Enable LDAP and sync teams and users

Once you enable LDAP you can sync your LDAP directory to the teams and users that are present in MKE.

To enable LDAP and sync to your LDAP directory:

  1. Log in to the MKE web UI as an MKE administrator.

  2. Under your user name drop-down, click Admin Settings > Authentication & Authorization.

  3. Scroll down and click Enabled next to LDAP. A list of LDAP settings displays.

  4. Enter the values that correspond with your LDAP server installation.

  5. Test your configuration in MKE.

  6. Create a team in MKE to mirror your LDAP directory.

  7. Select ENABLE SYNC TEAM MEMBERS.

  8. Choose between the following two methods for matching group members from an LDAP directory. Refer to the table below for more information.

    • Select LDAP MATCH METHOD to change the method for matching group members in the LDAP directory from Match Search Results (default) to Match Group Members. Fill out Group DN and Group Member Attribute as required.

    • Keep the default Match Search Results method and fill out Search Base DN, Search filter, and Search subtree instead of just one level as required.

  9. Optional. Select Immediately Sync Team Members to run an LDAP sync operation immediately after saving the configuration for the team.

  10. Optional. To allow non-LDAP team members to sync the LDAP directory, select Allow non-LDAP members.

    Note

    you do not select Allow non-LDAP members, manually-added and SAML users will be removed during the LDAP sync.

  11. Click Create.


There are two methods for matching group members from an LDAP directory:

Bind method

Description

Match Group Members (direct bind)

Specifies that team members are synced directly with members of a group in the LDAP directory of your organization. The team membership is synced to match the membership of the group.

Group DN

The distinguished name of the group from which you select users.

Group Member Attribute

The value of this group attribute corresponds to the distinguished names of the members of the group.

Match Search Results (search bind)

Specifies that team members are synced using a search query against the LDAP directory of your organization. The team membership is synced to match the users in the search results.

Search Base DN

The distinguished name of the node in the directory tree where the search starts looking for users.

Search filter

Filter to find users. If empty, existing users in the search scope are added as members of the team.

Search subtree instead of just one level

Defines search through the full LDAP tree, not just one level, starting at the base DN.