ManualWorks supports login with LDAP (Lightweight Directory Access Protocol).

Configuring LDAP

In the <Admin | Preferences | API> menu, click the <Change> link in the LDAP panel, and configure LDAP.

The input items are as follows.

LDAP input items
Item	Description
LDAP	Select this to log in with LDAP. If it is not selected, users cannot log in with LDAP even if the other items are set.
LDAP Enable TLS Connection	Select this to connect to the LDAP server over TLS.
Synchronize with LDAP	When selected, changes to a user's name or email address in LDAP are applied to the ManualWorks user information when the user logs in.
LDAP Host	The LDAP server address. You can omit `ldap://`. To use SSL, add `ldaps://` in front, and change the LDAP port to match the LDAP server.	localhost
LDAP Port	The default is `389`.	389
LDAP Principal	The LDAP account used to connect to the LDAP server to search for users.	cn=Manager,dc=my-domain,dc=com
LDAP Credentials	The password of the LDAP account used to connect to the LDAP server to search for users. Click the <Change Password> link to enter it.
LDAP Base DN	The base distinguished name	ou=people,dc=my-domain,dc=com
LDAP User Filter	The filter used to search for users. Enter the username as `${uid}`. The default is `uid=${uid}`.	uid=${uid}
LDAP ID Attribute	The name of the ID attribute. The default is `uid`.	uid
LDAP Name Attribute	The name of the name attribute. The default is `displayName`.	displayName
LDAP Mail Attribute	The name of the mail attribute. The default is `mail`.	mail

When you select the “LDAP” option and fill in all items, the <Test LDAP> link appears in the LDAP panel. Enter a username and password to check whether the LDAP user can be found and can log in.

Even if the LDAP settings are wrong or the LDAP server cannot be reached, users can still log in with their ManualWorks password. For LDAP configuration problems, check the log files.

LDAP Login Policy

Keep the following in mind when users log in with LDAP.

If a user who logs in with LDAP does not exist in ManualWorks, the user is created automatically. If a username created before the LDAP integration matches the LDAP username, that user is used as is.
- The user is added to groups set to automatic assignment.
Users who log in with LDAP for the first time get the Write & Read role. If the licensed user limit is reached, they get the Read Only role instead.
You can give a different role with Changing the Initial Role.
Administrators can change the role in the <Users> menu.
Users who log in with LDAP cannot change their name, email address, or password in ManualWorks.
If you select the “Synchronize with LDAP” option, changes to a user's name or email address in LDAP are applied when the user logs in. Otherwise, the information from when the user was first created is kept.
If an administrator gives the user a password in ManualWorks, the user can log in with either LDAP or the ManualWorks password.

Changing the Initial Role

Specify the role to give users who log in for the first time through external authentication. LDAP does not pass role information, so it always uses this setting. OAuth 2.0 uses it when the authentication server sends roles as 3rabbitz or leaves it empty. Run the following command.

set-preference -name DEFAULT_ROLE -value reader

Note the following.

To give several roles, separate them with semicolons, such as reader;translator.
You can specify admin, editor, writer, translator, and reader. Any other value is not set, and an error is shown.
If the licensed user limit is reached, the Write & Read, Create Style, Translator, and Administrator roles are not given, and only the Read Only role is given.
If you do not set it, ManualWorks works as before. To remove the setting, run remove-preference -name DEFAULT_ROLE.
It does not apply to existing users. Roles that an administrator changed in the <Users> menu are kept when the user logs in again.
It does not apply to users who log in with Google, Facebook, or Naver accounts.