---
title: LDAP and AD User Interface Examples
slug: manufacturing-connect-edge/ldap-and-ad-user-interface-examples
docTags:
createdAt: 2022-09-30T13:47:48.000Z
---
The following examples can be used to set up the LDAP Active Directory and LDAP rfc2307bis.
# Form Example
The following form examples are Active Directory and LDAP rfc2307bis.
## Active Directory
```Text
const PROVIDER_CONFIG = {
name: 'openldap',
type: 'ldap2307bis',
host: 'ldap.example.com',
port: 389,
tls: false,
bindDN: 'cn=system,dc=example,dc=com',
bindDNPassword: 'password',
userSearchBaseDN: 'ou=People,dc=example,dc=com',
userSearchScope: 'sub',
userFilter: '(objectClass=posixAccount)',
userAttrID: 'uidNumber',
userAttrUsername: 'uid',
userAttrFirstName: 'givenName',
userAttrLastName: 'sn',
groupSearchBaseDN: 'ou=Groups,dc=example,dc=com',
groupSearchScope: 'sub',
groupFilter: '(objectClass=posixGroup)',
groupAttrName: 'cn',
groupAttrUser: 'dn',
groupAttrType: 'member'
};
```
## LDAP rfc2307bis
```Text
const PROVIDER_CONFIG = {
name: 'openldap',
type: 'ldap2307bis',
host: 'ldap.example.com',
port: 389,
tls: false,
bindDN: 'cn=system,dc=example,dc=com',
bindDNPassword: 'password',
userSearchBaseDN: 'ou=People,dc=example,dc=com',
userSearchScope: 'sub',
userFilter: '(objectClass=posixAccount)',
userAttrID: 'uidNumber',
userAttrUsername: 'uid',
userAttrFirstName: 'givenName',
userAttrLastName: 'sn',
groupSearchBaseDN: 'ou=Groups,dc=example,dc=com',
groupSearchScope: 'sub',
groupFilter: '(objectClass=posixGroup)',
groupAttrName: 'cn',
groupAttrUser: 'dn',
groupAttrType: 'member'
};
```
More examples for Active Directory filter can be found at [Active Directory](http://adfilters.blogspot.com/2015/03/active-directory-ldap-filter-querys.html).
# Field Definitions
| **Definition** | **Description** |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Name of this connector. |
| Type | The connector type. Only the Generic type is currently supported. |
| Connection | These fields are attributes of the server connection. |
| Host | Domain name or IP address of the LDAP host.
|
| Port | The LDAP port. |
| Use TLS | Enable or disable LAPS protocol for a secure connection. TLS settings should match the port. LDAP servers use port 389 for LDAP protocol and port 636 for LDAPS protocol. The connection fails if port 389 is specified and the Use TLS option is enabled.
|
| Bind DN | Account used to connect to the LDAP server (only requires read and browse permissions). The distinguished name of the account used for accessing LDAP server. An anonymous connect is used of Bind DN is not specified. |
| CA Certificate Chain | Trusted root certificate chain (only required if private CA is used by the server).
* The CA Certificate Chain file is only available if the **Use TLS **option is selected.
* The CA Certificate Chain field can be left blank if the server certificate is issued by a public CA.
* Private root certificates can be added to the trusted store using **System **>** Certificates**. In this case, the CA Certificate Chain field can be left blank. |
| Bind DN Password | Password for Bind DN |
| Users | These attributes are used to find user accounts in the LDAP server. |
| User Search Base DN | Distinguished name of the entity where search for users starts
. |
| Search Scope | The Search Scope is an option. sub, one or base indicate the search scope (sub is the default).
* **sub **is used to indicate searching of all entries at all levels under and including the specified base DN.
* **one **is used to indicate searching all entries on level under the base DN. This does not include the base DN and any entries under that one level under the base DN.
* **base **is used to indicate searching only the entry being returned. It must meet the search filter criteria. |
| User Search Filter | The LDAP filter used to identify user accounts. |
| Attribute for Unique User ID | LDAP attribute to uniquely identify a user. The typical value is uidNumber for rfc2307 and object GUID for AD
. |
| Attribute for Username | An LDAP attribute containing the username for logging in. It is usually uid for sAMAccountName for AD
. |
| Attribute for First Name | An LDAP attribute that contains the first name of the user. The default value is givenName.
|
| Attribute for Last Name | An LDAP attribute contains the last name of the user. The default value is sn
. |
| Groups | These attributes are used to find groups in the LDAP server. User roles are derived from group names. For example, administrator is matched against Manufacturing Connect Edge user roles. |
| Group Search Base DN | The distinguished name of the entity where search for group starts. |
| Group Search Filter | The LDAP filter used to identify user groups
. |
| Group Name Attribute | The attribute name containing the group name (usually cn)
. |
| Group Membership Attribute | The attribute name that contains the list of group members (usually member)
.
* The most common group membership scheme is when the group object contains multiple member attributes that contain the DN name of the member account.
* However, there is an old rfc2703 standard that uses the reverse mechanism when the user object contains a list of group names.
* The old rfc2703 standard is not supported by the Generic connector.
|
| Member value type | The type of the member value (values are dnor uid). This attribute is case sensitive. |
| Test | These values are used for testing connectivity.
|
| UserID | The userid. |
| Password | The password. |
# Test Failure
If the test fails, you should receive a detailed message about the reason for failure. Here is a list of a few possible failure reasons:
- **Unable to connect to the server**: Wrong address/DNS name or port of the of the LDAP host.
- **Protocol mismatch**: Connecting with TLS to the port that doesn't support authentication.
- **Certificate validation failure**: Missing or invalid rootCA.
- **User not found**: Indicates broad range of possible problems like invalid search path, invalid filter, or invalid attributes for username or userid.
- **User attribute not found**: When one of the user attributes is either missing or empty.
- **Group not found**: If search path, scope, or filter are invalid.
- **Group attribute not found**: If any of the group attributes is empty or missing.
- **Authentication failure**: If authentication fails, this usually means invalid username or password.
- **Authorization failure**: Means that returned set of scopes does not match those of the requested role.
:::hint{type="info"}
**Note**: The **Save **button is only available if the test successfully completes.
:::