en-US - - English

Windows AD Provider

The Active-directory provider form has these fields:

  • Name* - the name of the new provider, which can be chosen at the bottom of the PassMan sign-in page.
  • Servers* - the address of the servers that do the sign-in, given by IP address or FQDN. For secure LDAP (LDAPS), put the ldaps:// prefix before the machine name. With an FQDN, the system works only if the DNS server set in PassMan resolves the requests correctly.
  • Base DN* (domain name) - the subtree of AD that you want PassMan to reach for authentication. Example: dc=demopassmanad,dc=local. If you copy the Base DN from somewhere, delete the opening and closing quotation marks, if there are any.
  • Tech user username* and Tech user password* - used to sign in. The user must be able to search the AD user list (right: search and bind authentication). If you get an error when you select Load groups, enter the user name in UPN form (for example, techuser@example.com).
  • Certificate - with LDAPS, you must give the certificate of the server.
  • Only visible OU-s - if AD has very many items, you can speed up PassMan considerably by giving only the OUs that hold the users and groups. If this field is left empty, PassMan searches the whole AD.
  • Use SAML auth - see SAML2 settings.
  • Authentication groups - only users in the groups given here can sign in to PassMan. If this field is left empty, EVERYONE among the provider's users can sign in to PassMan.
  • Permission groups - the groups (from AD) that you want to set permissions for in PassMan. If this field is left empty, all groups appear when permissions are assigned in PassMan.

You can fill in the group names by hand (type the name, then Enter), or select Load groups and type 3 characters to get a list of matches to choose from. (The technical user's data, and with LDAPS the certificate, must be filled in first.)

Error messages

  • Could not connect (ConnectionError) - the provider's server is not reachable.
  • Could not connect (LDAPInvalidDnError) - the Base DN parameter is wrong. (Check that there is no quotation mark at the start or end of the field.)
  • Could not connect (Error occurred during communication with Active Directory {'error': 'AD LDAP Error', 'exception': 'LDAPSocketOpenError'}) - the Base DN parameter is wrong (check that there is no quotation mark at the start or end of the field), or the given AD server is not reachable.
  • Could not connect (Error occurred during communication with Active Directory {'error': 'AD LDAP authentication failed', 'exception': 'LDAPInvalidCredentialsResult'}) - wrong user name or password.
  • Could not connect (LDAPSocketSendError) - with LDAPS, the server certificate is not given.
  • Could not connect (Supplied authentication config is invalid {'provider': 'demoAD', 'provider_type': 'active-directory-ldap', 'error': 'servers must be the list of ADDS servers'}) - no server is given.

Status codes

  • 400 - the user name, the password or one of the parameters is not correct.
  • 500 - unhandled error.
  • 503 - timeout.