Secure LDAP Guidelines

Enterprise Printing Platform Print Server Admin
1

In EPP 10.2.1.0, Development introduced changes to allow easier secure LDAP integrations for EPP user administration. This document outlines the basics for LDAPS integrations with an active directory server.

Product Release/Version

These guidelines will work with EPP 10.2.1.0 and later builds.

Setting Up Secure LDAP (LDAPS) in Enterprise Printing Platform

This guide explains how to configure EPP to connect to your LDAP directory server using a secure encrypted connection (LDAPS). The example below uses Microsoft Active Directory, but the same steps apply to other supported LDAP server types.

Before You Start

  • Your LDAP server hostname or IP address and port (typically 636 for LDAPS)
  • A service account (username + password) with read access to the directory
  • The Base DN — the starting point in the directory tree for user searches
  • The EPP Group DN — the AD/LDAP group whose members will be imported into EPP
  • The LDAP server SSL certificate (.cer file) — provided by your AD/LDAP administrator

Step 1 — Upload the LDAP Server Certificate

Your AD/LDAP administrator needs to export the server SSL certificate as a .cer file and provide it to you. Once you have it, upload it into EPP so that EPP can establish the secure connection.

  1. Go to Admin → System Configuration → Security → Certificate Management
  2. Click Upload Certificate
  3. Select the .cer file
  4. Enter a short alias (e.g. ldap-cert) — lowercase, no spaces
  5. Click Upload

Note: If your AD server uses an internal Certificate Authority (CA), you may need to upload the Root CA certificate rather than the server certificate itself. Check with your AD administrator.

Step 2 — Configure LDAP Settings

Navigate to Admin → System Configuration → Security. Set Security Mode to LDAP, then click the LDAP Settings tab and fill in the fields below.

Field Example Value Description
Server Type Microsoft Select the type matching your LDAP server
Host IP/Name ldap.yourcompany.com Hostname or IP address of your LDAP/AD server
Port 636 Use 636 for LDAPS (secure). Plain LDAP uses 389.
User ID DOMAIN\svcaccount The account EPP uses to connect and authenticate to the directory
Password (service account password) Password for the service account above
Base DN OU=Users,DC=yourcompany,DC=com Root path in the directory where EPP searches for users
EPP Group DN CN=EPP Users,OU=Groups,DC=yourcompany,DC=com Members of this group will be imported into EPP
Secure Connection Checked Check this to turn on the secure encrypted connection

The screenshot below shows an example of a completed LDAP Settings configuration:

image
image1432×836 117 KB

Figure 1 — LDAP Settings with Secure Connection enabled (Microsoft AD example)

Step 3 — Verify Settings

Once all fields are filled in, click the Verify Settings button. EPP will attempt to connect to your LDAP server and validate your credentials and directory paths.

Result What it Means / What to Do
Success All checks passed. Click Save to apply the configuration.
Authentication Failure The service account credentials are incorrect or the account is locked. Double-check the User ID and Password.
Server Connection Failure EPP cannot reach the LDAP server. Check the hostname, port, and that port 636 is open in your firewall.

Step 4 — Save and Apply

  1. Once verification passes, click Save
  2. Restart the EPP service to apply the new security settings
  3. Log in with an Active Directory user account to confirm authentication is working

For Oracle or other non-Microsoft LDAP servers using StartTLS (port 389), select the appropriate Server Type — EPP will automatically use the correct TLS protocol.