# LDAP/AD Ignition gateway **URL:** \ **Category:** Ignition Early Access\ **Created:** [July 6, 2019, 10:11pm UTC](https://forum.inductiveautomation.com/t/ldap-ad-ignition-gateway/26332 "2019-07-06T22:11:54Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![damean.thomas](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/damean.thomas/32/11367_2.png) [@damean.thomas](https://forum.inductiveautomation.com/u/damean.thomas)\ **Post date:** [July 6, 2019, 10:11pm UTC](https://forum.inductiveautomation.com/t/ldap-ad-ignition-gateway/26332/1 "2019-07-06T22:11:54Z")
My controls network is isolated on a separate network and i am using Univention (UCS) for my AD server. All of the windows and Linux computers have joined the domain without issue but i have been trying for the last 2 months to us the AD server as a user source and have yet to accomplish this. My log just states : java.lang.Exception:Failed connecting to LDAP server. Does anyone have any ideas about what i am doing wrong. i have to get this working before i enable a one way trust with the main company DC ---
**Author:** ![oscar.salcedo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/oscar.salcedo/32/11019_2.png) [@oscar.salcedo](https://forum.inductiveautomation.com/u/oscar.salcedo)\ **Post date:** [July 8, 2019, 3:22pm UTC](https://forum.inductiveautomation.com/t/ldap-ad-ignition-gateway/26332/2 "2019-07-08T15:22:32Z")
Can you post the User Sources/AD settings on your Ignition Gateway? We may be able to point out the issue that way. Cheers, Oscar. ---
**Author:** ![damean.thomas](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/damean.thomas/32/11367_2.png) [@damean.thomas](https://forum.inductiveautomation.com/u/damean.thomas)\ **Post date:** [July 24, 2019, 11:37am UTC](https://forum.inductiveautomation.com/t/ldap-ad-ignition-gateway/26332/3 "2019-07-24T11:37:11Z")
I figured it out. For anyone else that is trying to use a linux ad server (i.e. Univention, Zentyal) you have to use the prefix and suffix. prefix “uid=” suffix “,cn=xxx,dc=xxx,dc=xxx” All of this time it was the comma in front of the cn that tripped me up. Now that i am able to login using ad. No users show up when i select manage users. log says error 32 no such object. Here is what i get with a s4 search on the server. ![Capture](https://us1.discourse-cdn.com/inductiveautomation/original/2X/8/8f4f971e40eac3f4431908ceb73682a694d01970.png) ---
**Author:** ![damean.thomas](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/damean.thomas/32/11367_2.png) [@damean.thomas](https://forum.inductiveautomation.com/u/damean.thomas)\ **Post date:** [July 25, 2019, 12:14pm UTC](https://forum.inductiveautomation.com/t/ldap-ad-ignition-gateway/26332/4 "2019-07-25T12:14:39Z")
This is for anyone else trying to accomplish this. I was fully able to get this working by disabling :“ldap server require strong auth” in samba 4 thus not requiring an ssl which is not a problem on my isolated vlan. Steps: 1. Ensure user has read auth in samba or use admin account for browse 2. Disable “ldap server require strong auth” to allow simple auth on port 389 3.User listing base according to DN (CN=xxx,DC=yyy,DC=zzzz 3. Samba 4 or Samba 4 with LDAP bridge can use default user list search filter and user name attribute 5.User name prefix in samba cn= 4. User name suffix in samba ",cn=user,dc=yyy,dc=zzz With this i was able to test with Zentyal, Univention and Straight samba 4 including the turnkey DC lxc. Any questions about DN just use a ldap browser ie. Apache Directory studio to find the Distinguished Name needed.