Nuclos LDAP Active Directory: base DN, manager DN, sAMAccountName, filter, synchronization, authentication, memberof.

Language: Deutsch · English

LDAP configuration

Connect LDAP/Active Directory – authentication, synchronization, filters and attribute mapping.

On this page

Menu Administration → LDAP configuration. An LDAP (e.g. Microsoft Active Directory) is a hierarchical directory service for central management of resources such as users. Nuclos uses LDAP for authentication and a simple synchronization (LDAP → Nuclos); authorization remains in Nuclos.

Authentication

Users found via the authentication filter are checked against the LDAP – the Nuclos password is ignored.
Users not found cannot log in (exception: super users – the Nuclos password is also tried for them if the LDAP is unavailable).
The test authentication button verifies a user/password combination.

Users must be created manually in Nuclos with the same user name and assigned to a group with the system start right. Synchronization neither creates nor deletes users.

Synchronization

With an active LDAP configuration a synchronization icon appears in the user detail view. It copies first name, last name and e-mail from the configured LDAP attributes.

Configuration fields

Field	Description	Example
Name	Name der LDAP-Anbindung	`yourdc`
URL	Verbindungsstring mit IP/Port	`ldap://192.168.1.1:389`
Base DN	Basis-DN mit den Benutzerdaten	`DC=yourdomain,DC=de`
Search Scope	Suchtiefe	`SUBTREE`
Manager DN	Zugriffsbenutzer (eigenen anlegen)	`yourdomain\manager` oder `CN=manager,OU=Users,DC=yourdomain,DC=de`
Manager Passwort	Passwort des Manager-Benutzers	–
Filter (Authentifizierung)	Filter für die Anmeldung	`(sAMAccountName={0})`
Alternativer Filter (Auth.)	Anmeldung auf AD-Gruppe eingrenzen	`(&(objectClass=user)(sAMAccountName={0})(memberof=CN=Gruppe,OU=Users,DC=yourdomain,DC=de))`
Filter (Synchronisation)	Filter für die Synchronisation	`(objectClass=user)`

Attribute mapping (mandatory)

Nuclos attribute	Description	LDAP attribute
name	Benutzername	sAMAccountName
firstname	Vorname	givenName
lastname	Nachname	sn
email	E-Mail-Adresse	mail

Tools such as JXplorer, Apache Directory Studio or Microsoft's AD Explorer help determine the base DN/manager DN and the tree structure.

Related pages

SSO configuration

SSO.

Open →

User

Users.

Open →