Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/gnmyt/Nexterm/llms.txt

Use this file to discover all available pages before exploring further.

LDAP authentication lets users log in to Nexterm with their existing directory credentials. Nexterm uses a service account to search the directory for the user, then verifies the password by binding as that user. On success, Nexterm creates or updates a local account with attributes from the directory entry and issues a session token.

​
How it works

Each login attempt follows these steps:
1

Service account bind

Nexterm connects to your LDAP server and binds using the configured Bind DN and Bind Password to gain search access.
2

User search

Nexterm searches the Base DN subtree using your User Search Filter, replacing the {{username}} placeholder with the value the user typed at login.
3

Credential verification

Nexterm attempts to bind to the directory as the matched user using the password they provided. A successful bind means the credentials are correct.
4

Account sync

Nexterm creates a local account for first-time users, or updates the first and last name for returning users, based on the directory attributes.
5

Session creation

Nexterm issues a session token and logs the user in.
Enabling an LDAP provider automatically disables the internal (local password) provider. Make sure your LDAP server is reachable from Nexterm before enabling the provider.

​
Adding an LDAP provider

1

Open authentication settings

Go to Settings → Authentication and click Add LDAP.
2

Fill in the connection fields

Enter the server details, bind credentials, and search configuration as described in the fields table below.
3

Test the connection

Click Test Connection to verify Nexterm can reach the server and bind successfully with the service account credentials.
4

Enable the provider

Toggle the provider to enabled. Nexterm will disable the internal provider automatically.

​
Provider fields

FieldDescription
NameA label to identify this provider in the admin interface.
HostHostname or IP address of your LDAP server.
Port389 for plain LDAP, 636 for LDAPS.
Bind DNDistinguished name of the service account Nexterm uses for directory searches.
Bind PasswordPassword for the service account. Stored encrypted at rest using your ENCRYPTION_KEY.
Base DNThe directory subtree to search for users (for example, CN=Users,DC=corp,DC=example,DC=com).
User Search FilterLDAP filter used to locate a user. Use {{username}} as a placeholder for the login input.
Use TLSEnable when connecting to an LDAPS endpoint on port 636.

​
Example configurations

Host:                dc01.corp.example.com
Port:                636
Bind DN:             CN=svc_nexterm,CN=Users,DC=corp,DC=example,DC=com
Base DN:             CN=Users,DC=corp,DC=example,DC=com
User Search Filter:  (sAMAccountName={{username}})
Use TLS:             enabled
For Active Directory, change the Username attribute mapping to sAMAccountName in Advanced Settings. The default uid attribute is not used in AD.

​
Search filter reference

The {{username}} placeholder in the search filter is replaced with the exact string the user enters at login.
DirectoryFilterNotes
Active Directory(sAMAccountName={{username}})Use the Windows login name (pre-2000 format).
OpenLDAP(uid={{username}})Standard POSIX uid attribute.
Email login(mail={{username}})Lets users type their email address instead of a username.
Combined (person + uid)(&(objectClass=person)(uid={{username}}))Restricts results to user objects; useful when the base DN contains non-person entries.

​
Attribute mapping

Nexterm reads three attributes from the matched directory entry. The defaults work for most OpenLDAP schemas. Override them in Advanced Settings if your directory uses different attribute names.
Nexterm fieldDefault attributeActive Directory equivalent
UsernameuidsAMAccountName
First namegivenNamegivenName
Last namesnsn

​
Testing the connection

After saving the provider, click Test Connection. Nexterm binds to the directory using the configured service account and reports whether the bind succeeds. A successful test confirms the host, port, Bind DN, and Bind Password are correct.
A passing connection test only checks the service account bind. To confirm that user searches work, try logging in with a directory account after enabling the provider.

​
Troubleshooting

Nexterm cannot connect to the LDAP server. Check:
  • The Host field matches your server’s hostname or IP.
  • The Port is correct (389 for LDAP, 636 for LDAPS).
  • A firewall is not blocking the connection from the Nexterm host to the LDAP server on that port.
You can test reachability from the Docker host with:
nc -zv dc01.corp.example.com 636
The service account bind failed. Check:
  • The Bind DN is the full distinguished name, including all CN= and DC= components.
  • The Bind Password is correct and has not expired.
  • The service account is not locked or disabled in your directory.
If the first or last name is blank or incorrect, the directory attributes may differ from the defaults. Check the actual attribute names on a user entry in your directory and update the attribute mapping in Advanced Settings accordingly.

Build docs developers (and LLMs) love

Get started for freeTalk to us