Before you can use LDAP group authentication on the LoadMaster, you must add and configure an LDAP endpoint. The endpoint defines the LDAP server connection settings and the binding account that the LoadMaster uses to query the directory.

  1. In the main menu, go to Certificates & Security > LDAP Configuration.

  2. Enter a name for the LDAP endpoint configuration and click Add.
    Note: Spaces and special characters are not permitted in the endpoint name.

  3. Configure the endpoint fields as described in the following table:
    Field Description
    LDAP Server(s)

    Type the IP address or Fully Qualified Domain Name (FQDN) of your LDAP server. To specify multiple servers, separate each address with a space (not a comma).

    To use a non-default port, append the port number after the address using a colon. For example: 10.1.1.10:389 10.1.1.11:389.

    If you have multiple domains and are using Permitted Groups, you may need to include the Active Directory Global Catalog port. The default Global Catalog port is 3268. For example: 10.1.1.10:3268.
    LDAP Protocol

    Select the transport protocol to use when communicating with the LDAP server:

    • Unencrypted - uses standard LDAP (ldap://) with no encryption.
    • StartTLS - upgrades the connection to TLS after the initial connection is established.
    • LDAPS - uses LDAP over SSL/TLS (ldaps://) from the start of the connection. If you create an SSO domain with the Authentication Protocol set to Certificates, set this field to LDAPS.
    Validation Interval Specify how often (in seconds) the LoadMaster re-validates a user against the LDAP server.
    Referral Count

    Controls LDAP referral chasing for multi-domain Active Directory environments. Set to 0 to disable referral support. Set to a value between 1 and 10 to enable referral chasing and limit the number of hops followed.

    Note: Using the Active Directory Global Catalog is the preferred approach for multi-domain environments, because it avoids the performance impact of referral chasing.
    Server Timeout Specify the LDAP server timeout in seconds. Valid values are 5 to 60. The default value is 5.
    Admin User

    Type the username of the account that the LoadMaster uses to bind to the LDAP directory and perform user and group lookups. This is sometimes called a service account or bind account.

    The following credential formats are accepted, depending on your directory configuration:

    • User Principal Name (UPN): user@domain.com - recommended for most Active Directory environments.
    • Distinguished Name (DN): CN=BindUser,OU=ServiceAccounts,DC=domain,DC=com - use this format if your directory policy requires it.
    • sAMAccountName: DOMAIN\username or just username — supported in some configurations but UPN is preferred for compatibility.
    Admin User Password Type the password for the Admin User binding account.

The LDAP endpoint is created and available for use in WUI authentication, Single Sign-On (SSO) domains, and health checks. You can now create the remote user groups. Refer to the following section: Create the Remote User Groups.