|
| 1 | +--- |
| 2 | +sidebar_position: 4 |
| 3 | +tags: |
| 4 | + - Enterprise |
| 5 | +--- |
| 6 | + |
| 7 | +# LDAP |
| 8 | +**Edition:** Enterprise |
| 9 | + |
| 10 | +## Overview |
| 11 | + |
| 12 | +Docmost supports LDAP (Lightweight Directory Access Protocol) authentication, allowing users to sign in using their existing corporate directory credentials. |
| 13 | + |
| 14 | +## Key Features |
| 15 | +- **Single Sign-On (SSO)**: Users can authenticate using their LDAP credentials |
| 16 | +- **Automatic User Provisioning**: New users are automatically created upon first login (if enabled) |
| 17 | +- **Group Sync**: Sync user group memberships from LDAP to Docmost on user login |
| 18 | + |
| 19 | +## Configuration |
| 20 | + |
| 21 | +### Setting Up LDAP Provider |
| 22 | + |
| 23 | +To configure LDAP authentication in your workspace: |
| 24 | + |
| 25 | +1. Navigate to **Workspace Settings** → **Security & SSO** |
| 26 | +2. Click on create and Select **LDAP / Active Directory** from the options |
| 27 | +3. Configure the following settings: |
| 28 | + |
| 29 | +<p align="center"> |
| 30 | +<img src="/docs/img/ldap-auth.png" width="800"/> |
| 31 | +</p> |
| 32 | + |
| 33 | + |
| 34 | +#### Basic Configuration |
| 35 | + |
| 36 | +| Field | Description | Example | |
| 37 | +|-------|-------------|---------| |
| 38 | +| **Display Name** | A friendly name for the LDAP provider | `Company LDAP` | |
| 39 | +| **LDAP Server URL** | The URL of your LDAP server | `ldap://ldap.example.com:389` or `ldaps://ldap.example.com:636` | |
| 40 | +| **Bind DN** | Distinguished Name of the service account used for searching | `cn=admin,dc=example,dc=com` | |
| 41 | +| **Bind Password** | Password for the service account | `••••••••` | |
| 42 | +| **Base DN** | Base Distinguished Name where user searches will start | `ou=users,dc=example,dc=com` | |
| 43 | +| **User Search Filter** | LDAP filter to find users (uses `{{username}}` as placeholder) | `(mail={{username}})` or `(uid={{username}})` | |
| 44 | + |
| 45 | +##### Additional Options |
| 46 | + |
| 47 | +- **Group Sync**: Enable automatic synchronization of LDAP groups to Docmost groups |
| 48 | +- **Allow Signup**: Allow new users to be automatically provisioned on first login |
| 49 | +- **Enabled**: Toggle to enable/disable the LDAP provider |
| 50 | + |
| 51 | +## User Authentication Flow |
| 52 | + |
| 53 | +1. User clicks on the LDAP login option on the sign-in page |
| 54 | +2. User enters their LDAP username and password |
| 55 | +3. Docmost performs the following steps: |
| 56 | + - Binds to LDAP server using configured service account |
| 57 | + - Searches for the user using the configured search filter |
| 58 | + - Validates user credentials by attempting to bind as the user |
| 59 | + - Retrieves user attributes (email, name, groups) |
| 60 | + - Creates or updates the user account in Docmost |
| 61 | + - Syncs group memberships (if enabled) |
| 62 | + |
| 63 | +## Group Synchronization |
| 64 | + |
| 65 | +### How Group Sync Works |
| 66 | + |
| 67 | +When group synchronization is enabled, Docmost automatically manages user group memberships based on their LDAP group associations. |
| 68 | + |
| 69 | +⚠️ **Groups must be pre-created in Docmost**: LDAP group synchronization does NOT create new groups. You must manually create groups in Docmost with names that match your LDAP group names. |
| 70 | + |
| 71 | +### Setting Up Group Sync |
| 72 | + |
| 73 | +1. **Create Groups in Docmost**: |
| 74 | + ``` |
| 75 | + Example LDAP Groups: |
| 76 | + - CN=Engineering,OU=Groups,DC=example,DC=com |
| 77 | + - CN=Marketing,OU=Groups,DC=example,DC=com |
| 78 | + - CN=HR-Team,OU=Groups,DC=example,DC=com |
| 79 | + |
| 80 | + Create corresponding Docmost groups: |
| 81 | + - Engineering |
| 82 | + - Marketing |
| 83 | + - HR-Team |
| 84 | + ``` |
| 85 | + Learn more about Docmost [Groups Documentation](/user-guide/groups). |
| 86 | + |
| 87 | +2. **Enable Group Sync** in the LDAP provider configuration |
| 88 | + |
| 89 | +## Search Filter Examples |
| 90 | + |
| 91 | +The user search filter determines how Docmost finds users in your LDAP directory. Use `{{username}}` as a placeholder for the username entered during login. |
| 92 | + |
| 93 | +## Integration with Multi-Factor Authentication |
| 94 | + |
| 95 | +LDAP authentication fully supports Docmost's MFA feature: |
| 96 | + |
| 97 | +- Users can enable MFA after initial LDAP login |
| 98 | +- MFA challenges are presented after successful LDAP authentication |
| 99 | +- MFA settings are managed per-user in Docmost, not in LDAP |
| 100 | +- A workspace admin can enforce MFA for all users. |
| 101 | + |
| 102 | +## Things to Consider |
| 103 | + |
| 104 | +### Existing Users |
| 105 | + |
| 106 | +When enabling LDAP for a workspace with existing users: |
| 107 | + |
| 108 | +1. Users with matching email addresses will be linked to their LDAP accounts |
| 109 | +2. LDAP login will update their profile with LDAP attributes, and sync groups (if group sync is enabled) |
| 110 | + |
| 111 | +### Deactivating LDAP |
| 112 | +If you need to disable LDAP: |
| 113 | + |
| 114 | +1. Existing LDAP users retain their Docmost accounts |
| 115 | +2. Users will need password resets to regain access |
| 116 | +3. Group memberships remain unchanged until manually modified |
| 117 | + |
| 118 | +## Troubleshooting |
| 119 | + |
| 120 | +### Common Issues and Solutions |
| 121 | + |
| 122 | +| Issue | Possible Cause | Solution | |
| 123 | +|-------|---------------|----------| |
| 124 | +| "LDAP server bind credentials are invalid" | Incorrect bind DN or password | Verify service account credentials | |
| 125 | +| "Invalid LDAP username or password" | User credentials incorrect or user not found | Check user search filter and user's LDAP entry | |
| 126 | +| Groups not syncing | Groups don't exist in Docmost | Pre-create groups in Docmost with matching names | |
| 127 | +| Users can't log in | LDAP provider disabled or misconfigured | Verify provider is enabled and URL is correct | |
| 128 | +| TLS connection fails | Certificate validation issues | Check CA certificate configuration | |
| 129 | + |
0 commit comments