---
title: "DB24 | Docs - LDAP Authentication"
url: https://db24.ai/docs/ldap-authentication
description: "LDAP (Lightweight Directory Access Protocol) is the standard protocol for querying and authenticating against a directory service - in most customer…"
lang: en
---

# LDAP Authentication

Last updated: September 7, 2026

## DB24 Portal – LDAP Authentication

## Introduction

LDAP (Lightweight Directory Access Protocol) is the standard protocol for querying and authenticating against a directory service — in most customer environments this means Microsoft Active Directory.

When LDAP authentication is enabled, users sign in to DB24 Portal with their existing directory credentials instead of a separate portal account:

- Users authenticate directly against the customer's LDAP server — no passwords are stored in DB24 Portal.
- First-time LDAP users are provisioned automatically with their display name and e-mail from the directory.
- Portal roles (member or admin) are resolved from the user's directory group memberships on every login.

LDAP authentication is configured under **Settings → Organization → Authentication** and requires the **Admin** role.

* * *

## How Authentication Works

Understanding the login flow helps when filling in the fields below:

1. The portal connects to **Host**:**Port** using the selected **Security Mode**.
2. It binds (logs in) to the LDAP server as `DOMAIN\username` with the password the user entered — this is why **Domain** must be the short NetBIOS domain name.
3. It searches the subtree under **Base DN** for a user whose `sAMAccountName` matches the username, and reads the `displayName`, `mail` and `memberOf` attributes.
4. The group names in `memberOf` are compared against **Member Group Name** and **Admin Group Name** to decide the user's portal role. Users in neither group are denied access.
* * *

## Enabling LDAP Authentication

- **LDAP Authentication (ON/OFF)**
  Master switch for the feature. While it is **OFF**, the connection and group mapping fields are disabled and users can only sign in with DB24 credentials.

When the switch is **ON**, **Host**, **Domain** and **Base DN** are required. Click **SAVE** to store the configuration. The portal confirms with `LDAP Settings has successfully been updated.`

* * *

## Connection Settings

Configure the LDAP server used to authenticate DB24 Portal users.

| Field | Description |
| --- | --- |
| **Host** | Hostname or IP address of a domain controller (or other LDAP server) that is reachable from the DB24 Portal server. |
| **Port** | LDAP port on the server. Use `389` for None/StartTLS and `636` for LDAPS. Defaults to `389` if left empty. |
| **Domain** | The short **NetBIOS** domain name used to bind as `DOMAIN\username`, e.g. `CONTOSO`. Do **not** enter the DNS name (`contoso.com`) or a distinguished name. |
| **Base DN** | The distinguished name of the subtree where users are searched, e.g. `DC=contoso,DC=com`. A narrower OU such as `OU=Employees,DC=contoso,DC=com` also works, as long as all portal users are inside it. |
| **Security Mode** | `None` — unencrypted connection (not recommended outside test environments). `StartTLS` — connects on port 389 and upgrades the connection to TLS. `LDAPS` — TLS from the start, normally on port 636. |
| **Validate Certificate** | When on, the LDAP server's TLS certificate must be valid and trusted by the portal server. Only turn this off for self-signed certificates in test environments. |

Defaults for a new configuration are **Port** `389`, **Security Mode** `None` and **Validate Certificate** on.

* * *

## Group Mapping

Map LDAP groups to DB24 Portal member and admin roles. Roles are granted from directory group membership:

- **Member Group Name** — members of this group can sign in with the standard member role.
- **Admin Group Name** — members of this group receive the admin role (which includes member access).

Enter the plain group name (the CN), e.g. `DB24-Admins` — **not** a full distinguished name like `CN=DB24-Admins,OU=Groups,DC=contoso,DC=com`. Matching is exact and case-sensitive, so the name must match the directory group's CN character for character.

* * *

## Collecting the Values from a Customer Environment

Run these commands on a domain-joined Windows machine (the AD PowerShell commands require the ActiveDirectory module, available on domain controllers or via RSAT):

**Domain (NetBIOS name):**

`( Get-ADDomain ) . NetBIOSName `

Or without the AD module: `$env:USERDOMAIN` (when logged in as a domain user).

**Base DN:**

`( Get-ADDomain ) . DistinguishedName `

**Host (find a domain controller):**

`( Get-ADDomainController ) . HostName `

Or: `nltest /dclist:CONTOSO`

**Verify group names and membership:**

`Get-ADGroup  "DB24-Admins"  Get-ADPrincipalGroupMembership  someuser  |  Select-Object  Name `

The `Name` value is what goes into the group fields.

**Test connectivity from the portal server:**

`Test-NetConnection  dc01 . contoso . com  - Port 389 `

Use port `636` when using LDAPS. If the test fails, a firewall between the portal server and the domain controller is usually the cause.

* * *

## Signing In with LDAP

When LDAP authentication is enabled, the DB24 Portal login page shows **Select login method** with two options:

- **DB24** – Login with your DB24 credentials (**Email Address** and **Password**).
- **AD** – Login with your Active Directory credentials. The **Username** field is prefixed with the configured domain (`DOMAIN\`), so users enter only their username.

DB24 credential login remains available when LDAP is enabled.

If the directory rejects the credentials, or the user is not a member of the configured groups, the portal shows `The Username and Password you entered do not match. Please try again.`

LDAP users are shown by their directory display name in the portal header. The **Profile** page is not available for LDAP users, since their account is managed in the directory.

* * *

## Troubleshooting

- **All logins fail immediately** — check that Domain is the NetBIOS name (`CONTOSO`), not the DNS name (`contoso.com`). The bind is performed as `DOMAIN\username`.
- **Bind succeeds but user not found** — verify the Base DN spelling and that the user account is located inside that subtree.
- **User found but access denied** — the user is not a member of the configured groups, or the group name doesn't exactly match the group's CN (matching is case-sensitive; use the plain name, not a DN).
- **LDAPS connection errors** — the certificate is likely untrusted or doesn't match the hostname. Verify the certificate chain on the portal server, or temporarily disable Validate Certificate in a test environment to confirm the cause.
- **Timeouts** — the port is blocked by a firewall; verify with `Test-NetConnection` as shown above.
* * *

## Good to Know

- No directory passwords are stored in DB24 Portal. Each login binds to the LDAP server with the password the user entered.
- Roles are resolved from group membership on every login. Changing a user's directory groups takes effect the next time they sign in.
- A user in the admin group receives both the admin and the member role.
- With **LDAP Authentication** switched **OFF**, the configuration can be saved with empty fields. Validation applies only when the switch is **ON**.
- There is no built-in connection test in the portal. Use `Test-NetConnection` from the portal server as described above.

## Related Documentation

- DB24 Overview (https://db24.ai/docs/overview) - Platform introduction
- Data Collection Authentication (https://db24.ai/docs/collection-authentication) - How DB24 authenticates towards monitored instances

Previous Database Engagement Insights: https://db24.ai/docs/database-engagement-insights
Next Version 2026.3: https://db24.ai/docs/version-2026-3

## Structured data

```json
{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "DB24",
  "url": "https://db24.ai",
  "logo": "https://db24.ai/logo.png",
  "description": "SQL Server on autopilot. DB24 monitors, backs up and documents SQL Server automatically for organisations that run it without a dedicated DBA.",
  "contactPoint": {
    "@type": "ContactPoint",
    "contactType": "sales",
    "email": "sales@db24.ai"
  },
  "sameAs": [
    "https://www.linkedin.com/company/db24"
  ]
}
```