> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-active-directory-or-openldap.md).
# Authenticate users using Active Directory or OpenLDAP
You can configure Active Directory or OpenLDAP settings in the Cortex XSOAR tenant to enable login using directory usernames and passwords. Permissions are determined by mapping the AD or OpenLDAP groups to Cortex XSOAR user groups.
{% hint style="info" %}
### Note
For Active Directory deployments, only plain Active Directory is currently supported. Kerberos and NTLM binding are not supported.
{% endhint %}
**Before you begin**
* Ensure you have your server IP or host name, port, user DN, and base DN.
* Verify your directory uses the supported group types: **`posixGroup`** and **`groupOfUniqueNames`**.
* Custom LDAP group objects and configurations must be managed by your organization's IT department.
Task 1. Configure the AD/OpenLDAP connection
1. In Cortex XSOAR, navigate to **Settings & Info** → **Settings** → **Authentication Settings** and select the **LDAP Options** tab.
2. Click **Add Connection** and choose **Active Directory** or **OpenLDAP**.
3. Enter **General** parameters.
* **Server IP or Host Name**: Default is 10.10.10.10
* **Port**: Default is 389 for LDAP.
* **User DN**: A credential to log in to the LDAP server. Default is cn=John Smith,ou=users,dc=example,dc=com
* **Base DN**: The top of the directory tree that is searched. All items below the top of the directory tree are searched. Default is dc=example,dc=com
* **Password**: Your LDAP server login password.
4. (Optional) Configure **Advanced settings**.
Enter the names as they appear in your LDAP settings. The commonly used names are provided as defaults but can be edited
1. **Groups Object Class**: The name used for groups in your LDAP. Default is possixGroup.
2. **User Object Class**: The name used for users in your LDAP. Default is possixAccount.
3. **Group Membership Identifier Attribute**: The attribute of a group membership that is the unique identifier. Default is memberUid.
4. **User Unique Identifier Attribute**: The attribute of a user that is the unique identifier. Default is uid.
5. **Trust any certificate**: Disable this to support connections using self-signed certificates. Default is unselected.
6. **Connection Type**: Possible values are Start TLS, LDAPS, and None (default - plain text communication).
7. (For SSL only) **SSL Version**: Default is TLS v1.2.
5. Click **Test Connection** to validate your settings.
6. Click **Save**.
You can add multiple AD or OpenLDAP configurations. You can also disable or delete a connection.
Task 2. Map AD/LDAP groups to user groups
For authenticated users to have roles assigned, their directory group must be mapped to a Cortex XSOAR User Group.
1. In Cortex XSOAR, navigate to **Settings & Info** → **Settings** → **Access Management** → **User Groups**.
2. Create or edit a user group.
3. Map the user group to a role.
1. Select a role, for example Instance Administrator.
2. Select users.
3. Set the **AD Group Mapping** or **OpenLDAP Group Mapping** to the full static group DN, exactly as it appears in your directory.
You can map both AD and OpenLDAP groups within the same user group if needed.
4. Click **Save**.
Users will automatically appear in the **Users** table with the type **LDAP** after their first successful login.
Task 3. Log in to Cortex XSOAR with LDAP
1. On the Cortex XSOAR login page, click **Sign In with LDAP**.
2. Select the relevant LDAP configuration from the dropdown list.
3. Enter your login credentials as configured in Task 1(default is your LDAP server UID and password).
4. Click **Sign In**.
**Troubleshooting**
**Login errors**
If a user logs in and their password does not match, they will see a password mismatch error. However, if the failure is due to a mapping error, a DN error, or a binding error, they will receive a generic contact administrator message.
**Missing permissions**
If a user authenticates successfully but does not exist in any of the AD/LDAP groups that were mapped to a role, they will receive an access denied message and will be blocked from logging in.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-active-directory-or-openldap.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.