What is LDAP?

1. A single source of truth for all users and credentials.
   
2. Easy integration with LDAP-supported applications like Linux systems, Atlassian Jira, OpenVPN, printers, and more.
   
3. Secure authentication over the cloud (LDAPS).
   

What is a service account?

Prerequisites

1. Zoho Directory account with admin privileges
   
2. Cloud LDAP enabled in your Zoho Directory admin console
   
3. Users already added or synced to your Zoho Directory account
   

Add LDAP clients

1. Sign in to Zoho Directory, then click Admin Panel in the left menu.
   
2. Go to LDAP in the left panel, if not configured, click Configure LDAP. If already configured, click Add LDAP Client in the Clients tab.
   
3. Under LDAP client name field, enter a name (for example, Printer).
   
4. Under BindDN service account, if not added already, click Add service account. Enter a username for the service account, copy the generated password, and then click Save. 
   

   You'll need the generated password when connecting your client to the Secure LDAP service, so make sure to save it. Otherwise, you will have to regenerate a new password.
5. Now, select from the added accounts and click Save and Next.
   

Configure access permissions and attributes

1. To include users that an LDAP client can access to verify the user credentials, tick the checkbox Verify user credentials.
   
2. Tick the checkbox Read user information to select the attributes that the LDAP client can have access to.
   
3. Select one from the available LDAP attributes and click Save and Next.
   
4. To add a custom attribute, go to the Attributes tab, click Manage Attributes.
   
5. Click Add Attribute. Enter an attribute name.
   
6. For Field value, select from the profile fields or enter a hardcoded value. Then, click Add. You can select the custom-added attribute on the permissions page. 

Assign members

1. In the Summary page, click Assign Members at the bottom page to assign users to the client.
   
2. Under Choose Users, click to either select users manually or attach file.
   
3. After selecting, click Assign.

Add a service account

1. Under LDAP section, go to Service Accounts tab.
   
2. Click Add Service Account.
   
3. Enter a username for the service account, copy the generated password, and then click Save.
   

You'll need the generated password when connecting your client to the Secure LDAP service, so make sure to save it. Otherwise, you will have to regenerate a new password.

Delete a service account

1. Under LDAP section, go to Service Accounts tab.
   
2. Hover over the required service account, and click Delete.
   

If the service account is mapped to clients, you'll have to dissociate the clients from the service account to delete.

Edit access permissions

1. Sign in to Zoho Directory, then click Admin Panel in the left menu.
   
2. Go to LDAP, and click Clients tab.
   
3. Click on the required client from the list, click Edit, and then click Save and Next.
   
4. Tick or untick the access permissions checkbox based on your preference.

Edit LDAP client details

1. Go to Clients tab, and hover over the required client name.
   
2. Click , then click Edit.
   
3. Edit the necessary details on the page and click Save and Next.

Deactivate/ Delete LDAP client

1. Go to Clients tab, and hover over the required client name.
   
2. Click  , then click Deactivate.
   
3. To delete a client, click Delete. Once deleted, you can no longer retrieve the client's information. 
   
   

Connect LDAP clients to the Cloud LDAP service

Depending on the type of client, there are different instructions for connecting them to the LDAP service.

For encryption between the client and LDAP server, LDAPS is preferred. But, if you choose to use LDAP, it is necessary to enable StartTLS for security purposes.

LDAP-supported operations

1. StartTLS: A way to encrypt the connection, keeping your data safe while it’s sent over the network.
   
2. Who Am I?: Lets you check which user or application you’re currently authenticated as.

Certain LDAP clients, such as Atlassian Jira and SSSD, perform a user lookup to get more information about a user during user authentication. To make sure user authentication works correctly for such LDAP clients, you'll need to turn on Read user information for all organizational units where Verify user credentials is turned on.