LDAP User Management

GermainUX can authenticate Workspace users through an LDAP directory and map their LDAP group memberships to GermainUX Roles.

🔗 LDAP integration overview

LDAP integration allows organizations to:

Capability
Manage users centrally in an existing directory
Authenticate users with their directory credentials
Map LDAP groups to GermainUX Roles
Apply GermainUX permissions without creating separate passwords
Revoke Workspace access through the directory

⚙️ Before You Begin

Obtain the following information from your LDAP administrator:

Item
LDAP server URL
Service-account distinguished name and password
User and group search bases
User and group search filters
Group attribute containing the GermainUX Role name

Use an encrypted LDAPS connection whenever supported. The LDAP service account should have only the permissions required to search users and groups.

🔧 Configure LDAP Authentication

Log in to the Germain Workspace as an administrator.
Go to System > Auth Settings > Authentication.
Click Add New Configuration.
Select LDAP Provider.
Click Next.
Configure the LDAP provider fields.
Click Finish.

📋 LDAP Provider Settings

Field	Description
Provider Name	Unique label used to identify the LDAP authentication provider.
LDAP Server URL	Address of the LDAP server—for example, `ldaps://ldap.example.com:636`.
Manager DN	Distinguished name of the service account GermainUX uses to search the directory—for example, `cn=germain-service,ou=services,dc=example,dc=com`.
Manager Password	Password associated with the Manager DN account.
User Search Base	Directory location under which GermainUX searches for users—for example, `ou=users,dc=example,dc=com`.
Group Search Base	Directory location under which GermainUX searches for groups—for example, `ou=groups,dc=example,dc=com`.
User Search Filter	LDAP filter used to match the submitted username to a directory user.
Group Search Filter	LDAP filter used to find the groups associated with the authenticated user.
Group Role Attribute	Group attribute whose value is mapped to a GermainUX Role, commonly `cn`.

cn={0}

{0} represents the username entered on the GermainUX login page. This example searches for a user whose cn attribute matches that username.

Another commonly used filter is:

uid={0}

Use the attribute that represents the login identifier in your directory.

member={0}

In this example, GermainUX identifies groups whose member attribute contains the authenticated user’s distinguished name.

The exact filter depends on the directory structure and LDAP implementation used by your organization.

🗺️ Configure Role Mapping

GermainUX uses the value returned by Group Role Attribute to map LDAP groups to GermainUX Roles.

For example, if an LDAP group has:

cn=germain_apm_admin

GermainUX maps the user to the Role named:

germain_apm_admin

The corresponding Role must exist in GermainUX.

To review or create Roles, go to:

Germain Workspace > Left Menu > System > Auth Settings > User Roles

Ensure that:

Check
LDAP group names match the corresponding GermainUX Role names
Each Role has the appropriate permissions
Users belong to the required LDAP groups
Role names use consistent capitalization and spelling

👥 Manage LDAP Users

Create, update, disable, and remove users through your LDAP directory.

To grant a user GermainUX access:

Create or identify the user in LDAP.
Add the user to the appropriate LDAP group.
Ensure that a matching Role exists in GermainUX.
Ask the user to log in with their LDAP credentials.

To revoke access, remove the user from the mapped group or disable the directory account.

🔑 Log In

Open the GermainUX login page.
Enter the LDAP username and password.
GermainUX authenticates the credentials against LDAP.
GermainUX retrieves the user’s group memberships.
Matching GermainUX Roles determine the user’s permissions.
After successful authentication, the Germain Workspace opens.

✅ Validate the Configuration

Test the integration with a non-administrator LDAP account.

Confirm that:

Validation
Valid LDAP credentials allow the user to log in
Invalid credentials are rejected
LDAP groups map to the expected GermainUX Roles
The user can access only the authorized features
Removing the user from a mapped group removes the corresponding permissions

Service: Authentication

Feature Availability: 8.6.0 or later