This article is for IT support.
School Manager uses LDAP to sync across users and groups. Using LDAP servers allows you to add multiple Domain Controllers to School Manager.
If you use a Linewize appliance, it connects to your LDAP server, downloads, and processes the requested data, then uploads the IDs to the School Manager cloud. If you are using cloud-only filtering, the LDAP processing is done directly in the cloud. Once synced, groups can be used as classrooms in Classwize and where School Manager allows custom configurations by Group.
Before You Start
- Create a service account in your directory with LDAP read permission.
- Ensure you have a School Manager account with the Owner/Global Admin role.
Configuring LDAP Servers
Warning
You cannot configure both the LDAP and LDAP Servers page in School Manager. If you have an existing LDAP configuration, you must migrate it across to the LDAP Servers page.
- Go to Configuration > Authentication > LDAP Servers.
- Select Add LDAP Server.
- Select Enabled.
- Select Sync Enabled. This will sync the list of users and groups automatically between 00:00-02:00 UTC every day.
Caution
If you are using multiple Domain Controllers, select Sync Enabled on only one Domain Controller.
- You can select Sync Organization Units. If enabled, this will sync any organizational units previously set up on your server.
- Select the Server Type using the dropdown.
Server Type | Description |
---|---|
Manual | This allows full customization of field mapping |
Active Directory | The standard for Windows Server and the most commonly used server type |
OpenLDAP | Commonly used with macOS Server |
Novell eDirectory | This is an old protocol that some schools still use today |
- Select the Protocol using the dropdown.
Protocol | Description |
---|---|
LDAP | This is the most commonly used protocol |
LDAPS | This refers to Secure LDAP. |
- Enter the Server Hostname. This is the server IP address. You can also type in the hostname if you have set up internal DNS.
- Enter the Server Port. LDAP uses Port 389
- Enter the Base DN. This is where the server will search for users. This would normally be done at the top level (DC=) but it can also be done at a user level (OU=).
- Enter a Username. We recommend using the following naming convention DOMAIN\username or username@DOMAIN
- Enter the Password from your service account.
- You have the option to change the Search Query. The default (objectClass=*) will sync users and groups.
- Syncing by DN will maintain multiple groups with the same name.
- Select Sync BY DN for LDAP services.
- Clear Sync by DN if you use an eDirectory service.
- When you are complete, select Save.
Syncing LDAP Servers
Info
The sync process typically lasts between 5 and 30 minutes, although it might take longer based on your directory's size.
- Select Sync All and Refresh the page.
- Once the sync is finished, check the Status section to see whether the sync was successful or unsuccessful.
- The Status column will display the number of synched users and groups when successfully synced.
LDAP Servers Troubleshooting
Failed to Sync: Can’t contact LDAP server
Check these services are available and settings are correct, then try another sync:
- The LDAP server is online and reachable.
- Your Linewize appliance is online.
- The LDAP server entry is filled out completely.
- The Server Port is set to 389.
- The IP address for the Server Hostname is complete. You can enter a hostname if you have internal DNS configured.
- Connectivity exists between your Linewize appliance and your LDAP server.
If all checks fail, please contact Linewize Support for further assistance.
Failed to Sync: Referral
Check the Base DN (step 10) is correct then try another sync
If this check fails, please contact Linewize Support for further assistance.
Failed to Sync: Invalid credentials
Ensure your credentials (step 11) are correct then try another sync:
- You have entered the correct username and password.
- You have the correct username naming convention (DOMAIN\username or username@DOMAIN).
If all checks fail, please contact Linewize Support for further assistance.
Failed to Sync: Operations error
Ensure the following are correct then try another sync:
- You have the correct username naming convention (DOMAIN\username or username@DOMAIN).
- Your Domain Controller DNS settings are configured.
If all checks fail, please contact Linewize Support for further assistance.
Failed to Sync: Could not connect to the device
Check this service is available and settings are correct, then try another sync:
- Your Linewize appliance is online and reachable.
If this check fails, please contact Linewize Support for further assistance.
Failed to Sync: No such object
Check the Base DN (step 10) is correct then try another sync
If this check fails, please contact Linewize Support for further assistance.
Failed to Sync: Stong(er) authentication required
Check the Protocol (step 7) is correct then try another sync
If this check fails, please contact Linewize Support for further assistance.
Comments
0 commentsPlease sign in to leave a comment.