LDAP Settings
Lightweight Directory Access Protocol (LDAP) enables centralized user authentication for ERPNext. After configuring LDAP, users can log in using their LDAP credentials instead of maintaining separate ERPNext passwords.
1. Prerequisites
Before configuring LDAP, install the ldap3 Python module on the ERPNext server.
cd frappe-bench
./env/pip install ldap3
Once the module is installed, LDAP can be configured from the LDAP Settings page.
2. Configure LDAP
Open LDAP Settings and provide the required connection and authentication details.
LDAP Server URL
Enter the LDAP server address using one of the following formats:
ldap://yourserver:port
ldaps://yourserver:port
Base Distinguished Name (DN)
Specify the distinguished name of the LDAP user that ERPNext will use to search for user information. This account should have read-only access.
Password for Base DN
Enter the password associated with the Base DN account.
Organization Unit of Users
Specify the Organizational Unit (OU) that contains the users allowed to log in to ERPNext.
Default Role on Creation
Select the ERPNext role automatically assigned to users when they log in for the first time.
LDAP Search String
Defines how ERPNext searches for users in the LDAP directory.
The format is:
LDAPFIELD={0}
Common examples:
- Active Directory:
sAMAccountName={0} - OpenLDAP:
uid={0}
LDAP Email Field
Specifies the LDAP attribute that stores the user’s email address.
Common value:
mail
LDAP Username Field
Specifies the LDAP attribute used as the username.
- Active Directory:
sAMAccountName - OpenLDAP:
uid
LDAP First Name Field
Specifies the LDAP attribute that stores the user’s first name.
- Active Directory:
givenName - OpenLDAP:
sn
Optional Field Mapping
Additional LDAP attributes can also be mapped to ERPNext fields, including:
- Middle Name
- Phone
- Mobile Number
3. Enable LDAP
After entering all required settings, enable the Enabled option.
ERPNext validates the connection before enabling LDAP. If any configuration is incorrect, an error message is displayed indicating the issue that must be resolved.
Once enabled, users will see the Login via LDAP option on the ERPNext login screen.
4. LDAP Security
LDAP Settings provide options for establishing secure connections to the LDAP server.
SSL/TLS Mode
Choose how the connection is secured. Selecting StartTLS upgrades the connection to use TLS after connecting to the LDAP server.
If the LDAP server does not support StartTLS, enabling this option results in a StartTLS is not supported error.
Require Trusted Certificate
Specify whether ERPNext should verify the LDAP server’s SSL certificate before establishing the connection.
When enabled, provide absolute paths to the certificate files stored on the ERPNext server.
Supported certificate files include:
- Private Key File
- Server Certificate
- CA Certificate File
If using a self-signed certificate with StartTLS, set Require Trusted Certificate to No. This setting is ignored when StartTLS is not used.
5. LDAP Group Mapping
LDAP Group Mapping automatically assigns ERPNext roles based on LDAP group membership.
For example, users belonging to an Accounting group in LDAP can automatically receive the Accounts User role in ERPNext.
LDAP Group Field
Specify the LDAP attribute that stores group memberships.
Common value:
memberOf
This attribute is commonly available in Active Directory and OpenLDAP. Some OpenLDAP deployments may require additional configuration to expose this attribute.
Each time a user logs in, ERPNext synchronizes their roles by adding or removing ERPNext roles based on their current LDAP group memberships.
6. Security Options Summary
| Setting | Description |
|---|---|
| SSL/TLS Mode | Choose whether to connect normally or upgrade the connection using StartTLS. |
| Require Trusted Certificate | Determines whether the LDAP server must present a trusted SSL certificate. |
