Skip to content
Docs

Use LLDAP with Mideye Server: Setup and Limits

LLDAP is a lightweight LDAP server. Mideye Server can use it as a user directory for lookup, password validation and group membership, but LLDAP only implements part of LDAP. It is not on the list of supported directories.

LDAP profile settings

Section titled “LDAP profile settings”

Create an LDAP profile with these values:

FieldValue
Server ProductOpenLDAP
Port3890 (LDAP) or 6360 (LDAPS), LLDAP’s defaults
Search baseou=people,dc=example,dc=com (use your base DN)
Bind DNA service user, for example uid=mideye,ou=people,dc=example,dc=com
Object Classperson
User ID Attributesuid
Mobile Phone Attributesmobile
Group ClassgroupOfUniqueNames
Group Membermember
TOTP Secret Cipher AttributeLeave empty (see below)

LLDAP has no phone number attribute by default. Add a custom user attribute named mobile in the LLDAP web UI and fill it in for each user.

Make the bind user a member of the lldap_strict_readonly group so it can read all users without using the LLDAP admin account.

Known limitation: TOTP secrets cannot be stored in LLDAP

Section titled “Known limitation: TOTP secrets cannot be stored in LLDAP”

If TOTP Secret Cipher Attribute points at a custom LLDAP attribute, Verify fails with:

Failed to write the attribute: [LDAP: error code 53 - Unsupported operation: `Replace` for `<attribute>`]

LLDAP’s LDAP modify operation only accepts changes to userPassword. Custom attributes can only be written through LLDAP’s GraphQL API or web UI. Error 53 (unwillingToPerform) means the directory refuses the operation, so changing permissions on the bind user does not help.

Workaround: leave TOTP Secret Cipher Attribute empty. Mideye Server then stores the TOTP secrets in its own database. See On-premise TOTP tokens.

If you need TOTP secrets stored in the directory, use a directory with full LDAP modify support, such as Active Directory, OpenLDAP or 389 Directory Server.

Section titled “Related links”