While basic functionalities such as LDAP connection to sync user names and unique identifiers remain in the community plan, the premium plan will exclusively offer extended user attribute sync, group/team management, and background sync.
{% hint style="success" %} For an overview of the Identity Management features available across our various plans, please refer to authentication-across-plans.md. {% endhint %}
Directory service
A directory service is a shared system that helps organize and manage various items and network resources, such as files, users, printers, and devices. Examples include Microsoft AD, NetIQ eDirectory, and Apache Directory.
LDAP
Lightweight Directory Access Protocol (LDAP) is a protocol designed to enable easy access to and management of distributed directory information services over an IP network.
SAML
Security Assertion Markup Language(SAML) is an open standard for exchanging authentication and authorization data between parties, particularly between an identity provider and a service provider.
OAuth
OAuth is a widely-used open standard for granting websites and apps access to users' info on other platforms, without revealing passwords. Examples include Google, Facebook, LinkedIn, and Twitter.
Integrating with your organization's user directory ensures timely updates to user access. For instance, when someone joins the organization, their Rocket.Chat account is automatically created, and when they leave, their account is promptly deactivated. This becomes more crucial as the user scale increases.
Single Sign-On (SSO) allows users to authenticate once and access multiple independent software systems using a single set of credentials. SSO doesn't affect workspaces using social login capabilities (e.g., Google, LinkedIn), where users sign in through those platforms.
We are rewriting the LDAP feature in TypeScript and improving it over time. If you can't use your code due to this, be rest assured that we acknowledge community contributions. For those who contributed to LDAP/SAML/Custom OAuth, steps are taken to ensure that the changes do not negatively impact your operations.
If the Rocket.Chat workspace is air-gapped but linked to an internal LDAP server, subscribe to any of Rocket.Chat's premium plan to access advanced LDAP/SAML/OAuth features.
No, there are no adverse effects.
This error indicates that the login attempt was successful, but a follow-up search for the user on the LDAP Server returned no results. To resolve this, disable the "Find user after login" setting.
Use the "Sync User Active State" setting in #advanced-sync. Please be aware that compatibility with all LDAP Servers is not guaranteed.
If you're unable to log in without receiving error messages (and the last log entry is "Attempt to bind"), ensure that the LDAP account username doesn't match any local account username on your workspace. For instance, if you have a local user with the username "joe", enabling LDAP and attempting to log in with the same username "joe" from your LDAP server may fail without providing an error message. In this case, you won't be able to log in using "joe," your LDAP password, or your local password.
Every Rocket.Chat user must have an email address. Therefore, either the LDAP users have an email address or you set a default domain using the "default domain" setting in ldap-data-sync-settings.md.