Skip to main content

Set up LDAP / Active Directory authentication

Integrator

Ticketra can authenticate system users against an LDAP or Active Directory directory, with optional just-in-time (JIT) provisioning and group-to-role mapping.

Before you start​

You'll need:

  • The directory host and whether it uses LDAPS/StartTLS (and a CA certificate if using a private CA).
  • A bind DN and bind password for the service account that performs lookups.
  • The base DN to search under.
  • A search filter containing the {{username}} placeholder (e.g. (sAMAccountName={{username}})).

Configure​

  1. Sign in as a SUPER_ADMIN.
  2. Go to Admin → Configuration → LDAP.
  3. Enter the connection details:
    • Directory type (active_directory or generic LDAP)
    • Host, bind DN, bind password, base DN, search filter
    • CA certificate (paste PEM) if using LDAPS with a private CA
    • Connect timeout (milliseconds)
  4. Enable LDAP and save.
Test before you rely on it

Use the configuration page's test action (or a single test login) to confirm bind and search succeed before disabling local accounts.

Group-to-role mapping​

Map directory groups to Ticketra roles so access follows your existing group structure:

  1. In the LDAP config, define mappings from a group (e.g. CN=SOC-Admins,...) to a Ticketra role.
  2. Set a default role for matched users with no specific mapping.
  3. Choose an unmapped action: either assign the default role or deny access to users whose groups don't match any mapping.

Just-in-time (JIT) provisioning​

With JIT enabled, a directory user who authenticates successfully and resolves to a role is created automatically on first login — no manual user creation required.

Fallback behavior​

The fallback to local setting controls whether local password authentication is attempted if LDAP is unavailable. Choose this deliberately based on your availability vs. control requirements.

Login timing and enumeration

When LDAP is enabled, login requests for non-existent users may take noticeably longer than for known local users, because the unknown-user path attempts an LDAP lookup. If you operate in a hostile network, treat this as a username-enumeration consideration and keep the connect timeout low, alongside the built-in rate limiting and account lockout.

Scheduled sync​

Ticketra can periodically sync directory users (for example to reflect role changes or deactivations) on a schedule, in addition to login-time JIT.