This article explains how to configure Lightweight Directory Access Protocol (LDAP) authentication in OrangeHRM Starter. We go through the fundamentals, advanced concepts, and some troubleshooting parts to help the user enable and manage LDAP in OrangeHRM.

Step 01: Enabling LDAP Authentication

To enable LDAP, go to Admin - Configurations - LDAP Configuration and enable the toggle button located in the top right of the page.

Step 02: LDAP Server Setting

Next, update your LDAP server settings to set up the connection to your LDAP server. You will need to provide the following information.

Step 03: Choose your Bind Settings

Binding is the step where the LDAP server authenticates the user and, if the user is successfully authenticated, allows the user access to the LDAP server based on that user's privileges.

You can set this to “Bind Anonymously” by enabling the toggle switch. Anonymous binding allows a client to connect and search the directory (bind and search) without logging in because a distinguished name and password are not needed.

If you disable “Bind Anonymously”, then you need to provide a distinguished username and password to authenticate the user to LDAP. Ensure the user has permission to search the entire directory to import all users to OrangeHRM.

Step 04: User lookup Settings

You can define the users and groups lookup information under these configurations.

Step 05: Data Mapping

When LDAP user data is synchronized with OrangeHRM, LDAP user attributes should be matched with the relevant OrangeHRM employee fields. In this part, you may provide the data mapping as needed.

By providing the name of the related LDAP property name in the appropriate textbox, the following OrangeHRM fields can be mapped to LDAP user attributes.

• First Name
• Middle Name
• Last Name
• User Status 
• Work Email
• Employee ID

Step 06: Additional Settings

By enabling the given toggle switch, you may choose to merge the LDAP credentials with existing user accounts. When the option is turned off, user account creation is skipped without merging with existing ones in OrangeHRM.

Note:

This merge users switch may be beneficial for systems that used the LDAP add-on in OrangeHRM 4.x versions.

Next, the sync interval time can then be set. Enter your preferred sync interval time in hours in the provided field. If you enter X as your preferred sync interval time, OrangeHRM will connect to your LDAP server once every X hours behind the screens. This guarantees that LDAP-stored user credentials are correctly synchronized with OrangeHRM.

If you want to restrict user access through LDAP, you may make the change from LDAP, and OrangeHRM will be informed of the change during the subsequent sync run. After that, the user's LDAP credentials will no longer work to access OrangeHRM.

Step 07: Test Connection

You must save your LDAP configurations on this page for synchronization to take place, and then test the connection to make sure the connection was formed successfully.

If the connection is successful, you will be provided with a confirmation message as below with all indicators showing green.

If the test connection status shows any red indicator, revisit your LDAP configurations and network connection to rectify the errors indicated.

FAQs

Manually triggering a sync with the LDAP server

Once the connection with your LDAP server is established, OrangeHRM facilitates manual triggering of a synchronization flow via “Sync Connection”. Sync Connection shows the most recent successful synchronization or whether the most recent synchronization has failed. Clicking "Sync Now" will start a sync immediately, bypassing the need to wait for the next scheduled run.

Changing OrangeHRM password of users imported from LDAP

If the ESS user account is synchronized with the LDAP server, ESS users are not permitted to change their passwords via Forgot password or Change password screens.

The passwords of these user accounts can be changed by admin users. However, doing so will override the user's LDAP password and force them to input the updated OrangeHRM password whenever they wish to login to OrangeHRM.

Importing LDAP Credentials for existing users

If you intend to give them access via LDAP, it is recommended that you delete the current user accounts in OrangeHRM. Current users cannot access OrangeHRM using their LDAP credentials since syncing over existing users will not override user credentials created by OrangeHRM.