Log inSign upBook a demo
Tines Stories
  1. Docs
  2. Self-Hosted
  3. Configuring Tines
  1. Docs
  2. Self-Hosted
  3. Configuring Tines

LDAP authentication

Last updated Open markdown version

The default Tines identity provider can be configured by self hosted customers to authenticate users via LDAP (as opposed to via email or SSO).

As an admin, you can configure LDAP from **Access & security → Authentication** in the settings center:

Configuring LDAP

  1. Go to Access & Security -> Authentication.

  2. In the LDAP section, select Unlock to make changes.

  3. Enter your directory's host and base DN, along with any other settings you need.

  4. Turn on Enable LDAP and select Lock to save changes.

Required Settings

  • Host - The hostname or IP address of your LDAP server

  • Base DN - The base distinguished name for searches (e.g., dc=example,dc=com). Leave blank for an anonymous bind.

Optional Settings

  • Port - The port number (default: 636)

  • Bind DN - The distinguished name to bind with for searches (optional for anonymous bind)

  • Bind password - The password for the bind DN (required if whenever a bind DN is set)

ℹ️ Note: Your bind password is never shown again after you save it. To replace it, enter a new value. To remove both the bind DN and the password, select **Remove bind credentials**.

  • User filter - The filter to find users (default: (uid=${username})).

  • Email attribute - The attribute containing user email (default: mail)

  • First name attribute - The attribute containing first name (default: givenName)

  • Last name attribute - The attribute containing last name (default: sn)

  • Encryption - Transport security: LDAPS (implicit TLS, the default), StartTLS, or none

  • CA certificate - Inline PEM string of one or more CA certificates

  • Connect timeout - Connection timeout in seconds (default: 10)

  • Read timeout - Read timeout in seconds (default: 10)

⚠️ Security Warning: Disabling SSL verification makes your LDAP connection vulnerable to man-in-the-middle attacks. Only disable these settings in secure, isolated environments for testing purposes.

  • Verify peer - Verify server certificate is valid and trusted (default: on)

  • Verify hostname - Verify certificate matches the hostname (default: on)

How It Works

  1. When LDAP is configured, an “Sign in with LDAP” option appears on the login page

  2. Users enter their LDAP username and password

  3. The system searches for the user in LDAP using the configured filter

  4. If found, it attempts to authenticate by binding with the user’s credentials

  5. Upon successful authentication, user information is extracted from the following LDAP attributes:

    • Email (required): Extracted from the email attribute (default: mail).

    • First Name (optional): Extracted from the first name attribute (default: `givenName`).

    • Last Name (optional): Extracted from the last name attribute (default: `sn`).

  6. If the email address is missing or blank, authentication fails with “No email address found for user”

  7. The user is then signed in to their Tines tenant

Important: The email attribute is required for successful authentication. If your directory stores email under a different attribute set the email attribute accordingly.

Common Issues

  1. “Sign in with LDAP” not appearing - Ensure LDAP is enabled, and that a host and base DN are set.

  2. “Incorrect username or password” - Check the user filter and base DN, and verify the username and password are correct.

  3. “Incorrect username or password” (when multiple users match) - If your user filter returns multiple users, authentication fails with the same error as an incorrect password. Check the server logs for "Multiple users found" messages:

    • Review your user filter to make it more specific

    • Ensure usernames are unique in your LDAP directory

    • Consider using a more specific base DN to limit the search scope

  4. “LDAP connection failed”

    • Verify encryption mode is set correctly

    • Ensure the server certificate is trusted via system trust or a CA certificate

    • Confirm the host / port and network connectivity

  5. Connection timeouts

    • Increase the connect timeout for slow network connections

    • Increase read timeout for slow LDAP servers or large directories

    • Check network connectivity and firewall rules

  6. SSL/TLS certificate errors

    • Certificate verification failed: Set a CA certificate, or temporarily turn off verify peer for testing

    • Hostname verification failed: Certificate is valid but for different hostname - turn off verify hostname if using load balancers or internal hostnames

    • Self-signed certificate: Turn off verify peer for testing, but consider using proper certificates in production

Was this helpful?