Instruction for LDAP Configuration in Web Port

If LDAP integration is not working as expected, follow these steps to troubleshoot and configure correctly.

Step 1: User Lookup in AD

1. Test cn={0} for user lookup:
   • Check in Active Directory (AD) if the cn field contains the username of the user trying to log in.
   • If cn does not contain the username, use sAMAccountName={0} instead in the LDAP configuration.
2. User account for login:
   • The domain field can be left empty if multiple AD configurations are not used in Web Port.
   • Check both the AD server's and Web Port server's logs to see if the login is successful.
3. Authentication type:
   • Choose "Negotiate" under Auth-Type in the Web Port settings.
4. User requirements:
   • The username specified in the configuration must have the rights to perform lookups in AD.
   • You can also test entering the username in the format [e-mail].

Step 2: Testing the Configuration

1. Verification of user lookup:
   • Verify whether it is cn or sAMAccountName that contains the username in AD, and configure this correctly in Web Port.
2. Domain Field:
   • Leave the domain field empty in Web Port if it is not needed for multiple AD configurations.
3. Authentication:
   • Switch to "Negotiate" for the authentication type.
4. SSL and LDAP activation:
   • Verify that SSL is used for the connection to AD.
   • Ensure that the "Enable LDAP" option is selected in the LDAP settings.
5. Username formatting:
   • Test entering the username in two ways: without @ and in the format username@domain.

Groups and permissions

• Group access: Users gain access to Web Port by belonging to groups that match groups in AD. Even though group names are often based on cn, sAMAccountName is sometimes used.
• Incorrect entry: When switching to sAMAccountName in Web Port, make sure the username includes both @ and the domain in the AD settings.

LDAP and NTLM

• Separation of LDAP and NTLM: LDAP is decoupled from NTLM authentication. LDAP is not related to Basic Authentication or SSO via NTLM.
• For NTLM to work:

1. 1. The WebPort server must run with an account belonging to the same AD as the connecting clients.
   2. All clients connecting to Web Port must originate from computers belonging to the same AD as the WebPort server.
   3. Groups in Web Port must be configured to match the group names returned when user tokens are validated via SSPI (often in the format DOMAIN\GROUP).

• Basic authentication should not be used in conjunction with NTLM.

LDAPS configuration:

• Manual port configuration for LDAPS: When enabling SSL in the LDAP settings, the port number is not adjusted automatically. To ensure LDAPS functions correctly, manually set the port to 636 in the configuration.

Related articles

LDAP Settings