The Lightweight Directory Access Protocol (LDAP) serves as a centralized access control system utilized by numerous small and medium-scale organizations.

By configuring the LDAP service, you can log in to your BizCentric account using LDAP credentials.

1. Prerequisites

To utilize LDAP, you must initially install the ldap3 Python module. Follow these steps:

1. Open a terminal session on the server hosting your BizCentric instance.
2. Navigate to the bizcentric-bench directory.
3. Execute the command: ./env/pip install ldap3

Once this installation is complete, you can proceed to enable the LDAP service in BizCentric.

2. Setting up LDAP

To setup LDAP, go to

Home > Integrations > LDAP Settings

Many parameters are mandatory to allow BizCentric to connect to LDAP. They are:

• LDAP Server URL: This denotes the URL to your LDAP server and must adhere to the format ldap://yourserver:port or ldaps://yourserver:port.
• Base Distinguished Name (DN): This represents the distinguished name of the user authorized to retrieve user details from your LDAP server. It should be a user with read-only permissions.
• Password for Base DN: This refers to the password associated with the user mentioned above, utilized for retrieving user details from your LDAP server.
• Organization Unit of Users: This pertains to the DN of the Organizational Unit that all users in your LDAP server must belong to in order to log into BizCentric.
• Default Role on Creation: Upon user creation in BizCentric, this default role will be assigned to them upon their initial login.
• LDAP Search String: This enables BizCentric to match the user/email provided in the login screen with the LDAP Server. For instance, you could use email address or username based on your preference, and it should be in the format: LDAPFIELD={0}
• Example for Active Directory username: sAMAccountName={0}
• Example for Open LDAP username: uid={0}
• LDAP Email Field: Specifies the LDAP field containing the user’s email address.
• Example for Active Directory and Open LDAP: mail
• LDAP Username Field: Specifies the LDAP field containing the user’s username.
• Example for Active Directory: sAMAccountName
• Example for Open LDAP: uid
• LDAP First Name Field: Specifies the LDAP field containing the user’s first name.
• Example for Active Directory: givenName
• Example for Open LDAP: sn

There are many other non-mandatory fields that you can use to map your LDAP user fields to the BizCentric user fields. They are:

• Middle Name
• Phone
• Mobile

Once you’ve ensured your settings are accurate, you can select the ‘Enabled’ checkbox at the top. Upon attempting to enable LDAP, BizCentric will endeavor to establish a connection with the LDAP server to verify the settings. If this connection attempt fails, you won’t be able to enable LDAP and an error message will be displayed.

The error message will specify the issue that needs to be addressed before proceeding.

Once LDAP is enabled, the system will present the ‘Login Via LDAP‘ option on the login screen.

2.1 LDAP Security

In the LDAP Security section, You have many options to connect securely to your LDAP server.

• SSL/TLS Mode

  Specifies whether you want to start a TLS session on initial connection to the LDAP server.

• Require Trusted Certificate

  Indicates whether a trusted certificate is necessary for connecting to the LDAP server.

  If a trusted certificate is required, you must provide the paths to your certificate files. These files should be located on your BizCentric server, and the following fields should contain absolute paths to the files on your server:

  • Path to private Key File
  • Path to Server Certificate
  • Path to CA Certs File

2.2 LDAP Group Mappings

Note that all BizCentric roles will be checked each time a user logs on and will be removed or added to the user’s permissions.

Within the LDAP Settings section, you’ll encounter two dropdown menus.

1. SSL/TLS Mode: Choose ‘StartTLS’ to establish a connection to your LDAP server using StartTLS. If your LDAP server doesn’t support StartTLS, selecting this option will trigger an error indicating that StartTLS is not supported. In such a case, review the configuration on your LDAP server to address this issue.
2. Require Trusted Certificate: By switching this to ‘Yes’, the certificate provided by the LDAP server must be trusted by the BizCentric server. If you prefer to utilize StartTLS with a self-signed (untrusted) certificate, set this option to ‘No’. Note that if you’re not using StartTLS, this setting becomes irrelevant.