Configuring LDAP Servers

This article is for IT support.

School Manager uses LDAP to sync across users and groups. Using LDAP servers allows you to add multiple Domain Controllers to School Manager.

If you use a Linewize appliance, it connects to your LDAP server, downloads, and processes the requested data, then uploads the IDs to the School Manager cloud. If you are using cloud-only filtering, the LDAP processing is done directly in the cloud. Once synced, groups can be used as classrooms in Classwize and where School Manager allows custom configurations by Group.

Before You Start

  1. Create a service account in your directory with LDAP read permission.
  2. Ensure you have a School Manager account with the Owner/Global Admin role.

Configuring LDAP Servers

Warning

You cannot configure both the LDAP and LDAP Servers page in School Manager. If you have an existing LDAP configuration, you must migrate it across to the LDAP Servers page.

  1. Go to Configuration > Authentication > LDAP Servers.
  2. Select Add LDAP Server.
  3. Select Enabled.
  4. Select Sync Enabled. This will sync the list of users and groups automatically between 00:00-02:00 UTC every day.

Caution

If you are using multiple Domain Controllers, select Sync Enabled on only one Domain Controller.

  1. You can select Sync Organization Units. If enabled, this will sync any organizational units previously set up on your server.
  2. Select the Server Type using the dropdown.
Server Type Description 
Manual This allows full customization of field mapping
Active Directory The standard for Windows Server and the most commonly used server type
OpenLDAP Commonly used with macOS Server
Novell eDirectory This is an old protocol that some schools still use today
  1. Select the Protocol using the dropdown.
Protocol Description
LDAP This is the most commonly used protocol
LDAPS This refers to Secure LDAP.
  1. Enter the Server Hostname. This is the server IP address. You can also type in the hostname if you have set up internal DNS.
  2. Enter the Server Port. LDAP uses Port 389
  3. Enter the Base DN. This is where the server will search for users. This would normally be done at the top level (DC=) but it can also be done at a user level (OU=).
  4. Enter a Username. We recommend using the following naming convention DOMAIN\username or username@DOMAIN
  5. Enter the Password from your service account.
  1. You have the option to change the Search Query. The default (objectClass=*) will sync users and groups.
  2. Syncing by DN will maintain multiple groups with the same name.
    1. Select Sync BY DN for LDAP services.
    2. Clear Sync by DN if you use an eDirectory service.
  3. When you are complete, select Save.

Syncing LDAP Servers

Info

The sync process typically lasts between 5 and 30 minutes, although it might take longer based on your directory's size.

  1. Select Sync All and Refresh the page. 
  2. Once the sync is finished, check the Status section to see whether the sync was successful or unsuccessful. 
  3. The Status column will display the number of synched users and groups when successfully synced.

 

LDAP Servers Troubleshooting

Failed to Sync: Can’t contact LDAP server

Check these services are available and settings are correct, then try another sync:

  • The LDAP server is online and reachable.
  • Your Linewize appliance is online.
  • The LDAP server entry is filled out completely.
  • The Server Port is set to 389.
  • The IP address for the Server Hostname is complete. You can enter a hostname if you have internal DNS configured.
  • Connectivity exists between your Linewize appliance and your LDAP server.

If all checks fail, please contact Linewize Support for further assistance.

Failed to Sync: Referral

Check the Base DN (step 10) is correct then try another sync
If this check fails, please contact Linewize Support for further assistance.

Failed to Sync: Invalid credentials

Ensure your credentials (step 11) are correct then try another sync:

  • You have entered the correct username and password.
  • You have the correct username naming convention (DOMAIN\username or username@DOMAIN).

If all checks fail, please contact Linewize Support for further assistance.

Failed to Sync: Operations error

Ensure the following are correct then try another sync:

  • You have the correct username naming convention (DOMAIN\username or username@DOMAIN).
  • Your Domain Controller DNS settings are configured.

If all checks fail, please contact Linewize Support for further assistance.

Failed to Sync: Could not connect to the device

Check this service is available and settings are correct, then try another sync:

  • Your Linewize appliance is online and reachable.

If this check fails, please contact Linewize Support for further assistance.

Failed to Sync: No such object

Check the Base DN (step 10) is correct then try another sync

If this check fails, please contact Linewize Support for further assistance.

Failed to Sync: Stong(er) authentication required

Check the Protocol (step 7) is correct then try another sync

If this check fails, please contact Linewize Support for further assistance.

Was this article helpful?
0 out of 0 found this helpful
Share

Comments

0 comments

Please sign in to leave a comment.