[{"data":1,"prerenderedAt":1584},["ShallowReactive",2],{"navigation_docs_en":3,"-en-sign-in-and-directories-directory-services":427,"-en-sign-in-and-directories-directory-services-surround":1579},[4,31,117,188,238,271,310,369,378],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":30},"Getting started","i-hugeicons-rocket-01","\u002Fen\u002Fgetting-started","en\u002F01.getting-started",[10,15,20,25],{"title":11,"path":12,"stem":13,"icon":14},"What is DDM?","\u002Fen\u002Fgetting-started\u002Fwhat-is-ddm","en\u002F01.getting-started\u002F01.what-is-ddm","i-hugeicons-information-circle",{"title":16,"path":17,"stem":18,"icon":19},"Account and sign-in","\u002Fen\u002Fgetting-started\u002Fsign-in","en\u002F01.getting-started\u002F02.sign-in","i-hugeicons-key-01",{"title":21,"path":22,"stem":23,"icon":24},"AI in DDM","\u002Fen\u002Fgetting-started\u002Fai-in-ddm","en\u002F01.getting-started\u002F03.ai-in-ddm","i-hugeicons-ai-magic",{"title":26,"path":27,"stem":28,"icon":29},"System status","\u002Fen\u002Fgetting-started\u002Fsystem-status","en\u002F01.getting-started\u002F04.system-status","i-hugeicons-activity-03",false,{"title":32,"icon":33,"path":34,"stem":35,"children":36,"page":30},"CMS","i-hugeicons-dashboard-square-01","\u002Fen\u002Fcms","en\u002F02.cms",[37,42,47,52,57,62,67,72,77,82,87,92,97,102,107,112],{"title":38,"path":39,"stem":40,"icon":41},"The CMS at a glance","\u002Fen\u002Fcms\u002Foverview","en\u002F02.cms\u002F01.overview","i-hugeicons-compass-01",{"title":43,"path":44,"stem":45,"icon":46},"Uploading documents","\u002Fen\u002Fcms\u002Fupload","en\u002F02.cms\u002F02.upload","i-hugeicons-upload-01",{"title":48,"path":49,"stem":50,"icon":51},"Categories","\u002Fen\u002Fcms\u002Fcategories","en\u002F02.cms\u002F03.categories","i-hugeicons-folder-tree",{"title":53,"path":54,"stem":55,"icon":56},"Editing documents","\u002Fen\u002Fcms\u002Fdocuments","en\u002F02.cms\u002F04.documents","i-hugeicons-file-edit",{"title":58,"path":59,"stem":60,"icon":61},"Searching and filtering","\u002Fen\u002Fcms\u002Fsearch-and-filters","en\u002F02.cms\u002F05.search-and-filters","i-hugeicons-search-01",{"title":63,"path":64,"stem":65,"icon":66},"Groups and permissions","\u002Fen\u002Fcms\u002Fgroups-and-permissions","en\u002F02.cms\u002F06.groups-and-permissions","i-hugeicons-user-multiple",{"title":68,"path":69,"stem":70,"icon":71},"Users","\u002Fen\u002Fcms\u002Fusers","en\u002F02.cms\u002F07.users","i-hugeicons-user-add-01",{"title":73,"path":74,"stem":75,"icon":76},"Approvals","\u002Fen\u002Fcms\u002Fapprovals","en\u002F02.cms\u002F08.approvals","i-hugeicons-checkmark-badge-01",{"title":78,"path":79,"stem":80,"icon":81},"Markets and translations","\u002Fen\u002Fcms\u002Fmarkets-and-translations","en\u002F02.cms\u002F09.markets-and-translations","i-hugeicons-globe-02",{"title":83,"path":84,"stem":85,"icon":86},"Note templates","\u002Fen\u002Fcms\u002Fnote-templates","en\u002F02.cms\u002F10.note-templates","i-hugeicons-layout-01",{"title":88,"path":89,"stem":90,"icon":91},"Usage and audit log","\u002Fen\u002Fcms\u002Fusage-and-audit","en\u002F02.cms\u002F11.usage-and-audit","i-hugeicons-chart-column",{"title":93,"path":94,"stem":95,"icon":96},"AI assistant","\u002Fen\u002Fcms\u002Fassistant","en\u002F02.cms\u002F12.assistant","i-hugeicons-sparkles",{"title":98,"path":99,"stem":100,"icon":101},"Settings","\u002Fen\u002Fcms\u002Fsettings","en\u002F02.cms\u002F13.settings","i-hugeicons-settings-02",{"title":103,"path":104,"stem":105,"icon":106},"Plans","\u002Fen\u002Fcms\u002Fplans","en\u002F02.cms\u002F14.plans","i-hugeicons-package",{"title":108,"path":109,"stem":110,"icon":111},"Feature requests","\u002Fen\u002Fcms\u002Ffeature-requests","en\u002F02.cms\u002F15.feature-requests","i-hugeicons-idea-01",{"title":113,"path":114,"stem":115,"icon":116},"Report a bug","\u002Fen\u002Fcms\u002Fbug-reports","en\u002F02.cms\u002F16.bug-reports","i-hugeicons-bug-01",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":30},"App","i-hugeicons-smart-phone-01","\u002Fen\u002Fapp","en\u002F03.app",[123,128,133,138,143,147,152,157,162,167,170,173,176,179,184],{"title":124,"path":125,"stem":126,"icon":127},"Signing in and finding your way","\u002Fen\u002Fapp\u002Foverview","en\u002F03.app\u002F01.overview","i-hugeicons-login-03",{"title":129,"path":130,"stem":131,"icon":132},"Tabs and split view","\u002Fen\u002Fapp\u002Ftabs","en\u002F03.app\u002F02.tabs","i-hugeicons-layout-2-column",{"title":134,"path":135,"stem":136,"icon":137},"Finding and reading documents","\u002Fen\u002Fapp\u002Fdocuments","en\u002F03.app\u002F03.documents","i-hugeicons-file-01",{"title":139,"path":140,"stem":141,"icon":142},"Favorites","\u002Fen\u002Fapp\u002Ffavorites","en\u002F03.app\u002F04.favorites","i-hugeicons-favourite",{"title":144,"path":145,"stem":146,"icon":61},"Searching","\u002Fen\u002Fapp\u002Fsearch","en\u002F03.app\u002F05.search",{"title":148,"path":149,"stem":150,"icon":151},"Notes","\u002Fen\u002Fapp\u002Fnotes","en\u002F03.app\u002F06.notes","i-hugeicons-note-edit",{"title":153,"path":154,"stem":155,"icon":156},"Calendar and appointments","\u002Fen\u002Fapp\u002Fcalendar","en\u002F03.app\u002F07.calendar","i-hugeicons-calendar-03",{"title":158,"path":159,"stem":160,"icon":161},"Sending to customers","\u002Fen\u002Fapp\u002Foutbox","en\u002F03.app\u002F08.outbox","i-hugeicons-sent",{"title":163,"path":164,"stem":165,"icon":166},"Working offline","\u002Fen\u002Fapp\u002Foffline","en\u002F03.app\u002F09.offline","i-hugeicons-wifi-off-01",{"title":93,"path":168,"stem":169,"icon":96},"\u002Fen\u002Fapp\u002Fassistant","en\u002F03.app\u002F10.assistant",{"title":98,"path":171,"stem":172,"icon":101},"\u002Fen\u002Fapp\u002Fsettings","en\u002F03.app\u002F11.settings",{"title":108,"path":174,"stem":175,"icon":111},"\u002Fen\u002Fapp\u002Ffeature-requests","en\u002F03.app\u002F12.feature-requests",{"title":113,"path":177,"stem":178,"icon":116},"\u002Fen\u002Fapp\u002Fbug-reports","en\u002F03.app\u002F13.bug-reports",{"title":180,"path":181,"stem":182,"icon":183},"Desktop app","\u002Fen\u002Fapp\u002Fdesktop-app","en\u002F03.app\u002F14.desktop-app","i-hugeicons-computer",{"title":185,"path":186,"stem":187,"icon":119},"Mobile app","\u002Fen\u002Fapp\u002Fmobile-app","en\u002F03.app\u002F15.mobile-app",{"title":189,"icon":190,"path":191,"stem":192,"children":193,"page":30},"Sign-in & directories","i-hugeicons-security-check","\u002Fen\u002Fsign-in-and-directories","en\u002F04.sign-in-and-directories",[194,198,202,207,212,217,222,226,230,234],{"title":195,"path":196,"stem":197,"icon":19},"Sign-in methods","\u002Fen\u002Fsign-in-and-directories\u002Fsign-in-methods","en\u002F04.sign-in-and-directories\u002F01.sign-in-methods",{"title":199,"path":200,"stem":201,"icon":190},"Single sign-on","\u002Fen\u002Fsign-in-and-directories\u002Fsingle-sign-on","en\u002F04.sign-in-and-directories\u002F02.single-sign-on",{"title":203,"path":204,"stem":205,"icon":206},"Directory services (LDAP)","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-services","en\u002F04.sign-in-and-directories\u002F03.directory-services","i-hugeicons-hierarchy",{"title":208,"path":209,"stem":210,"icon":211},"Synchronisation and sign-in","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-sync","en\u002F04.sign-in-and-directories\u002F04.directory-sync","i-hugeicons-refresh",{"title":213,"path":214,"stem":215,"icon":216},"Microsoft Entra ID","\u002Fen\u002Fsign-in-and-directories\u002Fmicrosoft-entra-id","en\u002F04.sign-in-and-directories\u002F05.microsoft-entra-id","i-hugeicons-building-03",{"title":218,"path":219,"stem":220,"icon":221},"Okta","\u002Fen\u002Fsign-in-and-directories\u002Fokta","en\u002F04.sign-in-and-directories\u002F06.okta","i-hugeicons-finger-print",{"title":223,"path":224,"stem":225,"icon":81},"Google Workspace","\u002Fen\u002Fsign-in-and-directories\u002Fgoogle-workspace","en\u002F04.sign-in-and-directories\u002F07.google-workspace",{"title":227,"path":228,"stem":229,"icon":119},"Two-factor authentication","\u002Fen\u002Fsign-in-and-directories\u002Ftwo-factor-authentication","en\u002F04.sign-in-and-directories\u002F08.two-factor-authentication",{"title":231,"path":232,"stem":233,"icon":221},"Passkeys","\u002Fen\u002Fsign-in-and-directories\u002Fpasskeys","en\u002F04.sign-in-and-directories\u002F09.passkeys",{"title":235,"path":236,"stem":237,"icon":156},"Calendar access","\u002Fen\u002Fsign-in-and-directories\u002Fcalendar-access","en\u002F04.sign-in-and-directories\u002F10.calendar-access",{"title":239,"icon":240,"path":241,"stem":242,"children":243,"page":30},"MCP server","i-hugeicons-ai-network","\u002Fen\u002Fmcp-server","en\u002F05.mcp-server",[244,248,253,257,262,266],{"title":245,"path":246,"stem":247,"icon":240},"Overview","\u002Fen\u002Fmcp-server\u002Foverview","en\u002F05.mcp-server\u002F01.overview",{"title":249,"path":250,"stem":251,"icon":252},"Setup","\u002Fen\u002Fmcp-server\u002Fsetup","en\u002F05.mcp-server\u002F02.setup","i-hugeicons-plug-socket",{"title":254,"path":255,"stem":256,"icon":111},"What you can do with it","\u002Fen\u002Fmcp-server\u002Fuse-cases","en\u002F05.mcp-server\u002F03.use-cases",{"title":258,"path":259,"stem":260,"icon":261},"Tools","\u002Fen\u002Fmcp-server\u002Ftools","en\u002F05.mcp-server\u002F04.tools","i-hugeicons-wrench-01",{"title":263,"path":264,"stem":265,"icon":76},"Approving changes","\u002Fen\u002Fmcp-server\u002Fapproving-changes","en\u002F05.mcp-server\u002F05.approving-changes",{"title":267,"path":268,"stem":269,"icon":270},"Administration & security","\u002Fen\u002Fmcp-server\u002Fadmin-and-security","en\u002F05.mcp-server\u002F06.admin-and-security","i-hugeicons-shield-key",{"title":272,"icon":273,"path":274,"stem":275,"children":276,"page":30},"External sources","i-hugeicons-database-sync","\u002Fen\u002Fexternal-sources","en\u002F06.external-sources",[277,280,285,290,295,300,305],{"title":245,"path":278,"stem":279,"icon":273},"\u002Fen\u002Fexternal-sources\u002Foverview","en\u002F06.external-sources\u002F01.overview",{"title":281,"path":282,"stem":283,"icon":284},"SharePoint","\u002Fen\u002Fexternal-sources\u002Fsharepoint","en\u002F06.external-sources\u002F02.sharepoint","i-hugeicons-microsoft",{"title":286,"path":287,"stem":288,"icon":289},"OneDrive","\u002Fen\u002Fexternal-sources\u002Fonedrive","en\u002F06.external-sources\u002F03.onedrive","i-hugeicons-folder-cloud",{"title":291,"path":292,"stem":293,"icon":294},"Google Drive","\u002Fen\u002Fexternal-sources\u002Fgoogle-drive","en\u002F06.external-sources\u002F04.google-drive","i-hugeicons-google-drive",{"title":296,"path":297,"stem":298,"icon":299},"FTP \u002F SFTP","\u002Fen\u002Fexternal-sources\u002Fftp-sftp","en\u002F06.external-sources\u002F05.ftp-sftp","i-hugeicons-server-stack-01",{"title":301,"path":302,"stem":303,"icon":304},"REST interface","\u002Fen\u002Fexternal-sources\u002Frest","en\u002F06.external-sources\u002F06.rest","i-hugeicons-api",{"title":306,"path":307,"stem":308,"icon":309},"SOAP interface","\u002Fen\u002Fexternal-sources\u002Fsoap","en\u002F06.external-sources\u002F07.soap","i-hugeicons-source-code",{"title":311,"icon":304,"path":312,"stem":313,"children":314,"page":30},"Integration API","\u002Fen\u002Fintegration-api","en\u002F07.integration-api",[315,318,322,327,332,337,341,346,350,354,359,364],{"title":245,"path":316,"stem":317,"icon":14},"\u002Fen\u002Fintegration-api\u002Foverview","en\u002F07.integration-api\u002F01.overview",{"title":319,"path":320,"stem":321,"icon":19},"Authentication","\u002Fen\u002Fintegration-api\u002Fauthentication","en\u002F07.integration-api\u002F02.authentication",{"title":323,"path":324,"stem":325,"icon":326},"Conventions","\u002Fen\u002Fintegration-api\u002Fconventions","en\u002F07.integration-api\u002F03.conventions","i-hugeicons-book-open-01",{"title":328,"path":329,"stem":330,"icon":331},"Pushing documents","\u002Fen\u002Fintegration-api\u002Fpushing-documents","en\u002F07.integration-api\u002F04.pushing-documents","i-hugeicons-upload-02",{"title":333,"path":334,"stem":335,"icon":336},"Consuming content","\u002Fen\u002Fintegration-api\u002Fconsuming-content","en\u002F07.integration-api\u002F05.consuming-content","i-hugeicons-download-02",{"title":338,"path":339,"stem":340,"icon":137},"Reference: documents","\u002Fen\u002Fintegration-api\u002Freference-documents","en\u002F07.integration-api\u002F06.reference-documents",{"title":342,"path":343,"stem":344,"icon":345},"Reference: categories, tags, markets","\u002Fen\u002Fintegration-api\u002Freference-categories-tags","en\u002F07.integration-api\u002F07.reference-categories-tags","i-hugeicons-folder-01",{"title":347,"path":348,"stem":349,"icon":211},"Reference: sync manifest","\u002Fen\u002Fintegration-api\u002Freference-sync","en\u002F07.integration-api\u002F08.reference-sync",{"title":351,"path":352,"stem":353,"icon":309},"OpenAPI","\u002Fen\u002Fintegration-api\u002Fopenapi","en\u002F07.integration-api\u002F09.openapi",{"title":355,"path":356,"stem":357,"icon":358},"Changelog","\u002Fen\u002Fintegration-api\u002Fchangelog","en\u002F07.integration-api\u002F10.changelog","i-hugeicons-time-schedule",{"title":360,"path":361,"stem":362,"icon":363},"Reference: groups, markets, access","\u002Fen\u002Fintegration-api\u002Freference-groups-access","en\u002F07.integration-api\u002F11.reference-groups-access","i-hugeicons-user-lock-01",{"title":365,"path":366,"stem":367,"icon":368},"Moving from CMWS","\u002Fen\u002Fintegration-api\u002Fcmws","en\u002F07.integration-api\u002F12.cmws","i-hugeicons-arrow-reload-horizontal",{"title":370,"icon":371,"path":372,"stem":373,"children":374,"page":30},"What's new","i-hugeicons-gift","\u002Fen\u002Fwhats-new","en\u002F08.whats-new",[375],{"title":355,"path":376,"stem":377,"icon":358},"\u002Fen\u002Fwhats-new\u002Fchangelog","en\u002F08.whats-new\u002F01.changelog",{"title":379,"icon":299,"path":380,"stem":381,"children":382,"page":30},"Self-hosting","\u002Fen\u002Fself-hosting","en\u002F09.self-hosting",[383,386,390,395,399,404,408,413,418,422],{"title":245,"path":384,"stem":385,"icon":14},"\u002Fen\u002Fself-hosting\u002Foverview","en\u002F09.self-hosting\u002F01.overview",{"title":387,"path":388,"stem":389,"icon":106},"Docker Compose","\u002Fen\u002Fself-hosting\u002Fdocker-compose","en\u002F09.self-hosting\u002F02.docker-compose",{"title":391,"path":392,"stem":393,"icon":394},"Kubernetes","\u002Fen\u002Fself-hosting\u002Fkubernetes","en\u002F09.self-hosting\u002F03.kubernetes","i-hugeicons-cloud",{"title":396,"path":397,"stem":398,"icon":101},"Configuration","\u002Fen\u002Fself-hosting\u002Fconfiguration","en\u002F09.self-hosting\u002F04.configuration",{"title":400,"path":401,"stem":402,"icon":403},"Licence","\u002Fen\u002Fself-hosting\u002Flicence","en\u002F09.self-hosting\u002F05.licence","i-hugeicons-license",{"title":405,"path":406,"stem":407,"icon":211},"Updates","\u002Fen\u002Fself-hosting\u002Fupdates","en\u002F09.self-hosting\u002F06.updates",{"title":409,"path":410,"stem":411,"icon":412},"Postgres","\u002Fen\u002Fself-hosting\u002Fpostgres","en\u002F09.self-hosting\u002F07.postgres","i-hugeicons-database",{"title":414,"path":415,"stem":416,"icon":417},"Backups","\u002Fen\u002Fself-hosting\u002Fbackups","en\u002F09.self-hosting\u002F08.backups","i-hugeicons-database-restore",{"title":419,"path":420,"stem":421,"icon":261},"Troubleshooting","\u002Fen\u002Fself-hosting\u002Ftroubleshooting","en\u002F09.self-hosting\u002F09.troubleshooting",{"title":423,"path":424,"stem":425,"icon":426},"Firewall","\u002Fen\u002Fself-hosting\u002Ffirewall","en\u002F09.self-hosting\u002F10.firewall","i-hugeicons-firewall",{"id":428,"title":203,"body":429,"description":1572,"extension":1573,"links":1574,"meta":1575,"navigation":1576,"path":204,"seo":1577,"stem":205,"__hash__":1578},"docs_en\u002Fen\u002F04.sign-in-and-directories\u002F03.directory-services.md",{"type":430,"value":431,"toc":1549},"minimark",[432,441,476,486,498,503,506,596,600,610,737,754,766,770,780,787,867,871,894,898,905,915,960,964,970,980,987,990,996,1002,1008,1011,1015,1021,1092,1107,1163,1180,1184,1194,1223,1226,1230,1243,1308,1311,1325,1331,1334,1348,1352,1362,1474,1484,1488,1508,1511,1521,1530,1534],[433,434,435,436,440],"p",{},"A directory service connects DDM to your company's user directory – usually ",[437,438,439],"strong",{},"Active Directory",", but any LDAP directory works (OpenLDAP, FreeIPA, Samba, the LDAP interface of Okta or JumpCloud …). Once it is set up:",[442,443,444,452,458,469],"ul",{},[445,446,447,448,451],"li",{},"DDM ",[437,449,450],{},"creates accounts"," for your people – you do not invite them one by one,",[445,453,454,457],{},[437,455,456],{},"sorts them into groups"," according to your rules, so they see the right categories straight away,",[445,459,460,461,464,465,468],{},"keeps names, addresses and group memberships ",[437,462,463],{},"up to date",", and ",[437,466,467],{},"blocks"," people who have left,",[445,470,471,472,475],{},"and your people ",[437,473,474],{},"sign in with their company password"," – DDM never stores it.",[433,477,478,479,481,482,485],{},"You find it in the CMS under ",[437,480,98],{}," › ",[437,483,484],{},"Directory services",". Only administrators see it.",[487,488,489,490,493,494,497],"note",{},"Available from the ",[437,491,492],{},"Professional"," plan – see ",[495,496,103],"a",{"href":104},".",[499,500,502],"h2",{"id":501},"before-you-start","Before you start",[433,504,505],{},"Have these ready – your IT department will know them:",[507,508,510,515,523,527,546,550,564,568,583,587],"steps",{"level":509},"3",[511,512,514],"h3",{"id":513},"the-address-of-the-directory","The address of the directory",[433,516,517,518,522],{},"Host name and port of a domain controller or LDAP server, e.g. ",[519,520,521],"code",{},"dc01.company.local",". The DDM server must be able to reach it: on-premise that is usually the case, with a hosted DDM the directory has to be reachable from outside (e.g. through a firewall rule for DDM's address).",[511,524,526],{"id":525},"a-service-account","A service account",[433,528,529,530,533,534,537,538,541,542,545],{},"A user that may ",[437,531,532],{},"read"," the directory – nothing more. DDM uses it to search for people. Its full name (the ",[437,535,536],{},"Bind DN",") looks like ",[519,539,540],{},"CN=svc-ddm,OU=Service Accounts,DC=company,DC=local","; in Active Directory ",[519,543,544],{},"svc-ddm@company.local"," also works.",[511,547,549],{"id":548},"where-your-people-are","Where your people are",[433,551,552,553,556,557,560,561,497],{},"The ",[437,554,555],{},"Base DN"," – the part of the directory under which your users are, e.g. ",[519,558,559],{},"OU=Staff,DC=company,DC=local"," or simply ",[519,562,563],{},"DC=company,DC=local",[511,565,567],{"id":566},"your-e-mail-domain-is-confirmed","Your e-mail domain is confirmed",[433,569,570,571,481,573,481,576,579,580,497],{},"Under ",[437,572,98],{},[437,574,575],{},"Organisation",[437,577,578],{},"E-mail domains"," your company's domain must be listed and confirmed – DDM only creates accounts for addresses on a confirmed domain. See ",[495,581,195],{"href":582},"\u002Fen\u002Fsign-in-and-directories\u002Fsign-in-methods#your-e-mail-domains",[511,584,586],{"id":585},"the-groups-exist","The groups exist",[433,588,589,590,593,594,497],{},"Create the DDM groups the people are to land in beforehand, under ",[437,591,592],{},"Groups"," – see ",[495,595,63],{"href":64},[499,597,599],{"id":598},"_1-add-the-directory","1. Add the directory",[433,601,602,603,606,607,609],{},"Click ",[437,604,605],{},"New directory"," at the top right. A new directory called „Directory\" appears in the list and opens. Its name is at the top: type one your colleagues will recognise – e.g. „Head office AD\" – and click elsewhere; it is saved as soon as you leave the field. The name later appears in the ",[437,608,68],{}," list as the person's sign-in method.",[611,612,613,626],"table",{},[614,615,616],"thead",{},[617,618,619,623],"tr",{},[620,621,622],"th",{},"Field",[620,624,625],{},"What to enter",[627,628,629,646,663,674,683,693,703,717,727],"tbody",{},[617,630,631,637],{},[632,633,634],"td",{},[437,635,636],{},"Host",[632,638,639,640,643,644],{},"Name or IP address of the server, without ",[519,641,642],{},"ldap:\u002F\u002F"," – e.g. ",[519,645,521],{},[617,647,648,653],{},[632,649,650],{},[437,651,652],{},"Port",[632,654,655,658,659,662],{},[519,656,657],{},"636"," with TLS (recommended), ",[519,660,661],{},"389"," without",[617,664,665,669],{},[632,666,667],{},[437,668,555],{},[632,670,671,672],{},"Where the search starts, e.g. ",[519,673,563],{},[617,675,676,680],{},[632,677,678],{},[437,679,536],{},[632,681,682],{},"The service account. Empty = anonymous – most directories do not allow that",[617,684,685,690],{},[632,686,687],{},[437,688,689],{},"Password",[632,691,692],{},"The service account's password. It is stored encrypted and never shown again",[617,694,695,700],{},[632,696,697],{},[437,698,699],{},"Timeout (s)",[632,701,702],{},"How long DDM waits for an answer. 10 seconds is usually right",[617,704,705,710],{},[632,706,707],{},[437,708,709],{},"Fallback system",[632,711,712,713],{},"Another directory that takes over if this one cannot be reached – see ",[495,714,716],{"href":715},"#several-directories","Several directories",[617,718,719,724],{},[632,720,721],{},[437,722,723],{},"Require TLS",[632,725,726],{},"Encrypted connection (LDAPS). Leave it on – otherwise passwords travel unencrypted",[617,728,729,734],{},[632,730,731],{},[437,732,733],{},"Create accounts on first sign-in",[632,735,736],{},"Whether somebody the directory knows but DDM does not yet gets an account the first time they sign in",[433,738,570,739,742,743,746,747,750,751,497],{},[437,740,741],{},"Sync"," (",[437,744,745],{},"Manual",", ",[437,748,749],{},"Hourly"," …) you decide how often DDM synchronises – see ",[495,752,208],{"href":753},"\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-sync#when-synchronisation-runs",[755,756,757,758,746,760,762,763,765],"warning",{},"Changing the ",[437,759,636],{},[437,761,652],{}," or ",[437,764,723],{}," deletes the stored password: it belonged to the old server. Enter it again afterwards.",[499,767,769],{"id":768},"_2-test-the-connection","2. Test the connection",[433,771,602,772,775,776,779],{},[437,773,774],{},"Test the connection",". A new directory stays switched off until the test has succeeded – then switch on ",[437,777,778],{},"Directory active"," at the top, beside the name.",[433,781,782],{},[783,784],"img",{"alt":785,"src":786},"A directory after a successful connection test","\u002Fscreens\u002Fen\u002Fdocs-cms-directory-test.webp",[611,788,789,799],{},[614,790,791],{},[617,792,793,796],{},[620,794,795],{},"Message",[620,797,798],{},"What to do",[627,800,801,811,823,833,843,857],{},[617,802,803,808],{},[632,804,805],{},[437,806,807],{},"Connected. The search base is readable.",[632,809,810],{},"All good.",[617,812,813,818],{},[632,814,815],{},[437,816,817],{},"The host does not answer",[632,819,820,821,497],{},"Check the host name and port, and whether a firewall is in the way. With TLS the port is usually ",[519,822,657],{},[617,824,825,830],{},[632,826,827],{},[437,828,829],{},"The directory rejected the credentials",[632,831,832],{},"The Bind DN or the password is wrong – or the service account is locked or its password has expired.",[617,834,835,840],{},[632,836,837],{},[437,838,839],{},"The search base cannot be read",[632,841,842],{},"The Base DN is misspelt, or the service account may not read there. A directory reports both the same way.",[617,844,845,850],{},[632,846,847],{},[437,848,849],{},"This address may not be contacted",[632,851,852,853,856],{},"The address is a local one (e.g. ",[519,854,855],{},"127.0.0.1","), or – on a hosted DDM – a private network address. Use an address that is reachable from outside.",[617,858,859,864],{},[632,860,861],{},[437,862,863],{},"The stored password can no longer be decrypted",[632,865,866],{},"Enter the password again.",[868,869,870],"tip",{},"If the test fails with TLS but works without it, the DDM server does not trust your directory's certificate – typically one issued by your own company CA. Ask whoever runs DDM to add your CA certificate to the server rather than switching TLS off.",[487,872,873,874,877,878,880,881,883,884,886,887,891,892,497],{},"If your organisation moves over from the previous DDM, its directories arrive ",[437,875,876],{},"switched off"," – with their queries, attributes and group rules, and ",[437,879,741],{}," set to ",[437,882,745],{},". The old system never checked the directory's certificate, so a connection that worked there may fail here. So click ",[437,885,774],{}," first, check the queries with the ",[495,888,890],{"href":889},"#_5-check-with-the-preview","preview",", and only then switch on ",[437,893,778],{},[499,895,897],{"id":896},"_3-create-a-query","3. Create a query",[433,899,900,901,904],{},"A query says ",[437,902,903],{},"which entries"," of the directory become DDM users. A directory can have several queries – e.g. one for staff and one for external staff, each with its own groups.",[433,906,570,907,910,911,914],{},[437,908,909],{},"Queries & mappings",", click ",[437,912,913],{},"Query"," and fill in:",[442,916,917,923,929,938,954],{},[445,918,919,922],{},[437,920,921],{},"Name"," – for you, e.g. „Staff\".",[445,924,925,928],{},[437,926,927],{},"Search base DN"," – where this query looks. Empty = the directory's Base DN.",[445,930,931,934,935,497],{},[437,932,933],{},"Search filter"," – which entries count. A new query starts with ",[519,936,937],{},"(objectClass=person)",[445,939,940,943,944,947,948,762,951,497],{},[437,941,942],{},"Search scope"," – ",[437,945,946],{},"Whole subtree"," (usually right), ",[437,949,950],{},"One level down",[437,952,953],{},"This entry only",[445,955,956,959],{},[437,957,958],{},"Query active"," – only active queries take part in the regular synchronisation.",[511,961,963],{"id":962},"filters-that-work","Filters that work",[433,965,966,967,969],{},"For ",[437,968,439],{}," – all real, enabled users with an e-mail address:",[971,972,978],"pre",{"className":973,"code":975,"language":976,"meta":977},[974],"language-text","(&(objectCategory=person)(objectClass=user)(mail=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))\n","text","",[519,979,975],{"__ignoreMap":977},[433,981,982,983,986],{},"The last part leaves out ",[437,984,985],{},"disabled"," accounts. That matters: a person whose account IT disables when they leave then drops out of the result, and DDM blocks them at the next synchronisation. Without it, they stay active in DDM.",[433,988,989],{},"Only the members of one AD group – including members of groups nested inside it:",[971,991,994],{"className":992,"code":993,"language":976,"meta":977},[974],"(&(objectCategory=person)(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=DDM-Users,OU=Groups,DC=company,DC=local))\n",[519,995,993],{"__ignoreMap":977},[433,997,966,998,1001],{},[437,999,1000],{},"OpenLDAP"," and most other directories:",[971,1003,1006],{"className":1004,"code":1005,"language":976,"meta":977},[974],"(&(objectClass=inetOrgPerson)(mail=*))\n",[519,1007,1005],{"__ignoreMap":977},[487,1009,1010],{},"DDM imports up to 5,000 entries per query. If you have more, split them – e.g. one query per OU.",[499,1012,1014],{"id":1013},"_4-map-the-attributes","4. Map the attributes",[433,1016,570,1017,1020],{},[437,1018,1019],{},"Attribute mapping"," you decide which directory attribute fills which DDM field. There are three fields:",[611,1022,1023,1035],{},[614,1024,1025],{},[617,1026,1027,1029,1032],{},[620,1028,622],{},[620,1030,1031],{},"Usually",[620,1033,1034],{},"Note",[627,1036,1037,1055,1072],{},[617,1038,1039,1044,1049],{},[632,1040,1041],{},[437,1042,1043],{},"E-mail",[632,1045,1046],{},[519,1047,1048],{},"mail",[632,1050,1051,1054],{},[437,1052,1053],{},"Required."," It identifies the person – entries without an e-mail are skipped.",[617,1056,1057,1061,1069],{},[632,1058,1059],{},[437,1060,921],{},[632,1062,1063,762,1066],{},[519,1064,1065],{},"cn",[519,1067,1068],{},"displayName",[632,1070,1071],{},"If it is empty, DDM shows the e-mail address.",[617,1073,1074,1079,1082],{},[632,1075,1076],{},[437,1077,1078],{},"Picture",[632,1080,1081],{},"–",[632,1083,1084,1085,746,1088,1091],{},"Only a web address (URL) to an image. Photos stored in the directory itself (",[519,1086,1087],{},"jpegPhoto",[519,1089,1090],{},"thumbnailPhoto",") cannot be used.",[433,1093,1094,1095,1098,1099,1102,1103,1106],{},"For each field choose the source – ",[437,1096,1097],{},"Attribute"," (pick from the attributes of the loaded record) or ",[437,1100,1101],{},"Fixed value"," – and if needed a ",[437,1104,1105],{},"Transformation",":",[442,1108,1109,1120,1137,1157],{},[445,1110,1111,746,1114,746,1117],{},[437,1112,1113],{},"Lowercase",[437,1115,1116],{},"Uppercase",[437,1118,1119],{},"Trim whitespace",[445,1121,1122,746,1125,1128,1129,1132,1133,1136],{},[437,1123,1124],{},"Add prefix",[437,1126,1127],{},"Add suffix"," – e.g. build ",[519,1130,1131],{},"https:\u002F\u002Fintranet.company.com\u002Fphotos\u002F"," + ",[519,1134,1135],{},"uid"," into a picture URL",[445,1138,1139,943,1142,1145,1146,1149,1150,1153,1154],{},[437,1140,1141],{},"Replace",[437,1143,1144],{},"Search for"," \u002F ",[437,1147,1148],{},"Replace with",", e.g. replace ",[519,1151,1152],{},"@company.local"," with ",[519,1155,1156],{},"@company.com",[445,1158,1159,1162],{},[437,1160,1161],{},"Cut at separator"," – keeps what is before the separator",[755,1164,1165,1166,1169,1170,1172,1173,746,1175,762,1177,1179],{},"For signing in with the company password, DDM looks people up ",[437,1167,1168],{},"by their e-mail",". That only works if ",[437,1171,1043],{}," is mapped straight from an attribute – with no transformation or only ",[437,1174,1113],{},[437,1176,1116],{},[437,1178,1119],{},". If you build the address with a prefix, suffix or replacement, people who have already been imported can still sign in; new people can only get in after an import.",[499,1181,1183],{"id":1182},"_5-check-with-the-preview","5. Check with the preview",[433,1185,602,1186,1189,1190,1193],{},[437,1187,1188],{},"Load preview",". DDM fetches up to five entries of the query – ",[437,1191,1192],{},"nothing is imported",". With the arrows you leaf through them:",[442,1195,1196,1203,1210],{},[445,1197,1198,1199,1202],{},"on the left the ",[437,1200,1201],{},"LDAP record"," as the directory delivers it,",[445,1204,1205,1206,1209],{},"on the right the ",[437,1207,1208],{},"Resulting user"," as DDM would create it,",[445,1211,1212,1213,1216,1217,762,1220,497],{},"beside each mapping its ",[437,1214,1215],{},"Result",", beside each group rule ",[437,1218,1219],{},"matches",[437,1221,1222],{},"no match",[433,1224,1225],{},"This is the quickest way to find the right attribute names – everything the directory delivers is on the left.",[499,1227,1229],{"id":1228},"_6-map-groups","6. Map groups",[433,1231,570,1232,1235,1236,1239,1240,1106],{},[437,1233,1234],{},"Group mapping"," you decide which directory people land in which DDM group. Click ",[437,1237,1238],{},"Rule",", choose a condition, enter a value and select the ",[437,1241,1242],{},"→ Application group",[611,1244,1245,1258],{},[614,1246,1247],{},[617,1248,1249,1252,1255],{},[620,1250,1251],{},"Condition",[620,1253,1254],{},"Matches when",[620,1256,1257],{},"Example value",[627,1259,1260,1275,1290],{},[617,1261,1262,1267,1270],{},[632,1263,1264],{},[437,1265,1266],{},"memberOf contains",[632,1268,1269],{},"one of the person's groups contains the text",[632,1271,1272],{},[519,1273,1274],{},"CN=DMS-Sales",[617,1276,1277,1282,1285],{},[632,1278,1279],{},[437,1280,1281],{},"DN contains",[632,1283,1284],{},"the person's own DN contains the text",[632,1286,1287],{},[519,1288,1289],{},"OU=Field Service",[617,1291,1292,1297,1303],{},[632,1293,1294],{},[437,1295,1296],{},"Attribute equals",[632,1298,1299,1300],{},"an attribute has exactly this value – written as ",[519,1301,1302],{},"attribute=value",[632,1304,1305],{},[519,1306,1307],{},"department=Sales",[433,1309,1310],{},"Upper and lower case do not matter. A person can match several rules and is then in several groups.",[433,1312,570,1313,1316,1317,1320,1321,1324],{},[437,1314,1315],{},"Group fallback & test data"," you set the ",[437,1318,1319],{},"Fallback group",": everybody who matches ",[437,1322,1323],{},"no"," rule lands there. Somebody who matches a rule does not additionally land in the fallback group. Without a fallback group, these people are imported without a group and see nothing until you add them to one.",[433,1326,1327,1330],{},[437,1328,1329],{},"Ignore unmapped LDAP groups"," – when it is off, the import result lists directory groups that no rule covers. Useful while setting up, to see what you have overlooked.",[755,1332,1333],{},"DDM takes care of the groups that a rule or the fallback group hands out – and of only those. If you add somebody to such a group by hand and no rule matches them, the next import takes them out again. Groups no rule names are never touched – there, additions by hand stay.",[487,1335,1336,1339,1340,1343,1344,1347],{},[437,1337,1338],{},"memberOf"," in Active Directory only lists ",[437,1341,1342],{},"direct"," memberships. If your groups are nested, either name the inner group in the rule, or select the people with a filter for nested groups (see ",[495,1345,963],{"href":1346},"#filters-that-work",") and give that query a fallback group.",[499,1349,1351],{"id":1350},"_7-import","7. Import",[433,1353,1354,1357,1358,1361],{},[437,1355,1356],{},"Import now"," imports a single query – also one that is not yet active, to try it out. ",[437,1359,1360],{},"Import all now"," imports all active queries of the directory. Afterwards you see what happened:",[611,1363,1364,1373],{},[614,1365,1366],{},[617,1367,1368,1370],{},[620,1369,1215],{},[620,1371,1372],{},"Meaning",[627,1374,1375,1385,1395,1409,1422,1432,1444,1454,1464],{},[617,1376,1377,1382],{},[632,1378,1379],{},[437,1380,1381],{},"… created",[632,1383,1384],{},"new accounts",[617,1386,1387,1392],{},[632,1388,1389],{},[437,1390,1391],{},"… changed",[632,1393,1394],{},"name, e-mail, picture or groups updated",[617,1396,1397,1402],{},[632,1398,1399],{},[437,1400,1401],{},"… blocked",[632,1403,1404,1405],{},"people who are no longer in the directory – see ",[495,1406,1408],{"href":1407},"\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-sync#leavers","Leavers",[617,1410,1411,1416],{},[632,1412,1413],{},[437,1414,1415],{},"… without an e-mail address",[632,1417,1418,1419,1421],{},"entries skipped because ",[437,1420,1043],{}," is empty",[617,1423,1424,1429],{},[632,1425,1426],{},[437,1427,1428],{},"… not created – domain is not verified for this organisation",[632,1430,1431],{},"the address is not on one of your confirmed domains",[617,1433,1434,1439],{},[632,1435,1436],{},[437,1437,1438],{},"… not created",[632,1440,1441,1443],{},[437,1442,733],{}," is off",[617,1445,1446,1451],{},[632,1447,1448],{},[437,1449,1450],{},"… not taken in – account does not belong to this organisation",[632,1452,1453],{},"the address already has a DDM account in another organisation and is not on one of your confirmed domains – invite the person by hand",[617,1455,1456,1461],{},[632,1457,1458],{},[437,1459,1460],{},"… also in another organisation",[632,1462,1463],{},"the person also works for another organisation in DDM – that is fine",[617,1465,1466,1471],{},[632,1467,1468],{},[437,1469,1470],{},"Partly imported – at least one query failed. Nobody was blocked.",[632,1472,1473],{},"check the query that failed",[433,1475,1476,1477,1480,1481,1483],{},"Imported people are ",[437,1478,1479],{},"Members",". If somebody is to administer DDM, change their role under ",[437,1482,68],{},". Name and e-mail of imported people are marked as coming from the directory and are maintained there.",[499,1485,1487],{"id":1486},"calendars","Calendars",[433,1489,1490,1491,762,1494,746,1496,1499,1500,1503,1504,497],{},"If your Active Directory's mailboxes live in ",[437,1492,1493],{},"Microsoft 365",[437,1495,223],{},[495,1497,1498],{"href":236},"calendar access"," connects the calendars for everybody who signs in through the directory service too. If the calendar runs on a ",[437,1501,1502],{},"CalDAV server of your own"," with the same credentials, DDM can connect it at sign-in – see ",[495,1505,1507],{"href":1506},"\u002Fen\u002Fsign-in-and-directories\u002Fcalendar-access#company-caldav-with-directory-sign-in","Company CalDAV",[499,1509,716],{"id":1510},"several-directories",[433,1512,1513,1514,1145,1517,1520],{},"You can add several directories – e.g. one per country or per subsidiary. With the arrows ",[437,1515,1516],{},"Higher priority",[437,1518,1519],{},"Lower priority"," beside the directory's name you set the order in which DDM asks them when somebody signs in.",[433,1522,552,1523,1525,1526,1529],{},[437,1524,709],{}," is for a second server of the ",[437,1527,1528],{},"same"," directory – e.g. a second domain controller. If the first one does not answer, DDM asks the fallback. It is only used when the server cannot be reached, not when a password is wrong.",[499,1531,1533],{"id":1532},"removing-a-directory","Removing a directory",[433,1535,1536,1537,1540,1541,1544,1545,1548],{},"Click the bin beside the directory's name (",[437,1538,1539],{},"Remove directory",") and confirm with ",[437,1542,1543],{},"Remove permanently",". This also removes its queries, mappings and rules. The accounts stay – they are just no longer tied to the directory. People who signed in with their company password then need a DDM password: they can set one under ",[437,1546,1547],{},"Forgotten your password?"," on the sign-in page.",{"title":977,"searchDepth":1550,"depth":1550,"links":1551},2,[1552,1560,1561,1562,1565,1566,1567,1568,1569,1570,1571],{"id":501,"depth":1550,"text":502,"children":1553},[1554,1556,1557,1558,1559],{"id":513,"depth":1555,"text":514},3,{"id":525,"depth":1555,"text":526},{"id":548,"depth":1555,"text":549},{"id":566,"depth":1555,"text":567},{"id":585,"depth":1555,"text":586},{"id":598,"depth":1550,"text":599},{"id":768,"depth":1550,"text":769},{"id":896,"depth":1550,"text":897,"children":1563},[1564],{"id":962,"depth":1555,"text":963},{"id":1013,"depth":1550,"text":1014},{"id":1182,"depth":1550,"text":1183},{"id":1228,"depth":1550,"text":1229},{"id":1350,"depth":1550,"text":1351},{"id":1486,"depth":1550,"text":1487},{"id":1510,"depth":1550,"text":716},{"id":1532,"depth":1550,"text":1533},"Connect Active Directory, OpenLDAP or another LDAP directory – import people, sort them into groups, let them sign in with their company password.","md",null,{},{"icon":206},{"title":203,"description":1572},"Z3e-lriNLxeX9bgBClFHsBuDUs4f1oo8FBKaoHl19gQ",[1580,1582],{"title":199,"path":200,"stem":201,"description":1581,"icon":190,"children":-1},"Connect your organisation's own identity provider – Entra ID, Okta, Google Workspace or any OpenID Connect or SAML provider – so your people sign in with the account they already have.",{"title":208,"path":209,"stem":210,"description":1583,"icon":211,"children":-1},"When DDM synchronises with the directory, what it changes and what it never does, how the company password works – and what to do when something goes wrong.",1793617719189]