---
title: Add an LDAP/AD Provider
slug: manufacturing-connect-edge/add-an-ldapad-provider
docTags: 
createdAt: 2022-09-27T17:50:12.000Z
---

You must configure providers in Manufacturing Connect Edge to activate LDAP/AD authentication. The edge device contains a client that communicates with the LDAP server and receives information based on the client access level.

You can add an LDAP/AD Provider by navigating to **System **>** Access Control **>** LDAP/AD Auth**. 

:::hint{type="warning"}
**Important**:

- Manufacturing Connect Edge Authentication Providers do not support nested groups. A separate group for each role is required.
- Once you have added a provider, you need to select a provider on the login screen.
:::

To configure LDAP for Manufacturing Connect Edge, you must find the DN information from the LDAP server.

An LDAP Bind DN supplies the user and the user location in the LDAP directory tree. The LDAP client configuration file contains this information. See [Find LDAP Distinguished Names (DN)](docId\:NwdYueYRA_TehYkmk_rQ7) for more information.

**To add an LDAP provider:**

1. Navigate to **System **>** LDAP/AD Auth**.
2. Click the **LDAP / AD Auth** tab. 
3. Click the **Add a Provider** icon.
   The *Add Provider* dialog box appears.
   ![](https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/JvC6-LPHOofMMDjfrY0by_add-ldap.png)
4. Select the type of method for adding the provider. 
   - **Load AD Template**: Load pre-defined template for the Active Directory LDAP.
   - **Load OpenLDAP Template**: Load pre-defined template for the OpenLDAP server.
   - **Load**: Load a file with pre-defined settings for the provider. 
   - **Advanced**: Create a provider without a template.
5. Configure the settings for the provider. 

# Generic

1. Enter the provider name in the **Name **field. 
2.  The default selection for **Type **is generic. Confirm the generic settings and click **Next**. 
   The *Connection *section displays. 

# Connection

1. Configure the *Connection *settings. 
   - **Host**: Enter the fully qualified domain name or IP address of your LDAP server. 
   - **Port**: Enter the LDAP host port number in the Port field. The default LDAPS (Secure LDAP) port is 636. The default LDAP port is 389.
   - **Use TLS**: Select the checkbox to enable TLS authentication. When TLS is not enabled, Manufacturing Connect Edge expects to find a configured Custom Certificate. See [Add a Custom CA Certificate](docId\:K0L-iImQa7MFlnvRUs5qJ). 
   - **TLS Root CA**: If you select TLS authentication, paste the root SSL/TLS certificate or click **Upload **and load the file. 
   - **Bind DN**: Enter the bind DN identifier. The bind DN identifies the user and the location of the user in the LDAP directory tree. See [Find LDAP Distinguished Names (DN)](docId\:NwdYueYRA_TehYkmk_rQ7).
   - **Bind DN Password**: Enter the password used to authenticate against LDAP. 
2. When done, click **Next**. 
   The *User *section displays. 

# User

1. Configure the *User *settings. 
   - **User Search Base DN**: Enter a value. This Base DN (Distinguished Name) is the point in the LDAP directory tree that the LDAP service uses to initiate a user search. The Base DN is the latter part of the Bind DN. See [Find LDAP Distinguished Names (DN)](docId\:NwdYueYRA_TehYkmk_rQ7).
   - **Search Scope**: Select an option from the drop-down list.
     - **Base **limits the search to the base object. 
     - **One **restricts the search to "one level", or in other words, the immediate children of the base object. 
     - **Sub **enables a full LDAP tree search, including all children of the base object.
   - **User Search Filter**: Enter a filter to search LDAP users.
   - **Attribute for Unique UserID**: Enter the unique user ID number (uidNumber).
   - **Attribute for Username (for logging in)**: Enter the attribute that will be used for logins. 
   - **First Name**: Enter the user's first name.  
   - **Last Name**: Enter the user's surname. 
2. When done, click **Next**. 
   The *Groups *section displays. 

# Group

1. Configure the *Group *settings. 
   - **Group Search Base DN**: Enter a value. This Base DN (Distinguished Name) is the starting point that the LDAP service uses to find a group in the LDAP directory tree.
     Example of Group Base ND: 
     CN=Users,CN=Builtin,DC=MyDomain,DC=com
   - **Search** **Scope**: Select an option from the drop-down list. 
     - **Base **limits the search to the base object.
     - **One **restricts the search to "one level", as in the immediate children of the base object.
     - **Sub **enables a full LDAP tree search, including all children of the base object.
   - **Group Search Filter**: Enter a filter to query the Active Directory in the Group Search Filter field.
     See [How to write LDAP search filters](https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html) for more information about creating search filters.
     Example of a filter to query group objects with a common name (CN) starting with Admin:
     (&(objectCategory=group)(cn=Admin\*))
   - **Group Name Attribute**: Enter the common name (CN) for the group to search. 
   - **Group Membership Attribute**: Enter the distinguished name (DN) for the group to search.
   - **Member Value Type**: Enter the value type for members in the group, DN or CN. 
2. When done do one of the following:
   - Click **Test **to test the provider. 
   - Click **Save **to save the settings for the provider. 
   - Click **Create & Map Groups** to create the provider. 

The provider is created. Use this provider when logging in to Manufacturing Connect Edge.