Guide
Guide
No identity provider, only an OpenLDAP or Active Directory directory: your users get in with their organisation username and password.
SpotBooker checks the username and password against your directory, then applies the same entry rules as Microsoft and SAML sign-in. The password is never stored. LDAP sign-in is included in the subscription and available during the free trial. Only your workspace administrators can set it up, together with IT.
| You need | Why |
|---|---|
| A directory over LDAPS or StartTLS | Plain-text connections are not offered: passwords would travel readable. The server certificate is always checked, so the server name must match its certificate. |
| A directory reachable from the internet | SpotBooker reaches your directory from the address 178.128.162.107: allow it in your firewall, on the chosen port. Private or reserved addresses (10.x, 192.168.x, localhost…) are refused. |
| A read-only service account | It is used to find the person in the directory before checking their password. Anonymous searches are not used. |
| An email address on every account | SpotBooker identifies and notifies people by their address (the mail attribute by default). An account without an address cannot get in. |
The server name only, without ldap:// or a port; several servers separated by commas are tried in order. Choose the encryption, LDAPS (port 636) or StartTLS (port 389), and adjust the port if needed. Paste the authority certificate (PEM) only if your directory's certificate is signed by an internal authority.
Its DN and password. The password is encrypted when saved and never shown again; leave the field empty to keep the saved one.
The search base, for instance ou=people,dc=institute,dc=edu, and the user filter: (objectClass=person) by default. To restrict access to a group: (&(objectClass=person)(memberOf=cn=spotbooker,ou=groups,dc=institute,dc=edu)). Finally, choose what your users type: uid (OpenLDAP), sAMAccountName or userPrincipalName, the sign-in address (Active Directory).
“Test the connection” tries what is on screen without saving it: it reaches the server, binds with the service account and counts the users the filter keeps. If it fails, the message says which step is blocking.
The usual names are recognised out of the box: objectGUID or entryUUID for the stable identifier, mail, givenName, sn and memberOf. Only fill in the attribute mapping if your directory uses other names.
As with SAML, accepted email domains limit access to those addresses, let your users find your organisation from the sign-in page and allow an existing SpotBooker account to be linked. With automatic admission, anyone in the directory gets in with no admin rights; without it, each first sign-in files an access request. These settings belong to LDAP. Discovery from the login page, linking of existing accounts and automatic admission only apply once the domain is proven (see “Prove your domains” below).
Map the DN of a directory group, as it appears in memberOf, to a SpotBooker group. At every sign-in, the user joins the matching groups and leaves the others. Only direct membership counts: nested Active Directory groups are not followed.
Turn it on and save. On the sign-in page, your users choose “Sign in with your organisation” and type their address (or the domain): a username and password form opens in your organisation's name. You can also give them the direct sign-in link shown in the settings.
A domain you declare filters addresses as soon as it is saved. For it to also find your organisation from the login page, vouch for addresses and admit automatically, you must prove it is yours. Without that proof, any workspace could claim your domain. The proof covers the exact domain only: institut.fr does not cover labo.institut.fr, which must be declared and proven separately.
Under the domains field, each saved domain shows its record: type TXT, value spotbooker-verification=….
Your IT team adds it on the domain itself (for example institut.fr) or, if they prefer, on _spotbooker.institut.fr. It can stay in place: SpotBooker re-checks it every day.
Click “Verify now”. Otherwise SpotBooker looks for it on its own every 15 minutes for 14 days. A domain is verified by a single workspace: if it already is elsewhere, contact support. If the record disappears for 7 days in a row, the verification is withdrawn and your administrators are notified by email.
| What you see | What to do |
|---|---|
| “Cannot reach the directory: …” | The rest of the message gives the cause. Most often: wrong server name, a firewall blocking 178.128.162.107, wrong port or encryption, a certificate that is not trusted (paste the authority certificate) or whose name does not match, a private address refused. |
| “The server answers but rejects the service account” | Check the service account's full DN and password, and that the account is neither locked nor expired. |
| “The service account is accepted but the search fails” | The search base does not exist or the account cannot read it, or the directory rejects the filter. The directory's response follows the message. |
| “Connected, but no user matches the filter under this base” | The base is too narrow or the filter excludes everyone. Widen the base, or check the group DN in the filter. |
| “Incorrect username or password”, although the test succeeds | For security, this message is the same for any failure before the password is checked: wrong password, person outside the base or filter, username matching two entries, wrong username attribute (sAMAccountName instead of userPrincipalName, for instance), account without an email address. If everything looks right, write to us with the time of the attempt. |
| “Too many attempts. Please try again in … min.” | Too many failures for this username: wait for the time shown before trying again. |
| “Sign-in with your organisation directory is not available” | Sign-in is turned off or incomplete, or the free trial ended without a subscription. Your settings are kept. |
| “Your account is not allowed…” or “An account already exists with this address…” | Same causes as for SAML: address outside your domains or already used in another SpotBooker workspace, access request declined, or an existing account that SpotBooker only links if its domain is in your accepted domains. |
| “LDAP extension missing on the server” | LDAP sign-in is not open on our side yet. Prepare the configuration: it will apply as soon as it opens. Write to us if you need it. |