Welcome to the NZRT Wiki Podcast. Today we’re looking at LDAP and SSO.

If you’ve ever wondered how a company manages logins across multiple systems without asking staff to juggle half a dozen different passwords, LDAP and Single Sign-On are the answer. Let’s walk through how NZRT uses these technologies to connect Nextcloud, Dolibarr, and WordPress under one unified identity system.

First, let’s cover what LDAP actually is. LDAP stands for Lightweight Directory Access Protocol. Think of it as a central address book for your organisation. It stores user accounts, passwords, and group memberships in one place. That central store is usually either Active Directory, which is Microsoft’s directory service, or OpenLDAP, which is the open-source equivalent. When Nextcloud is connected to LDAP, it doesn’t manage its own user accounts — it asks the directory instead.

So how do you get that connection set up? The first step is enabling the LDAP app inside Nextcloud. There’s a command you run on the server to activate it, and once that’s done you head into the Settings area and look for the LDAP or Active Directory section. From there you configure a handful of key details. You tell Nextcloud the address of your LDAP server — in NZRT’s case that’s an internal address on the local network. You give it what’s called a Base Distinguished Name, which is the root of your directory tree, essentially your organisation’s domain broken into components. You also provide a Bind account — a dedicated service account Nextcloud uses to authenticate with the directory — and then you point it at where your users and groups live within that directory structure.

Now let’s talk about SSO, or Single Sign-On. This is what makes the experience seamless for your users. Once LDAP is connected, a user logs in once and that credential works across all integrated systems. For more advanced setups — say you’re connecting multiple identity providers or need enterprise-grade federation — there’s also a SAML option. SAML is a standard for exchanging authentication data between systems. Enabling that app and pointing it at your SAML metadata in the Security settings gets you there, but for most NZRT scenarios the core LDAP integration handles the heavy lifting.

One thing worth understanding is how groups flow across the integration. In your LDAP directory, groups have names like admin, sales, finance, and HR. When those groups sync into Nextcloud, they map directly to matching Nextcloud groups with the same names. Your admin group in Active Directory becomes the admin group in Nextcloud. Your finance team in Active Directory becomes the finance group in Nextcloud, and so on for sales and HR. You don’t have to manually rebuild your organisational structure inside each application — it comes across automatically.

Now let’s look at why this actually matters in practice. There are four key benefits. The first is a single password. When a user changes their LDAP or Active Directory password, that change flows through everywhere. They don’t need to update it separately in Nextcloud, Dolibarr, or WordPress. The second benefit is automated provisioning. When IT creates a new Active Directory account for a new hire, Nextcloud automatically picks that up and creates the corresponding user account — no manual steps needed. Third is deprovisioning. If someone leaves the organisation and IT disables their Active Directory account, their Nextcloud access is removed at the same time. You’re not relying on someone remembering to go into three different systems and disable the account manually. And fourth is group sync, which we already covered — your organisational structure stays consistent across every platform without extra effort.

For NZRT specifically, this integration spans Nextcloud, Dolibarr, and WordPress. The practical workflow is simple. When someone joins the team, IT creates one Active Directory account. From that single action, LDAP automatically syncs the user across all three systems. When they leave, one account gets disabled and access is revoked everywhere. That’s the power of centralised identity management — less administration overhead, fewer security gaps, and a much better experience for your users.

If you want to explore related topics, this wiki page connects to the Users and Groups documentation, the Two Factor Authentication guide, and the Dolibarr Integration notes.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.