On this page
Let an organization's members sign in with their own enterprise directory account instead of a separate platform password.
For: owners and admins of an organization with an LDAP or Active Directory server. Before you start: a super admin has turned directory login on for the organization, and the directory server accepts an encrypted connection from the platform.
Steps#
Confirm the prerequisite. Directory login only works once a super admin has enabled the tab for this organization; an owner or admin cannot turn it on themselves. Ask the platform operator if the tab is missing.
Open Settings > LDAP login ("Cài đặt > Đăng nhập LDAP") at
/settings/ldap.Fill in the connection fields:
Field Meaning Server and port The directory server's address LDAPS or StartTLS One is required; there is no plain-connection option Bind DN and bind password The account that reads the directory; leave blank for an anonymous bind Search base One to ten root branches to search for users User search filter Must contain the username placeholder Attribute mapping The attributes carrying email and name are required; the username attribute is optional Leaving the bind password blank while editing keeps the existing password; to switch to an anonymous bind, choose to clear it explicitly rather than leaving the field empty.
Use Test connection to call the directory once from the configuration page itself before saving for real.
Verify#
- Test connection succeeds against the directory server.
- A member who already has a platform account signs in successfully with their directory credentials.
When something is wrong#
| Symptom | Likely cause | Fix |
|---|---|---|
| The LDAP login tab does not appear | A super admin has not enabled directory login for this organization yet | Ask the platform operator to turn it on. |
| The page is open but shows no configuration form | The organization is not yet enabled, even though the page itself is reachable | Same as above — enabling is a super-admin action. |
| A directory account cannot sign in | The email from the directory does not match an existing platform account | Directory login never creates an account; invite the member first. |
| A person belonging to more than one organization cannot use directory login | This path is restricted to people in exactly one organization | They sign in with a password, passkey or a one-time link instead. |
| The server address is rejected on save | It points at a loopback, link-local, unspecified, internal IPv6 range, or the platform's own infrastructure | Directory servers cannot resolve to those ranges; use the real external address. |
How it works#
On sign-in, the platform opens an encrypted connection to the directory server and checks the password against the directory itself rather than a stored copy; only the display name is synced, and role, capability and brand access are always decided by the platform, never by directory groups. See Tenancy and security for the connection-security guarantees behind this path.
Limits#
- No mapping from directory groups to a role or to brand access; permissions are still entered on the platform.
- No periodic re-sync and no automatic lock when the directory disables a person; revoking access is still a platform action.
- No option to create an account at sign-in time.
- A person who belongs to more than one organization cannot use this path.