Sign-in & directories

Synchronisation and sign-in

When DDM synchronises with the directory, what it changes and what it never does, how the company password works – and what to do when something goes wrong.

When synchronisation runs

Each directory has its own schedule – the Sync field next to its connection details:

Schedule	Runs
Manual	only when you click Import now or Import all now
Hourly	every hour, at a quarter past
Daily	every night at 02:15 (server time)
Weekly	Mondays at 02:15 (server time)
At sign-in	no regular run – each person's own entry is read again when they sign in

At sign-in is the lightest option: it only reads the one person who is signing in and updates their name, e-mail, picture and groups. It creates nobody else and blocks nobody. If you want leavers to be blocked automatically, choose Hourly, Daily or Weekly.

Daily is right for most companies. Changes in the directory then arrive in DDM the next morning.

What a synchronisation does

For every entry the active queries find:

New person on one of your confirmed domains – DDM creates the account and the membership, as Member. No invitation, no e-mail; the address counts as confirmed, because your directory vouches for it.
Known person – name, e-mail and picture are updated if they changed in the directory, and the groups are set according to your rules.
Person who already has a DDM account – e.g. invited by hand before the directory was set up – is taken over and from then on also signs in with their company password. This only happens if the account belongs to your organisation alone, or its address is on one of your confirmed domains.
Changed e-mail address – DDM recognises the person by their directory entry and changes the address instead of creating a second account.

New people count towards your plan's user seats. Once every seat is taken, the synchronisation adds nobody else and reports … not added — every user seat of your plan is taken; everyone already in DDM is still updated. See Plans.

What it never does

It never deletes anybody. Leavers are blocked – their documents, notes and history stay.
It never touches people it did not bring in. Somebody invited by hand who is not in the directory is neither blocked nor moved to other groups.
It never unblocks anybody. DDM cannot tell whether somebody was blocked by the synchronisation or on purpose by an administrator. Unblock under Users if needed.
It never changes roles. Who is an administrator you decide under Users.
It never changes groups that no rule names.

Leavers

Somebody who was imported by this directory and no longer appears in the result is blocked: they can no longer sign in, and see the message Your account is blocked in this organisation. They are still listed under Users, with the status Blocked.

To make sure a faulty search does not lock out your whole company, DDM blocks nobody if:

one of the queries failed (Partly imported – at least one query failed. Nobody was blocked.),
a query hit the limit of 5,000 entries,
the search found no entries at all,
more than half of the people known from this directory would be blocked at once – that looks like a moved OU or a typo in the Base DN, not like people leaving.

Only Import all now and the scheduled runs block people. Import now for a single query never does – the other queries' people are simply not part of it.

In Active Directory a disabled account still exists. To have DDM block people whose account IT disables, leave disabled accounts out in the filter – see Filters that work.

Signing in with the company password

People from the directory sign in in the CMS and in the app as usual: E-mail and Password – their company password. DDM asks the directory whether the password is correct. The password is never stored in DDM, and a password change in the directory applies in DDM immediately.

How it works:

DDM first tries the e-mail and password as a DDM password.
If that does not fit, it uses the service account to look up the person in the directories that belong to their account, in the order of priority.
It then signs in to the directory as the person, with the password they typed. If the directory accepts, they are in.

People who do not have an account yet are looked up in the directories of the organisation that owns their e-mail domain. If Create accounts on first sign-in is on, they get their account at that moment – with the groups your rules give them – and are signed in straight away. If it is off, they see Your company password is correct, but there is no account for you here yet.

With Create accounts on first sign-in you can do without a regular import altogether: everybody gets their account when they first need it. A daily synchronisation is still useful – it blocks leavers.

Whether somebody can still set a separate DDM password is up to you: the company password works in addition to a DDM password, it does not replace it.

Troubleshooting

Problem	Cause and solution
E-mail address or password is incorrect although the company password is right	The E-mail the person types must be exactly the address DDM has for them (the mapped address). Check the person in the preview. If they have not been imported yet and E-mail is built with a prefix, suffix or replacement, import them first.
Your company password is correct, but there is no account for you here yet	Create accounts on first sign-in is off – import the person or switch it on.
Your account is blocked in this organisation	The person was blocked – by an administrator or because they were missing from the directory result. Unblock under Users.
Somebody is not imported	Not found by any active query (check with Load preview), no e-mail in the mapped attribute, or their address is not on a confirmed domain.
Somebody lands in the wrong group	Look at the person in the preview: beside each rule it says matches or no match. Remember that memberOf only lists direct memberships.
Signing in takes a long time	A directory does not answer. DDM waits at most 5 seconds per directory at sign-in – check the host, or add a Fallback system.
Nobody was blocked although people left	See the safety rules under Leavers – one of them applied. The import result tells you which.

Every import, every account created or blocked and every sign-in via a directory is recorded in the Audit log – see Usage and audit log.

For whoever runs DDM

Network: DDM must reach the directory's port (usually 636). On an installation that serves several customers, set LDAP_PRIVATE_NETWORKS=off so that customers cannot point a directory at your internal network; local addresses (127.0.0.1, link-local) are always refused.
Certificates: with Require TLS the directory's certificate is checked. If it comes from a company CA, add that CA to the trust store of the DDM server (for Node.js, e.g. with NODE_EXTRA_CA_CERTS).
Schedule: the regular synchronisation runs inside the DDM server, every hour at minute 15. If the server is not running, nothing is synchronised.

Directory services (LDAP)

Connect Active Directory, OpenLDAP or another LDAP directory – import people, sort them into groups, let them sign in with their company password.

Microsoft Entra ID

Connect your organisation's Entra ID (formerly Azure AD) – register DDM in your own tenant and enter it in DDM.