---
title: Registering LDAP Connection
slug: helium-en/registering-ldap-connection
description: Learn how to configure LDAP in 4biz to allow users to authenticate using their directory service credentials. This document provides step-by-step instructions on setting up a connection, mapping LDAP attributes, testing the connection, and importing the s
createdAt: 2021-10-11T15:38:52.000Z
---
LDAP (**Lightweight Directory Access Protocol**) is a standard protocol that allows managing directories, that is, accessing information banks about the users of a network through TCP/IP protocols.
You can configure **4biz** to query available user bases in a directory service (Microsoft Active Directory or open-LDAP), which allows these users to authenticate at **4biz** by using their credentials without having to manually enroll them (at **4biz**).
Today, the reading of data from an AD/LDAP server boils down to the "user" object. That way you can use filters to bring them to **4biz**.
Moreover, you can use the "**Field Mapping**" option to upload attribute information (e.g.: e-mail, phone, location, and others).
Below is an authentication model for **4biz** ******Cloud** customers who want to use their on-premises directory base.
## Before getting started
- [x] If you want to set up and synchronize automatically the users, **it is necessary to create a CRON** for this purpose (e.g.: synchronize users every day at 12:00 AM).
- [x] To create a schedule go to `Processes > Event Management > Time`.
## Procedure
### Configuring connection
1. Access the menu `Parametrization > LDAP Configuration`;
2. Click on the "**New**" button;
3. Complete all the fields available;
| **Field** | **Description** | **Example** |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------- |
| **Implementation** | Type of directory server | AD/OpenLDAP |
| **URL Conexão** | Access address to the directory database. Note that you can use an unencrypted (port 389) or encrypted (port 636) connection | ldaps\://auth.domain.com:636 |
| **DN Base** | DN Base is used to search user entries. | dc=domain,dc=com |
| **DN Alias** | Domain/Connection name, this name will be visible on the login screen | domain.com |
| **Filter** | Filter for the query of objects in directories | (&(objectCategory=person)(objectClass=user)) |
| **DN Manager** | User with permission to search the directory. In this case, enter the value according to the "distinguishedName" attribute of the AD | CN=Service User,OU=COMPANY,DC=domain,DC=com |
| **Pwd Manager** | DN Password Manager | **\*\*\*\*\*** |
| **Default Setting** | If the connection is available on the login screen | Yes/No |
:::hint{type="warning"}
📌 **IMPORTANT****!**
If there are no DN Groups, fill in the "**DN Group**" field only with an asterisk. This will cause the system to check the entire domain.
:::
4\. Check connectivity with the base by clicking on "**Test Connection**", if all data is correct, you will receive the message "**Connection successful**";
5\. Click on "**Save**".
:::hint{type="warning"}
⚠ **Attention****!**
Before asking to test, you must click the "**Save**" button to save the setting; otherwise, the test will use the data prior to the changes made on the screen.
:::
### Configuring DN Group and Appointments
After you have successfully configured a connection, you must add preferences for user synchronization, in which case you must enter LDAP Groups and Field Mapping. For "**LDAP Groups**" you have the possibility to create customizations where certain users will automatically inherit permissions in **4biz** via linkage with the Access Profile or Group.
For the "**Field Mapping**" item, you can configure the application to read AD/LDAP attribute information and bring it into the employee record (e.g.: read the "**mail**" attribute and feed the "**email**" field of employee).
1. To link new groups, click on "**Add**" in the **LDAP Groups** area and enter the data:
| **Field** | **Description** | **Example** |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------- |
| **DN Group** | Path to the DN Group | OU=Users,OU=Company |
| **Filter** | Filter for object search. Leave blank to use the one defined on the connection | (&(objectCategory=person)(objectClass=user)) |
| **Attribute for Name** | Enter attribute to read name (e.g., CN, SamAccountName, etc.) | CN |
| **Update links**
| The Frequency with which the fields "Access Profile" and "Group" will be updated when performing a synchronization (Options: Always, Never, or Only when creating) | Always |
| **Access Profile** | System profile that users will inherit | Administrator |
| **Group** | System group that users will be inserted | Managers |
| **Schedule** | The Period when automatic synchronization will be performed | \[Every day]\*
|
2\. To link attributes to fields, click on "**Add**" in the **Field Mapping** area, enter the name of the LDAP field and select the corresponding field in **4biz**;
| **The Field in the LDAP** | **The Field in the system** |
| ------------------------- | --------------------------- |
| E-mail | E-mail |
| TelephoneNumber | Telephone |
| localeID | Locality |
3\. Click on "**Save**".
:::hint{type="info"}
🖊 **Note****: **When there is an authentication request on the system identification screen (login and password), a correct connection search cycle is executed based on this configuration, that is, there is an authentication attempt for each domain registered here (if there is more than one).
:::
## To use LDAP protocol
Using the LDAPS protocol in **4biz** requires the AD/LDAP server public certificate in the JAVA CA certificate store (on your Wildfly server). Therefore, you must export it from the AD/LDAP server and import it into your instance. If you have questions about importing certificates on the application server, see the installation document.
## What to do next
To use AD/LDAP authentication effectively, after registering the connection, change **parameter 22** and enter a value equal to "**2**", that is, indicate that the default authentication method in **4biz** is AD/LDAP. However, manual authentication will continue to function normally.