- Hosted LDAP Providers

Azure Active Directory

Your Azure AD needs to have LDAP enabled, and password hash synchronization enabled, and it needs to be accessible to the server running Snipe-IT on port 389 and/or 636.

Microsoft's documentation on LDAP is here: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-ldaps

Specifically, an important part of that is:

Users (and service accounts) can't perform LDAP simple binds if you have disabled NTLM password hash synchronization on your managed domain.

Documentation on how to do that is here: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/secure-your-domain

Note that, after enabling the password hash system, users must change their passwords first before they can login. This is not a Snipe-IT limitation, it's unfortunately built-in to Azure itself.

Okta

Snipe-IT LDAP/AD works with Okta, and you should use the settings below, changing the placeholder information to your actual Okta subdomain:

• Active Directory : False
• Active Directory domain : Null
• LDAP Server: ldaps://your-okta-subdomain.ldap.okta.com
• Use TLS: leave unchecked (ldaps:// is already secure!)
• LDAP Bind Username: [email protected],ou=users,dc=your-okta-subdomain,dc=okta,dc=com
• Base Bind DN: dc=your-okta-subdomain,dc=okta,dc=com or possibly something like ou=users,dc=your-okta-subdomain,dc=okta,dc=com, depending on your configuration.
• LDAP Filter: &(uid=*) or possibly objectClass=inetOrgPerson depending on your configuration.
• Username field: uid
• Last Name: sn
• First Name: givenname
• LDAP Authentication Query: uid=
• LDAP Version : 3
• LDAP Active Flag : (leave this blank)

Note that these may not be exact values, as it will depend upon how you've set up your Okta account.

Testing the LDAP synchronization might return a admin limit exceeded exception from the Okta LDAP Interface if you don't limit the expected results (see : LDAP Interface known issues ).
To build your LDAP filter, see LDAP filter Syntax.

Here is a query exemple to limit the results that Okta should return :
(&(objectClass=inetOrgPerson)(organization=MyOrg)(organizationalStatus=ACTIVE))

JumpCloud

To use JumpCloud's LDAP-as-a-Service, please see the documentation on JumpCloud's website.

OneLogin

• Active Directory: false
• LDAP Server: ldaps://ldap.XY.onelogin.com (with a country code like 'us' or 'eu' for XY)
• LDAP Bind Username: [email protected],ou=users,dc=customer-name,dc=onelogin,dc=com
• Base Bind DN: ou=users,dc=customer-name,dc=onelogin,dc=com LDAP Filter: &(cn=*)
• Username Field: uid
• Last Name: sn
• LDAP First Name: givenname
• LDAP Auth Query: uid=

❗️

Getting Partial Results only on large directories (>500 users)?

OneLogin has a Pagination feature they need to activate for your account in order for Snipe-IT to see all of your users. Snipe-IT fetches users 500 at a time, and then uses pagination to get the rest of the results. Please talk to your OneLogin account rep and ask them to turn on paging for your account. Then Snipe-IT will be able to fetch all of your users.

Google Secure LDAP service

As of Snipe-IT v5.2.0, Snipe-IT now supports user syncing with Google Secure LDAP.

Part One: Google Workspace Configuration

Browse to https://admin.google.com and log in with your Google Workspace Administrator credentials.

Click on the left icon bar and choose Apps > LDAP

🚧

If you do not see LDAP as an option, you may not have it on your account!

Consider upgrading your account or purchasing the "Cloud Identity Premium" Add-On.

Click "ADD CLIENT" near the upper right

Name your LDAP connection (Snipe-IT might be a good name), and optionally add a description

For Access Permissions, in "Verify User credentials" pick "Entire domain" (optionally, you can restrict it to selected OU's, groups, and excluded groups if you want to limit which users show up in your Snipe-IT instance). in "Read user information" pick "Entire domain" (unless, again, you want to limit which attributes show up). Click "ADD LDAP CLIENT"

Click on "Download certificate". Then click "CONTINUE TO CLIENT DETAILS"

In the Authentication pane, click on Access Credentials, then click "GENERATE NEW CREDENTIALS". Copy both the Username and Password (both of which are randomly generated!). Paste the username somewhere safe so you can use it in a later step. To copy the password, you can click the 'eye' icon or click the button that says 'click to copy password'. Make sure to paste the password somewhere safe, as Google will not show it to you again once you close that dialog box.

Click on the upward-facing triangle near the upper-right.

Click anywhere in the Service Status Pane.

Click "ON for everyone" and then click "SAVE"

Part Two: Snipe-IT Configuration

In Snipe-IT, click the gear icon in the upper right. Click "LDAP."

Turn on the LDAP enabled checkbox.

Open the ZIP file that you downloaded from google. Open the two resulting files in any text editor.

You'll find two new fields in the Admin Settings > LDAP configuration of the UI: LDAP Client-Side TLS key and LDAP Client-Side TLS Certificate. (Warning: some versions of Snipe-IT incorrectly display the LDAP Client-Side TLS Key field name as: admin/settings/general.ldap_client_tls_key. This has been fixed in a later release.) Paste the contents of the .key file into the TLS key field, and the contents of the .crt file into the TLS Certificate field.

For LDAP Server put ldaps://ldap.google.com

For LDAP Bind Username put the username you got from the Access Credentials step in Part One.

For LDAP Bind Password put the password you got from the Access Credentials step in Part One.

For Base Bind DN put your domain with dc= components for each part of your domain. For example, for grokability.com we would put dc=grokability,dc=com . For example.grokability.com, we would put dc=example,dc=grokability,dc=com.

For LDAP filter put &(cn=*)(objectClass=person) to limit results to user accounts only.

For the Username Field you will probably want that to be mail, since you won't be able to log in to these accounts using SAML Single-sign-on without it.

Last Name should be sn

First Name should be givenname

LDAP Version should be 3

Employee Number should be employeenumber
Department should be departmentnumber
Email should be mail
Job Title should be title

Now click 'Save'.

📘

You must click 'Save' before you can test your settings!

If you click 'Test LDAP Synchronization` without having clicked the 'Save' button, the saved credentials, not the contents of the form you've been filling out, will be tested. This will be corrected in a later release.

After clicking 'Save', you can now return to the LDAP settings page and should be able to click "Test LDAP Synchronization." If that works, then your LDAP configuration is complete!

Note that since Google Secure LDAP does not currently support logging in via Secure LDAP, you'll want to configure your Snipe-IT instance to work with Google's SAML setup instead. (This is a limitation in Google, not with Snipe-IT.)