LDAP-Manager — administrator’s guide

Users open a browser, are shown a sign-in page, and authenticate with the account they already have in your directory. From that moment the session is tied to a named person: you can see it, report on it, limit how many devices it covers, and end it. For your team, the same console is where accounts are created, imported in bulk, grouped, expired and delegated.

The dashboard shows how many users are online right now, recent authentication activity, and the health of the system itself. The online counter in the header updates as you work, so you can see the effect of a change without reloading.

The left-hand navigation is grouped into five sections. Menu items you do not have permission for are not shown at all, so your menu may be shorter than a colleague’s — that is the role working, not a fault.

The dashboard — active sessions, today’s logins, directory totals, and login activity over 24 hours and 7 days.

LDAP Management → Users lists the accounts you are allowed to see. Search by username or name, then use the action buttons on a row, or open the account to edit it in full.

Other actions on a user: reset the password, disable the account immediately, set or clear an expiry date, change group membership, and — if your role allows it — delete the account. Each of these is a separate permission, so your role may allow some and not others.

Rather than configuring each account, you put accounts into groups and let the group carry the policy. Changing a user’s group changes what they get — there is no second place to update.

Group management — every directory group with its live member count, and its full directory path.

A guest account is an ordinary account with a mandatory Valid Until date. When that date passes the account stops working — nobody has to remember to turn it off.

Every account has a device allowance. It comes from the account’s group by default, and a per-user value overrides it where someone genuinely needs more.

When a user reaches the limit and tries to sign in on a new device, they are not simply refused. They are shown their own active sessions and may end one of them, then sign in — without having to call you and without re-entering their password.

There are three separate bulk tools, and it is worth knowing which one you want before you start.

Bulk Upload — preparing the file

The importer is deliberately forgiving, so in most cases the sheet you already have will work as it is.

Only the username column is required. These are the column headings the importer recognises — any one of them will do:

Bulk Upload — settings that apply to every row

Three things are set on the upload page rather than in the file, and they are applied to every account in it: the group or groups the new accounts join, a Valid Until date, and a device allowance. This is the quickest way to bring in a batch of guests or contract staff who should all expire on the same day.

Bulk Update — correcting what already exists

Bulk Update works on accounts that are already there, and it follows the opposite rule to the single-user edit form: a blank or missing value means “leave this field alone”, never “clear it”. A correction file only needs the username column plus the columns you are actually fixing.

Bulk actions on a selection

For changes that do not need a file, tick users in the Users list and apply one action to all of them:

Enable, disable and delete on a selection are also available, each behind its own permission.

Administrators are not directory users — they are separate console accounts. Each one is assigned a role, and the role is assembled from individual permissions. Grant only what the job needs.

A worked example: a guest-house role that can view the dashboard and users, create and edit users, reset passwords, set expiry dates, change a user’s group and bulk-upload — scoped to the guest group only, with delete, group management, the session monitor, reports and system settings all withheld.

How the address allow-list actually behaves. While the list is empty the console is open to every address. Adding the first entry turns restriction on: from then on only the addresses on the list, plus the server itself, can reach it. An entry may optionally also pin a hardware address, in which case both must match — that check only works for clients on the same subnet as the server.

Admin portal access control — the allow-list, what is always permitted, and the address you are currently on.

The Reports Dashboard opens on a row of counters — total directory users, active sessions right now, disabled accounts, expired accounts, users in no group, accounts expiring in the next 7 and 30 days, and new accounts this week and month. Below those sit login volume over 30 days, peak hours, the day-of-week pattern, the operating-system mix, and a per-group breakdown with headcount, logins, disabled and expired counts. That table has an Export CSV button.

The reports dashboard — account counters, login volume, peak hours, day-of-week pattern and a per-group breakdown.

Settings

System-wide configuration, gated behind its own permission so it can be kept away from delegated administrators. It covers the directory connection, portal behaviour, outgoing mail (with a test button so you can prove SMTP works before relying on it), the welcome and password-reset e-mail template, log forwarding targets, your own password, and the administrative address allow-list.

High Availability

The system runs as a redundant pair. This page shows the current state and gives you deliberate control over it rather than leaving failover as something that only ever happens to you.

Backup & Restore

A backup is a single ZIP file, named with the date and time it was taken. It contains the directory users and groups, the session database, and the system’s own configuration.

Sessions

Under the Network menu: every active session with the account, the address and when it started, and the ability to end one. The session list can be exported.

Inactive Report

Accounts that exist but have not been used. It looks back a configurable number of months — two by default — and lists everyone with no activity in that window, with CSV export for working through the list.

Users also have a status page showing their current session, a page to change their own password, and a short help page. If their session has ended at the network but their browser still shows them as connected, there is a re-login link that clears the stale session and returns them to sign-in — worth knowing, because it resolves a call in one step.