If a selected LDAP group or department contains no LDAP users, then a corresponding ProcessMaker Platform group is not created if it does not already exist. - ProcessMaker Platform users that exist synchronize from your LDAP server and are placed into the groups corresponding with your selected LDAP server group(s) or department(s). - ProcessMaker Platform users that do not already exist but exist in your selected LDAP group(s) or department(s) are created. **Requirements** Ensure that you have configured at least the following LDAP settings to connect with your LDAP server prior to selecting which LDAP groups to synchronize. Otherwise, no LDAP groups are available to synchronize when editing this setting. - [Enable directory synchronization via LDAP](/v1/docs/ldap-settings#enable-directory-synchronization-via-ldap). - [Set to which LDAP server type to connect](/v1/docs/ldap-settings#set-to-which-ldap-server-type-to-connect). - [Enter the LDAP server address and port number](/v1/docs/ldap-settings#enter-the-ldap-server-address-and-port-number). - [Enable TLS if your LDAP server uses a Transport Security Layer (TLS) certificate](/v1/docs/ldap-settings#enable-tls-to-connect-to-ldap). - [Enter the domain components for the base Distinguished Name](/v1/docs/ldap-settings#enter-the-domain-components-for-the-base-dn). - [Enter the credentials to connect to LDAP](/v1/docs/ldap-settings#enter-the-credentials-to-connect-to-ldap). Follow these steps to select which LDAP groups or departments to synchronize as ProcessMaker Platform groups: 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Groups to Import** setting. The **Groups To Import** screen displays the LDAP groups on your LDAP server. If your LDAP server contains no LDAP groups, this screen displays no groups with which to synchronize. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/49bb3a27-c418-4fe8-88d4-0e71e1ec1897.png) 2. Enable the toggle key for each LDAP group to synchronize as ProcessMaker Platform groups. 3. Click **Save**. 4. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Departments To Import** setting. The **Departments To Import** screen displays the LDAP departments. If your LDAP server contains no LDAP departments, this screen displays no departments with which to synchronize. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/bea771db-bf03-4dbe-b8d0-8c82c0f6dc67.png) 5. Enable the toggle key for each LDAP department to synchronize as ProcessMaker Platform groups. 6. Click **Save**. ### Enter the LDAP Object Class That Identifies Users Enter the LDAP object class that identifies users. Objects that match the object class synchronize with users that exist in your ProcessMaker Platform instance. During synchronization the following occurs: - LDAP groups that contain LDAP users and match the entered LDAP object class synchronize. - LDAP groups that do not contain LDAP users do not synchronize, regardless if they match the entered LDAP object class. Follow these steps to enter the LDAP object class that identifies users: 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **User Class Identifier** setting. The **User Class Identifier** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/3828ff0c-7591-48ec-8d63-ec12c861cb51.png) 2. Enter the LDAP object class that identifies users. Follow these guidelines depending on which [LDAP server type your LDAP server uses](/v1/docs/ldap-settings#set-to-which-ldap-server-type-to-connect): - **Active Directory:** Enter `samaccountname`. - **Open LDAP:** Enter `uid`. - **If unsure which object class to use:** Enter `*`. Synchronization is slower because all object classes are evaluated. 3. Click **Save**. ### Enter the LDAP Object Class That Identifies Groups Enter the LDAP object class that identifies groups. Objects that match the object class synchronize with groups that exist in your ProcessMaker Platform instance. ProcessMaker Platform groups that do not already exist are created from your LDAP server. Follow these steps to enter the LDAP object class that identifies groups: 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Group Class Identifier** setting. The **Group Class Identifier** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/0b8ef0b1-5bd1-4437-971c-f7dc733fc2c2.png) 2. Enter the LDAP object class that identifies groups. 3. Click **Save**. ### Map User Properties to LDAP Attributes Map how ProcessMaker Platform user properties correspond with synchronized LDAP attributes. See `_user` Magic Variable for ProcessMaker Platform user properties. Consider the following examples. | ProcessMaker User Property | User Property Function | Mapped LDAP Attribute | | --- | --- | --- | | `FirstName` | User's first name | `Name` | | `UserName` | User's user name | `SameAccountName` | Follow these steps to map how ProcessMaker Platform user properties correspond with LDAP attributes: 1. In [your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings), click the **Edit** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/1fda6f3c-3421-4d86-8810-e7d7f79c21ac.png) for the **Variable Map** setting. The **Variable Map** screen displays. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/7d97520d-9e16-468d-9356-26bc4de1cce3.png) 2. Follow these guidelines to map a ProcessMaker Platform user properties to an LDAP attribute: 1. Click the **+Add** button. A new row displays the existing mapped user properties. 2. In the **ProcessMaker Property** setting, enter the ProcessMaker Platform user property to which to map the LDAP attribute. 3. In the **LDAP Attribute** setting, enter the LDAP attribute from which to map to the ProcessMaker Platform user property. 4. Optionally, click the **Delete** icon ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/11c9bf6c-0ae3-4fc0-8dd8-b4980b191422.png) to delete a mapped ProcessMaker Platform user property. 3. Click **Save**. ## View LDAP Logs Display LDAP logs of LDAP user, group and/or department that have currently synchronized. **Permissions** Your user account or group membership must have the "Settings: Update Settings" permission to view LDAP logs unless your user account has the **Make this user a Super Admin** setting selected. See the [Settings](/v1/docs/permission-descriptions-for-users-and-groups#settings) permissions or ask your Administrator for assistance. Follow these steps to view LDAP logs: 1. [View your LDAP Settings](/v1/docs/ldap-settings#view-ldap-settings). The **LDAP** tab displays. 2. Click the **Logs** button. The **Logs** page displays all the LDAP synchronization logs. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/image(1).avif) LDAP Logs The **Logs** page displays the following information in tabular format about LDAP logs: - **ID:** The **ID** column displays the log ID used to identify this synchronization log. - **Tag:** The **Tag** column displays the synchronization type among LDAP Users, Groups, or Departments. - **Service:** The **Service** column displays **LDAP** as the service type the log applies. - **Message:** The **Message** column displays the synchronization status, the number of updated records, and the number of new registers after synchronization occurs. - **Created:** The **created** column displays the date and time when synchronization occurred.