> ## Documentation Index
> Fetch the complete documentation index at: https://docs.germainux.com/llms.txt
> Use this file to discover all available pages before exploring further.

# LDAP User Management

> Connect GermainUX to LDAP to manage user authentication and access centrally.

Service
`Authentication`

Availability
8.6.0 or later

> [!NOTE]
>
> GermainUX can authenticate Workspace users through an LDAP directory and map their LDAP group memberships to GermainUX Roles.

> [card] [LDAP integration overview](#ldap-integration-overview)
>
> Benefits of LDAP integration

> [card] [LDAP Provider Settings](#ldap-provider-settings)
>
> Directory connection options

> [card] [Configure Role Mapping](#configure-role-mapping)
>
> Map LDAP groups to roles

> [card] [Validate the Configuration](#validate-the-configuration)
>
> Test with a standard account

## LDAP integration overview

LDAP integration allows organizations to:

* Manage users centrally in an existing directory
* Authenticate users with their directory credentials
* Map LDAP groups to GermainUX Roles
* Apply GermainUX permissions without creating separate passwords
* Revoke Workspace access through the directory

## Before You Begin

Obtain the following information from your LDAP administrator:

* LDAP server URL
* Service-account distinguished name and password
* User and group search bases
* User and group search filters
* Group attribute containing the GermainUX Role name

Use an encrypted LDAPS connection whenever supported. The LDAP service account should have only the permissions required to search users and groups.

## Configure LDAP Authentication

1. Log in to the Germain Workspace as an administrator.
2. Go to **System > Auth Settings > Authentication**.
3. Click **Add New Configuration**.
4. Select **LDAP Provider**.
5. Click **Next**.
6. Configure the LDAP provider fields.
7. Click **Finish**.

   ![LDAP User Management: Configure LDAP Authentication](https://mintcdn.com/germain-ux/S6CZjLTFu68xyZFG/images/main/ldap-user-management/Screenshot-2023-08-10-at-13.59.26.png?fit=max\&auto=format\&n=S6CZjLTFu68xyZFG\&q=85\&s=9f6d2c80d04e4d4d6fec0310a3508ff2)

## LDAP Provider Settings

| Field | Description |
| - | - |
| **Provider Name** | Unique label used to identify the LDAP authentication provider. |
| **LDAP Server URL** | Address of the LDAP server—for example, `ldaps://ldap.example.com:636`. |
| **Manager DN** | Distinguished name of the service account GermainUX uses to search the directory—for example, `cn=germain-service,ou=services,dc=example,dc=com`. |
| **Manager Password** | Password associated with the Manager DN account. |
| **User Search Base** | Directory location under which GermainUX searches for users—for example, `ou=users,dc=example,dc=com`. |
| **Group Search Base** | Directory location under which GermainUX searches for groups—for example, `ou=groups,dc=example,dc=com`. |
| **User Search Filter** | LDAP filter used to match the submitted username to a directory user. |
| **Group Search Filter** | LDAP filter used to find the groups associated with the authenticated user. |
| **Group Role Attribute** | Group attribute whose value is mapped to a GermainUX Role, commonly `cn`. |

## Search-Filter Examples

### User Search Filter

```text theme={null}
cn={0}
```

`{0}` represents the username entered on the GermainUX login page. This example searches for a user whose `cn` attribute matches that username.

Another commonly used filter is:

```text theme={null}
uid={0}
```

Use the attribute that represents the login identifier in your directory.

### Group Search Filter

```text theme={null}
member={0}
```

In this example, GermainUX identifies groups whose `member` attribute contains the authenticated user’s distinguished name.

The exact filter depends on the directory structure and LDAP implementation used by your organization.

## Configure Role Mapping

GermainUX uses the value returned by **Group Role Attribute** to map LDAP groups to GermainUX Roles.

For example, if an LDAP group has:

```text theme={null}
cn=germain_apm_admin
```

GermainUX maps the user to the Role named:

```text theme={null}
germain_apm_admin
```

The corresponding Role must exist in GermainUX.

To review or create Roles, go to:

**Germain Workspace > Left Menu > System > Auth Settings > User Roles**

Ensure that:

* LDAP group names match the corresponding GermainUX Role names
* Each Role has the appropriate permissions
* Users belong to the required LDAP groups
* Role names use consistent capitalization and spelling

## Manage LDAP Users

Create, update, disable, and remove users through your LDAP directory.

To grant a user GermainUX access:

**1. Create or identify the user in LDAP**

**2. Add the user to the appropriate LDAP group**

**3. Ensure that a matching Role exists in GermainUX**

**4. Ask the user to log in with their LDAP credentials**

To revoke access, remove the user from the mapped group or disable the directory account.

## Log In

**1. Open the GermainUX login page**

**2. Enter the LDAP username and password**

**3. GermainUX authenticates the credentials against LDAP**

**4. GermainUX retrieves the user’s group memberships**

**5. Matching GermainUX Roles determine the user’s permissions**

**6. After successful authentication, the Germain Workspace opens**

## Validate the Configuration

Test the integration with a non-administrator LDAP account.

Confirm that:

* Valid LDAP credentials allow the user to log in
* Invalid credentials are rejected
* LDAP groups map to the expected GermainUX Roles
* The user can access only the authorized features
* Removing the user from a mapped group removes the corresponding permissions

## Get Help

> [card] [Contact GermainUX Support](https://docs.germainux.com/main/support.md)
>
> The GermainUX team helps you get up and running faster, empower your team, turn data into actionable insights, and optimize performance to deliver measurable business outcomes.

> [card] Can't find what you need?
>
> Search all GermainUX docs with **Ctrl + K**, or use the feedback buttons at the bottom of this page to tell us what is missing.

The content of this document is proprietary to GERMAIN SOFTWARE.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.