Add LDAP Panel

Overview

The Add LDAP panel is a comprehensive configuration wizard designed to bind external directory servers to the system. It encompasses server connection parameters, administrator binding validations, user/group schema attribute mappings, and granular authentication testing utilities.

This panel acts as a blueprint, instructing DataFloem on how to traverse external directory trees to seamlessly discover, match, and synchronize user objects and groups.

Access Requirements

This page is available only to users with Administrator privileges.

Only administrators can view and manage SSO Provider configurations. Non-administrator users cannot access this page.

Users without administrator privileges will receive the following authorization error:

Access Denied

You don't have access to this resource.

User Information

Panel Configuration Sections

The panel is logically segmented into 4 main operational zones:

1. Admin Information

Core network and binding parameters used to establish the initial handshake with the target LDAP server.

Name & Description: The identifying title and operational summary of the connection.
Is Active: A toggle switch determining if the connection is live.
Type: The structural integration type (Defaults to LDAP).
Host & Port: Network location and port specifications for the directory server.
Admin User & Password: The Distinguished Name (DN) and password of the dedicated service account authorized to search the directory tree.
Is Secure & Validate Certificate: Toggles enforcing encrypted transport layers (LDAPS/StartTLS) and strict server certificate validation checks.

2. User Information

Defines how target user accounts are discovered within the directory and how their remote fields map to the platform schema.

Object Class: The LDAP structural class used to filter user entities (e.g., person, organizationalPerson, or user).
Search Base: The root Distinguished Name where user tree lookups begin (e.g., ou=users,dc=company,dc=local).
Search Query: A raw LDAP filter expression applied to further narrow down eligible accounts.
Attribute Mappings (Name, Surname, Mail, Username Attribute): Maps remote directory keys to local DataFloem profile fields (e.g., mapping sAMAccountName or cn to local user credentials).
Auto Login Is Enabled: A toggle switch determining whether automated authentication schemes are enforced for incoming profiles.

3. Group Information

Governs the discovery rules for remote security groups to align them with platform-level roles.

Object Class: The structural class defining group objects (e.g., group or groupOfNames).
Group Member Attribute: The schema property keeping track of user membership arrays (e.g., member).
Search Base: The target root location within the tree where group lookups are executed.
Optional Group Allowed: A dynamic list allowing administrators to explicitly permit or restrict specific groups. Rows can be added or deleted on the fly.

4. Test Authentication

A sandboxed execution simulation used to verify connection integrity and attribute mapping rules before committing parameters to the database.

Username & User Password: Input fields where credentials of a real sample user from the target directory must be entered.
Test Connection Button: When triggered, the platform attempts a full end-to-end lookup simulation—binding the service account, locating the sample user, and attempting authentication. It returns a green success banner or explicit error diagnostics.

Execution & Validation Process

Populate all required parameter inputs according to your organizational directory layout.
Utilize the Test Connection action block to guarantee network connectivity and accurate schema parsing.
Once the simulation confirms a healthy configuration, click Save to deploy the integration, or click Cancel to abort changes.

Key Considerations

Password credentials for LDAP-managed accounts are never cached or persisted inside the DataFloem database; authentication challenges are validated directly against the remote server in real time during login.
Misconfigured or mismatched Attribute Mappings can result in broken user states, causing profile fields like email or full name to display blank values even if the account authenticates successfully.