Views:
 
Article #: KA-04183
Published: 05/28/2026
Last reviewed: 05/28/2026

How to Set Up LDAP On UPS (with Nesting Included)

 

Contents

  1. Introduction
  2. Purpose
  3. Procedure
  4. Troubleshooting
 

Introduction

The UPS NMC can authenticate web-interface logins against a Microsoft Active Directory (AD) domain using LDAP. Access rights are granted by mapping an AD group to a Role created on the NMC. The NMC does not traverse nested (group-within-a-group) AD memberships. It only evaluates a user's direct group membership. The equivalent of nesting is achieved by naming a single top-level group identically in AD and on the NMC, so the NMC follows that group directly.
 

Purpose

This article explains how to enable LDAP authentication against Active Directory on the UPS NMC, and how to work around the lack of native nested-group support by using an exact group-name match between AD and the NMC.
 

Procedure

Part A – Configure LDAP Server Settings

1.    Go to Settings > User Accounts > LDAP Configuration.
2.    Select the LDAP Enable checkbox.
3.    Set Type to Microsoft Active Directory.
4.    Enter the IP Address of the domain controller (e.g., 192.168.1.101).
5.    Enter the Port (typically 389 for Microsoft; 636 for LDAPS).
6.    Set Security: None (unencrypted), StartTLS (upgrade after connect), or TLS (start encrypted).
7.    In Base DN, enter the bind account (e.g., CN=myuser,CN=Users,DC=EMEA,DC=mydomain,DC=com).
8.    Enter the account password in Bind Password and Confirm Password.
9.    In Search User DN, enter the search base (e.g., DC=subdomain,DC=mydomain,DC=com).
10.    In Login Name Attribute, enter sAMAccountName (typical).
11.    In User Entry Object Class, enter person. The bind is now complete.

Part B – Map the Role (Nesting Equivalent)

1.    In Active Directory, create one top-level group for the intended NMC users (e.g., admins) and add the target users as direct members.
2.    On the NMC, go to Settings > User Accounts > Roles.
3.    Create a Role and set the Role Name to exactly match the AD group name — same spelling and case (e.g., admins).
4.    Enable the role privileges as needed.
5.    Save. LDAP authentication is ready — members of the matched AD group can now log in with their domain credentials.

Note on nesting: Because the NMC matches a user's direct membership against the Role Name, users in a child group nested under the matched group will not be recognized. Keep authorized users as direct members of the single named group to get the same result as nesting.
 

Troubleshooting

1. Login fails / no access granted: Confirm the NMC Role Name exactly matches the AD group name (spelling and case) and that the user is a direct member of that group, not a nested child group.

2. Bind fails: Verify the Base DN bind account, password, and that the account is not locked or expired in AD.

3. Users not found: Check the Search User DN scope, Login Name Attribute (sAMAccountName), and User Entry Object Class (person).

4. Secure connection fails: The NMC uses TLS 1.2 for LDAPS. Confirm the port (636 for TLS / 389 for StartTLS), the chosen Security mode, and that the AD server presents a TLS 1.2-compatible cipher suite.

5. Connection refused / timeout: Confirm the domain controller IP and port are reachable from the NMC and not blocked by a firewall.

6. Wrong privilege level: Verify the privileges enabled on the NMC Role match the intended access for that group.
 

Keywords: UPS, LDAP, Authentication, TLS