Published Date: June 26, 2026 | Last Updated: June 26, 2026
Overview
The LDAP integration connects Tello IAM to any LDAP-compatible directory service, including OpenLDAP and other standard directory servers. Because LDAP is a protocol rather than a specific product, the exact values required will vary depending on the directory software and infrastructure in use. This guide explains what each field expects — your IT Administrator or directory owner will need to supply the environment-specific values.
Before connecting
The Administrator completing this setup must have access to the LDAP server and a service account with read permissions on the directory. The LDAP server must be network-accessible from Tello IAM. If your directory requires a VPN or private network connection, that infrastructure must be in place before proceeding.
Step 1: Connection Settings
Navigate to Integrations in the left navigation, select + Add Integration, search for LDAP, and select Add. The Configure LDAP dialog opens with three tabs. Begin on the Connection Settings tab.
| Field | Description |
|---|---|
| Name | A display name for this identity source in Tello IAM. Use a descriptive name if connecting multiple directories. |
| Host | The hostname or IP address of the LDAP server (for example, ldap.example.com). |
| Port | The port used for LDAP connections. Default is 389 for standard connections and 636 for SSL/TLS. |
| Bind DN | The Distinguished Name (DN) of the service account used to authenticate to the LDAP server (for example, cn=admin,dc=example,dc=com). |
| Bind Password | The password for the Bind DN service account. |
| Use SSL | Enable to use SSL/TLS for secure LDAP (LDAPS) connections. If enabled, update the Port to 636. |
| Edit Mode | Controls how Tello IAM syncs changes with the LDAP directory. Read-Only: LDAP is the source of truth, no changes are written back. Sync: Changes sync in both directions. Import: Data is fetched and editable locally, but changes never sync back to LDAP. |
Step 2: User Synchronization
Select the User Synchronization tab to configure how user records are read from the directory.
| Field | Description |
|---|---|
| Users Base DN | The base DN where user objects are located in the directory (for example, ou=users,dc=example,dc=com). |
| User Filter | Optional LDAP filter to limit which users are synchronized. Default is (objectClass=inetOrgPerson). |
| User Object Classes | The object classes used to identify user records. Common defaults are inetOrgPerson and organizationalPerson. |
| Username LDAP Attribute | The LDAP attribute used as the username. Default is uid. |
| RDN LDAP Attribute | The attribute used for the Relative Distinguished Name. Usually the same as the username attribute. Default is uid. |
| UUID LDAP Attribute | The attribute used as the unique identifier for each user object. Default is entryUUID. |
| First Name LDAP Attribute | The attribute mapped to the user's first name. Default is givenName. |
| Last Name LDAP Attribute | The attribute mapped to the user's last name. Default is sn. |
| Email LDAP Attribute | The attribute mapped to the user's email address. Default is mail. |
Step 3: Group Synchronization
Select the Group Synchronization tab to configure how group memberships are read from the directory.
| Field | Description |
|---|---|
| Groups Base DN | The base DN where group objects are located (for example, ou=groups,dc=example,dc=com). |
| Group Filter | Optional LDAP filter to limit which groups are synchronized. Default is (objectClass=groupOfNames). |
| Group Object Classes | The object classes used to identify group records. Default is groupOfNames. |
| Group Name LDAP Attribute | The attribute used for the group name. Default is cn. |
| Membership LDAP Attribute | The attribute that defines group membership. Default is member. |
| Membership Attribute Type | Specifies whether membership is stored as a full DN or UID reference. Default is DN. |
| Membership User LDAP Attribute | The user attribute referenced in the membership record. Default is uid. |
| Preserve Group Inheritance | When enabled, nested group memberships from the LDAP hierarchy are included in the sync. Enabled by default. |
Step 4: Create the source
After completing all three tabs, select Create Source. The LDAP integration appears on the Integrations page and an initial sync begins automatically.
Verify the connection
After the initial sync completes, confirm the following on the Integrations page:
- The LDAP integration displays a status of
Active - A sync timestamp is present and reflects the completed sync
- User records on the Users page reflect the users and groups imported from the directory
Related articles
- Configuring Integrations — manage sync schedules, drift detection, and integration settings
- Understanding Errors — resolve integration errors and authorization failures
Seasoft Security Solutions LLC | Tello IAM