[{"data":1,"prerenderedAt":941},["ShallowReactive",2],{"navigation_docs_en":3,"-en-sign-in-and-directories-directory-sync":427,"-en-sign-in-and-directories-directory-sync-surround":936},[4,31,117,188,238,271,310,369,378],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":30},"Getting started","i-hugeicons-rocket-01","\u002Fen\u002Fgetting-started","en\u002F01.getting-started",[10,15,20,25],{"title":11,"path":12,"stem":13,"icon":14},"What is DDM?","\u002Fen\u002Fgetting-started\u002Fwhat-is-ddm","en\u002F01.getting-started\u002F01.what-is-ddm","i-hugeicons-information-circle",{"title":16,"path":17,"stem":18,"icon":19},"Account and sign-in","\u002Fen\u002Fgetting-started\u002Fsign-in","en\u002F01.getting-started\u002F02.sign-in","i-hugeicons-key-01",{"title":21,"path":22,"stem":23,"icon":24},"AI in DDM","\u002Fen\u002Fgetting-started\u002Fai-in-ddm","en\u002F01.getting-started\u002F03.ai-in-ddm","i-hugeicons-ai-magic",{"title":26,"path":27,"stem":28,"icon":29},"System status","\u002Fen\u002Fgetting-started\u002Fsystem-status","en\u002F01.getting-started\u002F04.system-status","i-hugeicons-activity-03",false,{"title":32,"icon":33,"path":34,"stem":35,"children":36,"page":30},"CMS","i-hugeicons-dashboard-square-01","\u002Fen\u002Fcms","en\u002F02.cms",[37,42,47,52,57,62,67,72,77,82,87,92,97,102,107,112],{"title":38,"path":39,"stem":40,"icon":41},"The CMS at a glance","\u002Fen\u002Fcms\u002Foverview","en\u002F02.cms\u002F01.overview","i-hugeicons-compass-01",{"title":43,"path":44,"stem":45,"icon":46},"Uploading documents","\u002Fen\u002Fcms\u002Fupload","en\u002F02.cms\u002F02.upload","i-hugeicons-upload-01",{"title":48,"path":49,"stem":50,"icon":51},"Categories","\u002Fen\u002Fcms\u002Fcategories","en\u002F02.cms\u002F03.categories","i-hugeicons-folder-tree",{"title":53,"path":54,"stem":55,"icon":56},"Editing documents","\u002Fen\u002Fcms\u002Fdocuments","en\u002F02.cms\u002F04.documents","i-hugeicons-file-edit",{"title":58,"path":59,"stem":60,"icon":61},"Searching and filtering","\u002Fen\u002Fcms\u002Fsearch-and-filters","en\u002F02.cms\u002F05.search-and-filters","i-hugeicons-search-01",{"title":63,"path":64,"stem":65,"icon":66},"Groups and permissions","\u002Fen\u002Fcms\u002Fgroups-and-permissions","en\u002F02.cms\u002F06.groups-and-permissions","i-hugeicons-user-multiple",{"title":68,"path":69,"stem":70,"icon":71},"Users","\u002Fen\u002Fcms\u002Fusers","en\u002F02.cms\u002F07.users","i-hugeicons-user-add-01",{"title":73,"path":74,"stem":75,"icon":76},"Approvals","\u002Fen\u002Fcms\u002Fapprovals","en\u002F02.cms\u002F08.approvals","i-hugeicons-checkmark-badge-01",{"title":78,"path":79,"stem":80,"icon":81},"Markets and translations","\u002Fen\u002Fcms\u002Fmarkets-and-translations","en\u002F02.cms\u002F09.markets-and-translations","i-hugeicons-globe-02",{"title":83,"path":84,"stem":85,"icon":86},"Note templates","\u002Fen\u002Fcms\u002Fnote-templates","en\u002F02.cms\u002F10.note-templates","i-hugeicons-layout-01",{"title":88,"path":89,"stem":90,"icon":91},"Usage and audit log","\u002Fen\u002Fcms\u002Fusage-and-audit","en\u002F02.cms\u002F11.usage-and-audit","i-hugeicons-chart-column",{"title":93,"path":94,"stem":95,"icon":96},"AI assistant","\u002Fen\u002Fcms\u002Fassistant","en\u002F02.cms\u002F12.assistant","i-hugeicons-sparkles",{"title":98,"path":99,"stem":100,"icon":101},"Settings","\u002Fen\u002Fcms\u002Fsettings","en\u002F02.cms\u002F13.settings","i-hugeicons-settings-02",{"title":103,"path":104,"stem":105,"icon":106},"Plans","\u002Fen\u002Fcms\u002Fplans","en\u002F02.cms\u002F14.plans","i-hugeicons-package",{"title":108,"path":109,"stem":110,"icon":111},"Feature requests","\u002Fen\u002Fcms\u002Ffeature-requests","en\u002F02.cms\u002F15.feature-requests","i-hugeicons-idea-01",{"title":113,"path":114,"stem":115,"icon":116},"Report a bug","\u002Fen\u002Fcms\u002Fbug-reports","en\u002F02.cms\u002F16.bug-reports","i-hugeicons-bug-01",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":30},"App","i-hugeicons-smart-phone-01","\u002Fen\u002Fapp","en\u002F03.app",[123,128,133,138,143,147,152,157,162,167,170,173,176,179,184],{"title":124,"path":125,"stem":126,"icon":127},"Signing in and finding your way","\u002Fen\u002Fapp\u002Foverview","en\u002F03.app\u002F01.overview","i-hugeicons-login-03",{"title":129,"path":130,"stem":131,"icon":132},"Tabs and split view","\u002Fen\u002Fapp\u002Ftabs","en\u002F03.app\u002F02.tabs","i-hugeicons-layout-2-column",{"title":134,"path":135,"stem":136,"icon":137},"Finding and reading documents","\u002Fen\u002Fapp\u002Fdocuments","en\u002F03.app\u002F03.documents","i-hugeicons-file-01",{"title":139,"path":140,"stem":141,"icon":142},"Favorites","\u002Fen\u002Fapp\u002Ffavorites","en\u002F03.app\u002F04.favorites","i-hugeicons-favourite",{"title":144,"path":145,"stem":146,"icon":61},"Searching","\u002Fen\u002Fapp\u002Fsearch","en\u002F03.app\u002F05.search",{"title":148,"path":149,"stem":150,"icon":151},"Notes","\u002Fen\u002Fapp\u002Fnotes","en\u002F03.app\u002F06.notes","i-hugeicons-note-edit",{"title":153,"path":154,"stem":155,"icon":156},"Calendar and appointments","\u002Fen\u002Fapp\u002Fcalendar","en\u002F03.app\u002F07.calendar","i-hugeicons-calendar-03",{"title":158,"path":159,"stem":160,"icon":161},"Sending to customers","\u002Fen\u002Fapp\u002Foutbox","en\u002F03.app\u002F08.outbox","i-hugeicons-sent",{"title":163,"path":164,"stem":165,"icon":166},"Working offline","\u002Fen\u002Fapp\u002Foffline","en\u002F03.app\u002F09.offline","i-hugeicons-wifi-off-01",{"title":93,"path":168,"stem":169,"icon":96},"\u002Fen\u002Fapp\u002Fassistant","en\u002F03.app\u002F10.assistant",{"title":98,"path":171,"stem":172,"icon":101},"\u002Fen\u002Fapp\u002Fsettings","en\u002F03.app\u002F11.settings",{"title":108,"path":174,"stem":175,"icon":111},"\u002Fen\u002Fapp\u002Ffeature-requests","en\u002F03.app\u002F12.feature-requests",{"title":113,"path":177,"stem":178,"icon":116},"\u002Fen\u002Fapp\u002Fbug-reports","en\u002F03.app\u002F13.bug-reports",{"title":180,"path":181,"stem":182,"icon":183},"Desktop app","\u002Fen\u002Fapp\u002Fdesktop-app","en\u002F03.app\u002F14.desktop-app","i-hugeicons-computer",{"title":185,"path":186,"stem":187,"icon":119},"Mobile app","\u002Fen\u002Fapp\u002Fmobile-app","en\u002F03.app\u002F15.mobile-app",{"title":189,"icon":190,"path":191,"stem":192,"children":193,"page":30},"Sign-in & directories","i-hugeicons-security-check","\u002Fen\u002Fsign-in-and-directories","en\u002F04.sign-in-and-directories",[194,198,202,207,212,217,222,226,230,234],{"title":195,"path":196,"stem":197,"icon":19},"Sign-in methods","\u002Fen\u002Fsign-in-and-directories\u002Fsign-in-methods","en\u002F04.sign-in-and-directories\u002F01.sign-in-methods",{"title":199,"path":200,"stem":201,"icon":190},"Single sign-on","\u002Fen\u002Fsign-in-and-directories\u002Fsingle-sign-on","en\u002F04.sign-in-and-directories\u002F02.single-sign-on",{"title":203,"path":204,"stem":205,"icon":206},"Directory services (LDAP)","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-services","en\u002F04.sign-in-and-directories\u002F03.directory-services","i-hugeicons-hierarchy",{"title":208,"path":209,"stem":210,"icon":211},"Synchronisation and sign-in","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-sync","en\u002F04.sign-in-and-directories\u002F04.directory-sync","i-hugeicons-refresh",{"title":213,"path":214,"stem":215,"icon":216},"Microsoft Entra ID","\u002Fen\u002Fsign-in-and-directories\u002Fmicrosoft-entra-id","en\u002F04.sign-in-and-directories\u002F05.microsoft-entra-id","i-hugeicons-building-03",{"title":218,"path":219,"stem":220,"icon":221},"Okta","\u002Fen\u002Fsign-in-and-directories\u002Fokta","en\u002F04.sign-in-and-directories\u002F06.okta","i-hugeicons-finger-print",{"title":223,"path":224,"stem":225,"icon":81},"Google Workspace","\u002Fen\u002Fsign-in-and-directories\u002Fgoogle-workspace","en\u002F04.sign-in-and-directories\u002F07.google-workspace",{"title":227,"path":228,"stem":229,"icon":119},"Two-factor authentication","\u002Fen\u002Fsign-in-and-directories\u002Ftwo-factor-authentication","en\u002F04.sign-in-and-directories\u002F08.two-factor-authentication",{"title":231,"path":232,"stem":233,"icon":221},"Passkeys","\u002Fen\u002Fsign-in-and-directories\u002Fpasskeys","en\u002F04.sign-in-and-directories\u002F09.passkeys",{"title":235,"path":236,"stem":237,"icon":156},"Calendar access","\u002Fen\u002Fsign-in-and-directories\u002Fcalendar-access","en\u002F04.sign-in-and-directories\u002F10.calendar-access",{"title":239,"icon":240,"path":241,"stem":242,"children":243,"page":30},"MCP server","i-hugeicons-ai-network","\u002Fen\u002Fmcp-server","en\u002F05.mcp-server",[244,248,253,257,262,266],{"title":245,"path":246,"stem":247,"icon":240},"Overview","\u002Fen\u002Fmcp-server\u002Foverview","en\u002F05.mcp-server\u002F01.overview",{"title":249,"path":250,"stem":251,"icon":252},"Setup","\u002Fen\u002Fmcp-server\u002Fsetup","en\u002F05.mcp-server\u002F02.setup","i-hugeicons-plug-socket",{"title":254,"path":255,"stem":256,"icon":111},"What you can do with it","\u002Fen\u002Fmcp-server\u002Fuse-cases","en\u002F05.mcp-server\u002F03.use-cases",{"title":258,"path":259,"stem":260,"icon":261},"Tools","\u002Fen\u002Fmcp-server\u002Ftools","en\u002F05.mcp-server\u002F04.tools","i-hugeicons-wrench-01",{"title":263,"path":264,"stem":265,"icon":76},"Approving changes","\u002Fen\u002Fmcp-server\u002Fapproving-changes","en\u002F05.mcp-server\u002F05.approving-changes",{"title":267,"path":268,"stem":269,"icon":270},"Administration & security","\u002Fen\u002Fmcp-server\u002Fadmin-and-security","en\u002F05.mcp-server\u002F06.admin-and-security","i-hugeicons-shield-key",{"title":272,"icon":273,"path":274,"stem":275,"children":276,"page":30},"External sources","i-hugeicons-database-sync","\u002Fen\u002Fexternal-sources","en\u002F06.external-sources",[277,280,285,290,295,300,305],{"title":245,"path":278,"stem":279,"icon":273},"\u002Fen\u002Fexternal-sources\u002Foverview","en\u002F06.external-sources\u002F01.overview",{"title":281,"path":282,"stem":283,"icon":284},"SharePoint","\u002Fen\u002Fexternal-sources\u002Fsharepoint","en\u002F06.external-sources\u002F02.sharepoint","i-hugeicons-microsoft",{"title":286,"path":287,"stem":288,"icon":289},"OneDrive","\u002Fen\u002Fexternal-sources\u002Fonedrive","en\u002F06.external-sources\u002F03.onedrive","i-hugeicons-folder-cloud",{"title":291,"path":292,"stem":293,"icon":294},"Google Drive","\u002Fen\u002Fexternal-sources\u002Fgoogle-drive","en\u002F06.external-sources\u002F04.google-drive","i-hugeicons-google-drive",{"title":296,"path":297,"stem":298,"icon":299},"FTP \u002F SFTP","\u002Fen\u002Fexternal-sources\u002Fftp-sftp","en\u002F06.external-sources\u002F05.ftp-sftp","i-hugeicons-server-stack-01",{"title":301,"path":302,"stem":303,"icon":304},"REST interface","\u002Fen\u002Fexternal-sources\u002Frest","en\u002F06.external-sources\u002F06.rest","i-hugeicons-api",{"title":306,"path":307,"stem":308,"icon":309},"SOAP interface","\u002Fen\u002Fexternal-sources\u002Fsoap","en\u002F06.external-sources\u002F07.soap","i-hugeicons-source-code",{"title":311,"icon":304,"path":312,"stem":313,"children":314,"page":30},"Integration API","\u002Fen\u002Fintegration-api","en\u002F07.integration-api",[315,318,322,327,332,337,341,346,350,354,359,364],{"title":245,"path":316,"stem":317,"icon":14},"\u002Fen\u002Fintegration-api\u002Foverview","en\u002F07.integration-api\u002F01.overview",{"title":319,"path":320,"stem":321,"icon":19},"Authentication","\u002Fen\u002Fintegration-api\u002Fauthentication","en\u002F07.integration-api\u002F02.authentication",{"title":323,"path":324,"stem":325,"icon":326},"Conventions","\u002Fen\u002Fintegration-api\u002Fconventions","en\u002F07.integration-api\u002F03.conventions","i-hugeicons-book-open-01",{"title":328,"path":329,"stem":330,"icon":331},"Pushing documents","\u002Fen\u002Fintegration-api\u002Fpushing-documents","en\u002F07.integration-api\u002F04.pushing-documents","i-hugeicons-upload-02",{"title":333,"path":334,"stem":335,"icon":336},"Consuming content","\u002Fen\u002Fintegration-api\u002Fconsuming-content","en\u002F07.integration-api\u002F05.consuming-content","i-hugeicons-download-02",{"title":338,"path":339,"stem":340,"icon":137},"Reference: documents","\u002Fen\u002Fintegration-api\u002Freference-documents","en\u002F07.integration-api\u002F06.reference-documents",{"title":342,"path":343,"stem":344,"icon":345},"Reference: categories, tags, markets","\u002Fen\u002Fintegration-api\u002Freference-categories-tags","en\u002F07.integration-api\u002F07.reference-categories-tags","i-hugeicons-folder-01",{"title":347,"path":348,"stem":349,"icon":211},"Reference: sync manifest","\u002Fen\u002Fintegration-api\u002Freference-sync","en\u002F07.integration-api\u002F08.reference-sync",{"title":351,"path":352,"stem":353,"icon":309},"OpenAPI","\u002Fen\u002Fintegration-api\u002Fopenapi","en\u002F07.integration-api\u002F09.openapi",{"title":355,"path":356,"stem":357,"icon":358},"Changelog","\u002Fen\u002Fintegration-api\u002Fchangelog","en\u002F07.integration-api\u002F10.changelog","i-hugeicons-time-schedule",{"title":360,"path":361,"stem":362,"icon":363},"Reference: groups, markets, access","\u002Fen\u002Fintegration-api\u002Freference-groups-access","en\u002F07.integration-api\u002F11.reference-groups-access","i-hugeicons-user-lock-01",{"title":365,"path":366,"stem":367,"icon":368},"Moving from CMWS","\u002Fen\u002Fintegration-api\u002Fcmws","en\u002F07.integration-api\u002F12.cmws","i-hugeicons-arrow-reload-horizontal",{"title":370,"icon":371,"path":372,"stem":373,"children":374,"page":30},"What's new","i-hugeicons-gift","\u002Fen\u002Fwhats-new","en\u002F08.whats-new",[375],{"title":355,"path":376,"stem":377,"icon":358},"\u002Fen\u002Fwhats-new\u002Fchangelog","en\u002F08.whats-new\u002F01.changelog",{"title":379,"icon":299,"path":380,"stem":381,"children":382,"page":30},"Self-hosting","\u002Fen\u002Fself-hosting","en\u002F09.self-hosting",[383,386,390,395,399,404,408,413,418,422],{"title":245,"path":384,"stem":385,"icon":14},"\u002Fen\u002Fself-hosting\u002Foverview","en\u002F09.self-hosting\u002F01.overview",{"title":387,"path":388,"stem":389,"icon":106},"Docker Compose","\u002Fen\u002Fself-hosting\u002Fdocker-compose","en\u002F09.self-hosting\u002F02.docker-compose",{"title":391,"path":392,"stem":393,"icon":394},"Kubernetes","\u002Fen\u002Fself-hosting\u002Fkubernetes","en\u002F09.self-hosting\u002F03.kubernetes","i-hugeicons-cloud",{"title":396,"path":397,"stem":398,"icon":101},"Configuration","\u002Fen\u002Fself-hosting\u002Fconfiguration","en\u002F09.self-hosting\u002F04.configuration",{"title":400,"path":401,"stem":402,"icon":403},"Licence","\u002Fen\u002Fself-hosting\u002Flicence","en\u002F09.self-hosting\u002F05.licence","i-hugeicons-license",{"title":405,"path":406,"stem":407,"icon":211},"Updates","\u002Fen\u002Fself-hosting\u002Fupdates","en\u002F09.self-hosting\u002F06.updates",{"title":409,"path":410,"stem":411,"icon":412},"Postgres","\u002Fen\u002Fself-hosting\u002Fpostgres","en\u002F09.self-hosting\u002F07.postgres","i-hugeicons-database",{"title":414,"path":415,"stem":416,"icon":417},"Backups","\u002Fen\u002Fself-hosting\u002Fbackups","en\u002F09.self-hosting\u002F08.backups","i-hugeicons-database-restore",{"title":419,"path":420,"stem":421,"icon":261},"Troubleshooting","\u002Fen\u002Fself-hosting\u002Ftroubleshooting","en\u002F09.self-hosting\u002F09.troubleshooting",{"title":423,"path":424,"stem":425,"icon":426},"Firewall","\u002Fen\u002Fself-hosting\u002Ffirewall","en\u002F09.self-hosting\u002F10.firewall","i-hugeicons-firewall",{"id":428,"title":208,"body":429,"description":929,"extension":930,"links":931,"meta":932,"navigation":933,"path":209,"seo":934,"stem":210,"__hash__":935},"docs_en\u002Fen\u002F04.sign-in-and-directories\u002F04.directory-sync.md",{"type":430,"value":431,"toc":918},"minimark",[432,437,446,523,536,542,546,549,581,592,596,632,636,653,660,678,687,694,698,709,712,735,745,751,754,757,864,873,877],[433,434,436],"h2",{"id":435},"when-synchronisation-runs","When synchronisation runs",[438,439,440,441,445],"p",{},"Each directory has its own schedule – the ",[442,443,444],"strong",{},"Sync"," field next to its connection details:",[447,448,449,462],"table",{},[450,451,452],"thead",{},[453,454,455,459],"tr",{},[456,457,458],"th",{},"Schedule",[456,460,461],{},"Runs",[463,464,465,483,493,503,513],"tbody",{},[453,466,467,473],{},[468,469,470],"td",{},[442,471,472],{},"Manual",[468,474,475,476,479,480],{},"only when you click ",[442,477,478],{},"Import now"," or ",[442,481,482],{},"Import all now",[453,484,485,490],{},[468,486,487],{},[442,488,489],{},"Hourly",[468,491,492],{},"every hour, at a quarter past",[453,494,495,500],{},[468,496,497],{},[442,498,499],{},"Daily",[468,501,502],{},"every night at 02:15 (server time)",[453,504,505,510],{},[468,506,507],{},[442,508,509],{},"Weekly",[468,511,512],{},"Mondays at 02:15 (server time)",[453,514,515,520],{},[468,516,517],{},[442,518,519],{},"At sign-in",[468,521,522],{},"no regular run – each person's own entry is read again when they sign in",[438,524,525,527,528,530,531,479,533,535],{},[442,526,519],{}," is the lightest option: it only reads the one person who is signing in and updates their name, e-mail, picture and groups. It creates nobody else and blocks nobody. If you want leavers to be blocked automatically, choose ",[442,529,489],{},", ",[442,532,499],{},[442,534,509],{},".",[537,538,539,541],"tip",{},[442,540,499],{}," is right for most companies. Changes in the directory then arrive in DDM the next morning.",[433,543,545],{"id":544},"what-a-synchronisation-does","What a synchronisation does",[438,547,548],{},"For every entry the active queries find:",[550,551,552,563,569,575],"ul",{},[553,554,555,558,559,562],"li",{},[442,556,557],{},"New person"," on one of your confirmed domains – DDM creates the account and the membership, as ",[442,560,561],{},"Member",". No invitation, no e-mail; the address counts as confirmed, because your directory vouches for it.",[553,564,565,568],{},[442,566,567],{},"Known person"," – name, e-mail and picture are updated if they changed in the directory, and the groups are set according to your rules.",[553,570,571,574],{},[442,572,573],{},"Person who already has a DDM account"," – e.g. invited by hand before the directory was set up – is taken over and from then on also signs in with their company password. This only happens if the account belongs to your organisation alone, or its address is on one of your confirmed domains.",[553,576,577,580],{},[442,578,579],{},"Changed e-mail address"," – DDM recognises the person by their directory entry and changes the address instead of creating a second account.",[582,583,584,585,588,589,535],"note",{},"New people count towards your plan's user seats. Once every seat is taken, the synchronisation adds nobody else and reports ",[442,586,587],{},"… not added — every user seat of your plan is taken","; everyone already in DDM is still updated. See ",[590,591,103],"a",{"href":104},[433,593,595],{"id":594},"what-it-never-does","What it never does",[550,597,598,604,610,619,627],{},[553,599,600,603],{},[442,601,602],{},"It never deletes anybody."," Leavers are blocked – their documents, notes and history stay.",[553,605,606,609],{},[442,607,608],{},"It never touches people it did not bring in."," Somebody invited by hand who is not in the directory is neither blocked nor moved to other groups.",[553,611,612,615,616,618],{},[442,613,614],{},"It never unblocks anybody."," DDM cannot tell whether somebody was blocked by the synchronisation or on purpose by an administrator. Unblock under ",[442,617,68],{}," if needed.",[553,620,621,624,625,535],{},[442,622,623],{},"It never changes roles."," Who is an administrator you decide under ",[442,626,68],{},[553,628,629],{},[442,630,631],{},"It never changes groups that no rule names.",[433,633,635],{"id":634},"leavers","Leavers",[438,637,638,639,642,643,646,647,649,650,535],{},"Somebody who was imported by this directory and no longer appears in the result is ",[442,640,641],{},"blocked",": they can no longer sign in, and see the message ",[442,644,645],{},"Your account is blocked in this organisation",". They are still listed under ",[442,648,68],{},", with the status ",[442,651,652],{},"Blocked",[438,654,655,656,659],{},"To make sure a faulty search does not lock out your whole company, DDM blocks ",[442,657,658],{},"nobody"," if:",[550,661,662,669,672,675],{},[553,663,664,665,668],{},"one of the queries failed (",[442,666,667],{},"Partly imported – at least one query failed. Nobody was blocked.","),",[553,670,671],{},"a query hit the limit of 5,000 entries,",[553,673,674],{},"the search found no entries at all,",[553,676,677],{},"more than half of the people known from this directory would be blocked at once – that looks like a moved OU or a typo in the Base DN, not like people leaving.",[438,679,680,681,683,684,686],{},"Only ",[442,682,482],{}," and the scheduled runs block people. ",[442,685,478],{}," for a single query never does – the other queries' people are simply not part of it.",[582,688,689,690,535],{},"In Active Directory a disabled account still exists. To have DDM block people whose account IT disables, leave disabled accounts out in the filter – see ",[590,691,693],{"href":692},"\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-services#filters-that-work","Filters that work",[433,695,697],{"id":696},"signing-in-with-the-company-password","Signing in with the company password",[438,699,700,701,704,705,708],{},"People from the directory sign in in the CMS and in the app as usual: ",[442,702,703],{},"E-mail"," and ",[442,706,707],{},"Password"," – their company password. DDM asks the directory whether the password is correct. The password is never stored in DDM, and a password change in the directory applies in DDM immediately.",[438,710,711],{},"How it works:",[713,714,715,718,728],"ol",{},[553,716,717],{},"DDM first tries the e-mail and password as a DDM password.",[553,719,720,721,724,725,535],{},"If that does not fit, it uses the service account to look up the person in the directories that ",[442,722,723],{},"belong to their account",", in the order of ",[442,726,727],{},"priority",[553,729,730,731,734],{},"It then signs in to the directory ",[442,732,733],{},"as the person",", with the password they typed. If the directory accepts, they are in.",[438,736,737,738,741,742,535],{},"People who do not have an account yet are looked up in the directories of the organisation that owns their e-mail domain. If ",[442,739,740],{},"Create accounts on first sign-in"," is on, they get their account at that moment – with the groups your rules give them – and are signed in straight away. If it is off, they see ",[442,743,744],{},"Your company password is correct, but there is no account for you here yet",[537,746,747,748,750],{},"With ",[442,749,740],{}," you can do without a regular import altogether: everybody gets their account when they first need it. A daily synchronisation is still useful – it blocks leavers.",[438,752,753],{},"Whether somebody can still set a separate DDM password is up to you: the company password works in addition to a DDM password, it does not replace it.",[433,755,419],{"id":756},"troubleshooting",[447,758,759,769],{},[450,760,761],{},[453,762,763,766],{},[456,764,765],{},"Problem",[456,767,768],{},"Cause and solution",[463,770,771,788,799,810,822,841,852],{},[453,772,773,779],{},[468,774,775,778],{},[442,776,777],{},"E-mail address or password is incorrect"," although the company password is right",[468,780,781,782,784,785,787],{},"The ",[442,783,703],{}," the person types must be exactly the address DDM has for them (the mapped address). Check the person in the preview. If they have not been imported yet and ",[442,786,703],{}," is built with a prefix, suffix or replacement, import them first.",[453,789,790,794],{},[468,791,792],{},[442,793,744],{},[468,795,796,798],{},[442,797,740],{}," is off – import the person or switch it on.",[453,800,801,805],{},[468,802,803],{},[442,804,645],{},[468,806,807,808,535],{},"The person was blocked – by an administrator or because they were missing from the directory result. Unblock under ",[442,809,68],{},[453,811,812,815],{},[468,813,814],{},"Somebody is not imported",[468,816,817,818,821],{},"Not found by any active query (check with ",[442,819,820],{},"Load preview","), no e-mail in the mapped attribute, or their address is not on a confirmed domain.",[453,823,824,827],{},[468,825,826],{},"Somebody lands in the wrong group",[468,828,829,830,479,833,836,837,840],{},"Look at the person in the preview: beside each rule it says ",[442,831,832],{},"matches",[442,834,835],{},"no match",". Remember that ",[442,838,839],{},"memberOf"," only lists direct memberships.",[453,842,843,846],{},[468,844,845],{},"Signing in takes a long time",[468,847,848,849,535],{},"A directory does not answer. DDM waits at most 5 seconds per directory at sign-in – check the host, or add a ",[442,850,851],{},"Fallback system",[453,853,854,857],{},[468,855,856],{},"Nobody was blocked although people left",[468,858,859,860,863],{},"See the safety rules under ",[590,861,635],{"href":862},"#leavers"," – one of them applied. The import result tells you which.",[438,865,866,867,870,871,535],{},"Every import, every account created or blocked and every sign-in via a directory is recorded in the ",[442,868,869],{},"Audit log"," – see ",[590,872,88],{"href":89},[433,874,876],{"id":875},"for-whoever-runs-ddm","For whoever runs DDM",[550,878,879,898,912],{},[553,880,881,884,885,889,890,893,894,897],{},[442,882,883],{},"Network:"," DDM must reach the directory's port (usually ",[886,887,888],"code",{},"636","). On an installation that serves several customers, set ",[886,891,892],{},"LDAP_PRIVATE_NETWORKS=off"," so that customers cannot point a directory at your internal network; local addresses (",[886,895,896],{},"127.0.0.1",", link-local) are always refused.",[553,899,900,903,904,907,908,911],{},[442,901,902],{},"Certificates:"," with ",[442,905,906],{},"Require TLS"," the directory's certificate is checked. If it comes from a company CA, add that CA to the trust store of the DDM server (for Node.js, e.g. with ",[886,909,910],{},"NODE_EXTRA_CA_CERTS",").",[553,913,914,917],{},[442,915,916],{},"Schedule:"," the regular synchronisation runs inside the DDM server, every hour at minute 15. If the server is not running, nothing is synchronised.",{"title":919,"searchDepth":920,"depth":920,"links":921},"",2,[922,923,924,925,926,927,928],{"id":435,"depth":920,"text":436},{"id":544,"depth":920,"text":545},{"id":594,"depth":920,"text":595},{"id":634,"depth":920,"text":635},{"id":696,"depth":920,"text":697},{"id":756,"depth":920,"text":419},{"id":875,"depth":920,"text":876},"When DDM synchronises with the directory, what it changes and what it never does, how the company password works – and what to do when something goes wrong.","md",null,{},{"icon":211},{"title":208,"description":929},"mTDLga-9FHtiBAKwAx9WsEEuFekbXXvnYIOTD6LcZ5E",[937,939],{"title":203,"path":204,"stem":205,"description":938,"icon":206,"children":-1},"Connect Active Directory, OpenLDAP or another LDAP directory – import people, sort them into groups, let them sign in with their company password.",{"title":213,"path":214,"stem":215,"description":940,"icon":216,"children":-1},"Connect your organisation's Entra ID (formerly Azure AD) – register DDM in your own tenant and enter it in DDM.",1793617719347]