Note: Make sure the uid attribute is properly configured on the LDAP server for target group members. The attribute will be used as the login username of the system.

1.Log in to the System Management page.

2.In the System Management page, click User Accounts > External Authentication.

3.Click Add LDAP Authentication. A Wizard is opened to guide you through the steps to connect to the LDAP server and configure the tenant or domain access privileges for the imported user accounts.

1)Enter a unique name to identify the LDAP server and a brief description.

2)Enter the credentials to connect to the LDAP server. See LDAP Server Settings for more details.

3)Click Show Group to find available user groups from the LDAP server. All matched groups are listed in the Groups pane.

4)Select one or more user groups to import, and then click Next.

Tip: Click Validate to verify whether the selected groups still exist on the LDAP server. Click the icon to remove an invalid group from the list.

5)Assign domain access and more privileges to the user accounts in the selected groups one by one.

▪System Admin — click to assign the system administrator role to the user accounts. For the detailed privileges of System Management and User Management, refer to Featured Management Privileges.

▪Tenant Access — select one or more tenants to assign access permissions to the user accounts.

▪Tenant Admin — select one or more tenants to assign the tenant administrator role to the user accounts.

▪Allowed to Create Domain — select the check box to assign the domain creation permission to the user accounts.

▪Domain Access — select one or more domains to assign access permissions to the user accounts.

▪Domain Privileges — click Assign Privileges to assign more domain privileges to the user accounts by role. See Share Policy for more details.

6)Click Save.

7)In the pop-up dialog, enter the username and password of a user account under the specified server address or user root and click Verify to authenticate the connection.

8)Click OK in the pop-up dialog.

4.Navigate to the Users tab and click Synchronize With LDAP/AD Server to immediately load the user accounts imported from the LDAP server. Alternately, the user accounts can also be automatically synchronized after the first-time login.

Note: The synchronization only carries out on the enabled authentications. If you add a new user account to the selected group on the LDAP server after the synchronization, the user can immediately log in to the specified domains with the assigned roles and privileges. If you delete any user accounts from the LDAP server, the changes will not be synchronized with the system automatically. You have to manually remove them from the system.

Note: To prevent the assigned roles and privileges of an external user account from being synced with any changed authentication settings, you can lock the user rights as follows. See Creating User Account for more details.

LDAP/AD Server Settings

The following table lists the credentials that are required when connecting to an LDAP/AD server.

 

 

See also:

▪Defining User Roles

▪Roles and Privileges