--- title: "Rocket Chat Identity Management FAQ" slug: "identity-management-faq" description: "Review identity management FAQs for Rocket Chat. Ensure secure access, compliance, and authentication." updated: 2026-10-26T17:05:46Z published: 2026-10-26T17:05:46Z canonical: "docs.rocket.chat/identity-management-faq" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt > Use this file to discover all available pages before exploring further. # Authentication and Identity Management FAQ ****What is LDAP and how is it used in Rocket.Chat?**** LDAP (Lightweight Directory Access Protocol) is a protocol used to access and manage directory services. In Rocket.Chat, LDAP is commonly used to: - Authenticate users against an external directory - Sync user information (such as usernames and attributes) For detailed information, see [LDAP](https://docs.rocket.chat/docs/ldap). ****What is Active Directory and how does it relate to LDAP?**** Active Directory is a directory service (commonly provided by Microsoft) used to manage users, devices, and access within an organization. It typically uses LDAP as its underlying protocol for authentication and directory access. ****What is OAuth login?**** [**OAuth**](https://docs.rocket.chat/docs/oauth) is an authentication standard that allows users to sign in using external providers (such as Google, Apple, or GitHub) without sharing their passwords. In Rocket.Chat, OAuth enables social or third-party login options. ****What is SAML and when should I use it?**** [**SAML**](https://docs.rocket.chat/docs/saml) (Security Assertion Markup Language) is a standard used for single sign-on (SSO). It allows users to log in once through an identity provider (such as Okta or Azure AD) and access Rocket.Chat without entering credentials again. SAML is commonly used in enterprise environments. > [!WARNING] > For more details about authentication options across Rocket.Chat plans, see [User Authentication and Identity Management](https://docs.rocket.chat/docs/authentication). ****Will LDAP and SAML keep working on Community workspaces?**** No. From Rocket.Chat 9.0.0, LDAP and SAML are available on Starter workspaces and on all premium plans (Commercial, Government, and Defense). They are not available on Community workspaces. See [Our Plans](/v1/docs/our-plans) for details. ****Why is identity management important in Rocket.Chat?**** Identity management helps you control user access automatically as your organization grows. With identity management: - New users can be created automatically when they join your organization - Access is removed promptly when users leave - User data stays synchronized with your identity provider This reduces manual work, prevents access issues, and improves security. ****How does single sign-on (SSO) work in Rocket.Chat?**** Single sign-on (SSO) allows users to log in once through a central identity provider and access Rocket.Chat without managing separate credentials. In Rocket.Chat, SSO enables authentication through providers such as LDAP, SAML, or OAuth. > [!WARNING] > SSO is different from social login (such as Google or GitHub). With social login, users authenticate directly with those services rather than through a centralized identity provider. ****Why is my LDAP, SAML, or custom OAuth integration not working?**** First, check your plan. From Rocket.Chat 9.0.0, LDAP, SAML, and Custom OAuth are available on Starter workspaces and on all premium plans (Commercial, Government, and Defense). They are not available on Community workspaces. See [Our Plans](/v1/docs/our-plans) for details. Rocket.Chat is updating its identity management features, including LDAP and related integrations. As part of these changes, previously implemented or custom integrations may no longer be compatible. If you're using a custom or older integration: - It may need to be updated to match the latest implementation - Some previously supported approaches may no longer work If you experience issues, [contact support](https://www.rocket.chat/contact) or refer to the latest [integration documentation](/v1/docs/integrations) for updated guidance. ****Can I use identity management features in an air-gapped environment?**** Yes. If your Rocket.Chat workspace is deployed in an [air-gapped](https://docs.rocket.chat/v1/docs/rocketchat-air-gapped-deployment) (offline) environment and connected to an internal LDAP server, you can still use identity management features. Advanced features such as LDAP, SAML, and Custom OAuth are available on Starter workspaces and on all premium plans (Commercial, Government, and Defense), even in offline environments. See [Our Plans](/v1/docs/our-plans) for details. ****Does LDAP integration affect security or data privacy in an air-gapped environment?**** No. Updates to LDAP integration do not introduce changes that affect security or data privacy. In air-gapped environments: - All authentication and data exchange remain within your internal network - No external communication is required for LDAP-based authentication Your existing security boundaries and data privacy controls remain unchanged. ****What does the “Bind successful but user was not found via search” error mean?**** This error means the user's credentials were accepted (LDAP bind succeeded), but Rocket.Chat could not find the user in the directory during the search step. This usually happens when: - The **Find user after login** setting is enabled - The LDAP search query does not return the expected user To fix it: 1. Go to **Manage → Workspace → Settings → LDAP → User Search**. 2. Either: - Disable **Find user after login**, or - Review and correct your LDAP search filter to ensure the user can be found > [!WARNING] > For more details, see [Microsoft LDAP Search Filter Syntax](https://learn.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax?redirectedfrom=MSDN). ****How can I prevent disabled LDAP users from logging into Rocket.Chat?**** Enable the **Sync User Active State** setting to automatically block users marked as disabled in your LDAP directory. **Steps:** 1. Go to **Manage → Workspace → Settings → LDAP**. 2. In **Advanced Sync**, set [**Sync User Active State**](https://docs.rocket.chat/docs/ldap-premium-settings#advanced-sync) to **Disable Users**. When enabled, Rocket.Chat will automatically deactivate users whose LDAP status is marked as disabled. When a user is deactivated this way, their active sessions are revoked immediately: their login tokens are cleared and their OAuth access tokens, refresh tokens, and authorization codes are revoked, so they can no longer access Rocket.Chat or call the API with previously issued credentials. > [!WARNING] > This feature requires a [premium plan](/v1/docs/our-plans) and depends on your LDAP server correctly exposing a user “active” or “disabled” attribute. ****Why does LDAP login fail even when my configuration is correct?**** One possible cause is a **username conflict between LDAP and local users**. If a local user already exists with the same username as an LDAP user, authentication may fail without a clear error. **Example:** If a local user named `joe` already exists, and an LDAP user also tries to log in as `joe`, the login may silently fail—even if the LDAP credentials are correct. **To fix it:** - Ensure LDAP usernames do not match existing local usernames - Rename or remove conflicting local users, or adjust your LDAP username mapping > [!WARNING] > Tip: Use unique usernames for LDAP users to avoid conflicts with local accounts. ****Why are LDAP users not created during sync?**** LDAP users will not be created if they do not have an email address. Rocket.Chat requires every user account to include an email address. If this field is missing in your LDAP directory, user creation will fail during synchronization. **To fix it:** - Ensure your LDAP directory provides an email address for all users, or - Configure a fallback domain using the **Default Domain** setting in [LDAP data sync settings](https://docs.rocket.chat/v1/docs/ldap-data-sync-settings).