DB24 LogoDB24 Docs

    LDAP Authentication

    Last updated: September 7, 2026

    DB24 Portal – LDAP Authentication

    Introduction

    LDAP (Lightweight Directory Access Protocol) is the standard protocol for querying and authenticating against a directory service — in most customer environments this means Microsoft Active Directory.

    When LDAP authentication is enabled, users sign in to DB24 Portal with their existing directory credentials instead of a separate portal account:

    • Users authenticate directly against the customer's LDAP server — no passwords are stored in DB24 Portal.
    • First-time LDAP users are provisioned automatically with their display name and e-mail from the directory.
    • Portal roles (member or admin) are resolved from the user's directory group memberships on every login.

    LDAP authentication is configured under Settings → Organization → Authentication and requires the Admin role.

    How Authentication Works

    Understanding the login flow helps when filling in the fields below:

    1. The portal connects to Host:Port using the selected Security Mode.
    2. It binds (logs in) to the LDAP server as DOMAIN\username with the password the user entered — this is why Domain must be the short NetBIOS domain name.
    3. It searches the subtree under Base DN for a user whose sAMAccountName matches the username, and reads the displayName, mail and memberOf attributes.
    4. The group names in memberOf are compared against Member Group Name and Admin Group Name to decide the user's portal role. Users in neither group are denied access.

    Enabling LDAP Authentication

    • LDAP Authentication (ON/OFF)
      Master switch for the feature. While it is OFF, the connection and group mapping fields are disabled and users can only sign in with DB24 credentials.

    When the switch is ON, Host, Domain and Base DN are required. Click SAVE to store the configuration. The portal confirms with LDAP Settings has successfully been updated.

    Connection Settings

    Configure the LDAP server used to authenticate DB24 Portal users.

    Field Description
    Host Hostname or IP address of a domain controller (or other LDAP server) that is reachable from the DB24 Portal server.
    Port LDAP port on the server. Use 389 for None/StartTLS and 636 for LDAPS. Defaults to 389 if left empty.
    Domain The short NetBIOS domain name used to bind as DOMAIN\username, e.g. CONTOSO. Do not enter the DNS name (contoso.com) or a distinguished name.
    Base DN The distinguished name of the subtree where users are searched, e.g. DC=contoso,DC=com. A narrower OU such as OU=Employees,DC=contoso,DC=com also works, as long as all portal users are inside it.
    Security Mode None — unencrypted connection (not recommended outside test environments). StartTLS — connects on port 389 and upgrades the connection to TLS. LDAPS — TLS from the start, normally on port 636.
    Validate Certificate When on, the LDAP server's TLS certificate must be valid and trusted by the portal server. Only turn this off for self-signed certificates in test environments.

    Defaults for a new configuration are Port 389, Security Mode None and Validate Certificate on.

    Group Mapping

    Map LDAP groups to DB24 Portal member and admin roles. Roles are granted from directory group membership:

    • Member Group Name — members of this group can sign in with the standard member role.
    • Admin Group Name — members of this group receive the admin role (which includes member access).

    Enter the plain group name (the CN), e.g. DB24-Admins — not a full distinguished name like CN=DB24-Admins,OU=Groups,DC=contoso,DC=com. Matching is exact and case-sensitive, so the name must match the directory group's CN character for character.

    Collecting the Values from a Customer Environment

    Run these commands on a domain-joined Windows machine (the AD PowerShell commands require the ActiveDirectory module, available on domain controllers or via RSAT):

    Domain (NetBIOS name):

    (Get-ADDomain).NetBIOSName

    Or without the AD module: $env:USERDOMAIN (when logged in as a domain user).

    Base DN:

    (Get-ADDomain).DistinguishedName

    Host (find a domain controller):

    (Get-ADDomainController).HostName

    Or: nltest /dclist:CONTOSO

    Verify group names and membership:

    Get-ADGroup "DB24-Admins"
Get-ADPrincipalGroupMembership someuser | Select-Object Name

    The Name value is what goes into the group fields.

    Test connectivity from the portal server:

    Test-NetConnection dc01.contoso.com -Port 389

    Use port 636 when using LDAPS. If the test fails, a firewall between the portal server and the domain controller is usually the cause.

    Signing In with LDAP

    When LDAP authentication is enabled, the DB24 Portal login page shows Select login method with two options:

    • DB24 – Login with your DB24 credentials (Email Address and Password).
    • AD – Login with your Active Directory credentials. The Username field is prefixed with the configured domain (DOMAIN\), so users enter only their username.

    DB24 credential login remains available when LDAP is enabled.

    If the directory rejects the credentials, or the user is not a member of the configured groups, the portal shows The Username and Password you entered do not match. Please try again.

    LDAP users are shown by their directory display name in the portal header. The Profile page is not available for LDAP users, since their account is managed in the directory.

    Troubleshooting

    • All logins fail immediately — check that Domain is the NetBIOS name (CONTOSO), not the DNS name (contoso.com). The bind is performed as DOMAIN\username.
    • Bind succeeds but user not found — verify the Base DN spelling and that the user account is located inside that subtree.
    • User found but access denied — the user is not a member of the configured groups, or the group name doesn't exactly match the group's CN (matching is case-sensitive; use the plain name, not a DN).
    • LDAPS connection errors — the certificate is likely untrusted or doesn't match the hostname. Verify the certificate chain on the portal server, or temporarily disable Validate Certificate in a test environment to confirm the cause.
    • Timeouts — the port is blocked by a firewall; verify with Test-NetConnection as shown above.

    Good to Know

    • No directory passwords are stored in DB24 Portal. Each login binds to the LDAP server with the password the user entered.
    • Roles are resolved from group membership on every login. Changing a user's directory groups takes effect the next time they sign in.
    • A user in the admin group receives both the admin and the member role.
    • With LDAP Authentication switched OFF, the configuration can be saved with empty fields. Validation applies only when the switch is ON.
    • There is no built-in connection test in the portal. Use Test-NetConnection from the portal server as described above.