Skip to main content

LDAP

LDAP and Active Directory let users sign in to Files.com with their directory passwords. The directory confirms the password, while the Files.com account and its permissions determine access. For an administrator evaluating this connection, the important choices are which directory account a username identifies and whether Files.com verifies the directory before sending credentials.

Directory Account Matching

The LDAP provider's Username Field selects the directory attribute used to find the account, and Base Search Path limits the search to entries at or below that location. With sAMAccountName, Files.com removes the provider's configured domain suffix from the Files.com username before searching. With userPrincipalName, it keeps the full username, including the domain. If the configured field has no match, Files.com also searches the directory's uid attribute.

Each search uses the complete value as literal text. A partial username match does not select an entry. Each value must identify one directory entry within the search scope. Your directory administrator is responsible for preventing duplicates.

If several entries match, Files.com selects the first entry returned by the directory and checks the password against that entry. It does not try the other matching entries if the password fails. Duplicate values therefore let the directory's result order determine which account's password is accepted. The LDAP/Active Directory configuration guide explains the username and search settings.

Password and Directory Verification

Files.com accepts a directory password only after a successful LDAP bind: the directory must confirm authentication with the supplied credentials. A referral to another directory, or another result that does not confirm authentication, does not count as a correct password.

With Secure Connection enabled, Server Certificate determines how Files.com verifies the directory before sending the service account's credentials or checking a user's password. Connected System Identity explains the certificate choices and their consequences. Password confirmation and directory identity are separate checks; encryption alone does not establish which system receives the credentials.