LDAP/Windows AD integration

This integration synchronizes user and organization information from your LDAP or Windows AD directory to the user management module in Qoder CN. It also lets users sign in with their LDAP or Windows AD account credentials.

​

Create users outside the synchronization scope

Enterprise administrators can configure and manage LDAP and Windows AD integrations in Enterprise Settings > Identity Providers. To create users outside the synchronization scope, select the Support for built-in users checkbox.

​

Configure LDAP integration

Prerequisites:

• The LDAP service is deployed.
• User accounts are configured on the LDAP server.
• You have the Bind DN and Bind Password for the LDAP server.

​

Step 1: Configure LDAP connection

Configure the connection to your LDAP server.

• Server Address: The address and port of the LDAP server.
• Base DN: The distinguished name (DN) of the entry where the search begins. This is typically the root directory of the LDAP server. To limit the scope of synchronization, you can specify a subdirectory.

• Bind DN: The DN of the account used to connect to and search the directory, typically an administrator account.
• Bind DN Password: The password for the Bind DN account.
• User Query Condition: The filter used to query user information for synchronization. The default value is (objectClass=person).
• Department Query Condition: The filter used to query department information for synchronization. The default value is (objectClass=GroupOfUniqueNames).

The form also includes the User Logon Query Condition field, which defaults to sAMAccountName=%s. After you fill in the information, click Next.

​

Step 2: Configure account linking and attribute mapping

You can choose from four methods to identify and link accounts:

• Link Accounts with Same Email: Automatically links user accounts in Qoder CN and LDAP that have the same email address.
• Link Accounts with Same Username: Automatically links user accounts in Qoder CN and LDAP that have the same username.
• Link Accounts with Same Mobile Number: Automatically links user accounts in Qoder CN and LDAP that have the same mobile number.
• Link Accounts with Same Employee ID: Automatically links user accounts in Qoder CN and LDAP that have the same employee ID.

Whichever method you choose, ensure the corresponding attribute field is both unique and present in your directory. Qoder CN uses your selected method for one-to-one account matching. The following diagram shows how accounts are linked when you select Link Accounts with Same Email. Next, you need to configure the user attribute mapping. The page displays a tip: "User information is matched and synchronized based on the configured identity source and mapping rules. This configuration cannot be changed after you save it. Please proceed with caution." You must specify the User Unique Identifier, which is the LDAP user attribute that uniquely identifies an account, and select an Account Linking Method. The default attribute mappings are: Name → givenName, username → uid, email → mail, mobile number → mobile, employee ID → employeeNumber, and Nickname → givenName. Mappings for Name and username are required. Then, click Next.

​

Step 3: Enable services

By default, LDAP integration services are disabled. You can enable the following services:

• User and Organization Synchronization: When enabled, this feature keeps the user directory in User Management synchronized with the users within the LDAP synchronization scope.
• Single Sign-On: Lets users sign in with their LDAP username and password.

On the Enable Services page, User and Organization Synchronization and Single Sign-On have separate toggle switches. Both are disabled by default and can be enabled as needed. If you choose to enable a service, you must configure its settings.

​

User and organization synchronization

• Data Sync Timing: The default is manual synchronization. You can switch between manual and scheduled synchronization.
  • Manual: After your LDAP data changes, an administrator must click Execute Manual Sync on the LDAP integration details page to start the synchronization.

• Scheduled: Configure synchronization to run at a specific time daily, weekly, or monthly, or at a regular interval. After setting a schedule, we recommend performing an initial manual sync to ensure data is immediately updated in Qoder CN.
• User Difference Handling: By default, if a Qoder CN account has no match in LDAP, it is ignored. If an LDAP user in the synchronization scope has no match in Qoder CN, a new account is created and linked. You can change this behavior.
  • Existing Qoder CN account not matched to an LDAP account - Ignore: When an existing Qoder CN account does not have a matching LDAP account, the extra account on Qoder CN is not deleted.
  • An existing Qoder CN account does not match an LDAP account - Delete the Qoder CN account: When an existing Qoder CN account does not match an LDAP account, delete the account on Qoder CN.
  • No matching Qoder CN account for an existing LDAP account - Ignore: If an existing LDAP account does not have a matching Qoder CN account, a new account is not created in Qoder CN.
  • An existing LDAP account does not match a Qoder CN account-a new Qoder CN account is created and bound: When an existing LDAP account does not match a Qoder CN account, a new account is created in Qoder CN and bound to the LDAP account according to the Account Binding and Attribute Mapping rules;
• Organization Difference Handling: By default, if a Qoder CN department has no match in LDAP, it is ignored. If an LDAP department in the synchronization scope has no match in Qoder CN, a new department is created. You can change this behavior.
  • Existing Qoder CN departments not matched to LDAP departments-Ignore: If an existing Qoder CN department is not matched to an LDAP department, the department node in Qoder CN is not deleted.
  • Unmatched Qoder CN departments - Delete Qoder CN departments: When an existing Qoder CN department is not matched to an LDAP department, the department node on Qoder CN is deleted.
  • Existing LDAP department not matched to a Qoder CN department - Ignore: If an existing LDAP department does not have a matching Qoder CN department, a department node is not created in Qoder CN.
  • An existing LDAP department is not matched with a Qoder CN department - a Qoder CN department is created and bound: If an existing LDAP department is not matched with a Qoder CN department, a department node is created in Qoder CN and the two department nodes are bound.

​

Single sign-on

After you enable single sign-on (SSO), you can:

• This page provides the LDAP login address. Qoder CN users who have bound an LDAP account can use their LDAP account and password to log in to Qoder CN on this page.
• Customize the display name and icon for the LDAP sign-in button that appears on the Qoder CN sign-in page.
• Allow Qoder CN accounts to be created on first sign-in:
  • If this option is not selected, only binding between LDAP accounts and Qoder CN accounts is allowed at login, and if a matching Qoder CN account is not found, Qoder CN will not create a new Qoder CN account based on the LDAP account.
  • If selected: When an LDAP account logs in to Qoder CN and cannot be matched to an existing Qoder CN account, Qoder CN creates a new Qoder CN account and binds it to the LDAP account.

You can save the configuration without enabling any services and enable them later from the integration details page. When you are finished, click Save.

​

LDAP login for Qoder CN

When SSO is enabled, the Qoder CN sign-in page displays an LDAP sign-in option. Users with linked accounts can click this option to go to the LDAP sign-in page and enter their LDAP credentials.

​

Synchronization results

If synchronization is enabled, you can check the latest sync status on the LDAP integration details page. The status can be Not Synced, Synced, Sync Failed, or Partially Synced.

​

Modify LDAP integration services

On the LDAP integration details page, click Modify Service Configuration next to an enabled service to modify its configuration or disable it.

• If you disable user and organization synchronization:
  • Existing account links between Qoder CN and LDAP are preserved.
  • User and organization synchronization from LDAP stops.
• If you disable single sign-on:
  • Existing account links between Qoder CN and LDAP are not affected.
  • Logging in to Qoder CN with an LDAP account is not supported. To log in to Qoder CN, use the username and password for Qoder CN.

​

Remove LDAP integration

On the LDAP integration details page, click Remove Integration and then confirm in the dialog box. Removing the integration has the following effects:

• This action removes all account links between Qoder CN and LDAP. However, previously synced user and organization information is not affected.
• User and organization synchronization from LDAP stops.
• Logging in to Qoder CN with an LDAP account is no longer supported. To log in to Qoder CN, you can use the Qoder CN username and password.