Sign-in with Active Directory
Copy link to the page “Sign-in with Active Directory”Let colleagues sign in to the appliance with their AD accounts and receive a role from their AD group.
What you need
Copy link to the section “What you need”- Professional or Enterprise and the LDAP/AD module loaded under Modules.
- An AD service account that can read users and their direct group memberships.
- An Owner with a local password or Cloud sign-in for emergency access. AD cannot grant the Owner role.
Give AD users access
Copy link to the section “Give AD users access”- Create the AD groups
sslbrain-adminsandsslbrain-operatorsand add users directly to them. - Open Appliance › Users and login › AD login and turn on LDAP Authentication.
- Enter Server, Port (389), Base DN, Bind user (DN) and Bind password using the service account’s details.
- Enter the groups’ CN values in Admin group and Operator group. Click Save, then Test connection.
Check that it works
Copy link to the section “Check that it works”Connection status shows Connected. Open the sign-in page in another browser window, choose Log in with AD and try a user account, such as jens@company.com. Check the role under Users and sign-in.
If it fails
Copy link to the section “If it fails”- The connection test fails → check access from the appliance to the domain controller on port 389 and the service account’s credentials.
- The user is not found → change Base DN so the search includes the user.
- The user gets Viewer → use direct group membership and the group’s exact CN, including letter case.
- An AD user cannot download a backup or private key → have an Owner or a user who can confirm their sign-in download it. AD sign-in cannot be confirmed again.
How roles are assigned
Copy link to the section “How roles are assigned”| Direct member of | Role |
|---|---|
| Admin group | Administrator |
| Operator group | Operator |
| Neither group | Viewer |
The role is calculated at each sign-in. Operator group and Domain can be empty. For example, Base DN can be DC=company,DC=local and Bind user (DN) can be CN=svc-sslbrain,OU=Service,DC=company,DC=local.