LDAP Premium Settings

Available on Rocket.Chat premium plans, LDAP Premium Settings provide advanced controls for user synchronization, account lifecycle management, and attribute handling within your LDAP integration.

Background Sync

Configure automated synchronization between Rocket.Chat and your LDAP directory.

Sync ABAC Attributes

The Sync ABAC Attributes settings control how Rocket.Chat synchronizes LDAP user attributes used for Attribute-Based Access Control (ABAC).

These settings are available on Premium plans.

ABAC attribute mapping format

The mapping must be a JSON object.

Example:

{
  "department": "dept",
  "region": "region"
}

See the Configure ABAC user guide for more information.

Sync Teams

The Sync Teams settings allow you to map and synchronize LDAP teams with Rocket.Chat teams.

Team mapping from LDAP to Rocket.Chat format

The Team mapping from LDAP to Rocket.Chat field must contain a JSON object.

Example:

{
  "ldap-team-1": "RocketChatTeamA",
  "ldap-team-2": "RocketChatTeamB"
}

• Each key represents an LDAP team identifier.

• Each value represents the corresponding Rocket.Chat team name.

Only mappings defined in this object are synchronized.

Auto Logout Deactivated Users

Configure automatic logout for users who have been deactivated.

Auto Logout interval format

The Auto Logout Interval field uses standard cron syntax.

Example:

*/5 * * * *

This configuration logs out deactivated users every five minutes.

You can adjust the schedule based on your operational or security requirements.

Sync Custom Fields

Configure Rocket.Chat to synchronize custom fields from your LDAP directory.

Custom Fields mapping format

The Custom Fields Mapping field must contain a JSON object.

Example:

{
  "departmentNumber": "department",
  "employeeType": "roleType",
  "extensionAttribute1": "region"
}

• Each key represents an LDAP attribute.

• Each value represents the corresponding Rocket.Chat custom field name.

Only the attributes defined in this JSON object are considered in the mapping.

Advanced Sync

Configure advanced LDAP synchronization settings to manage user states and query attributes.

Sync User Active State

Controls whether users should be enabled or disabled in Rocket.Chat based on their LDAP status.

The pwdAccountLockedTime attribute is used to determine whether a user is disabled.

• This attribute is supported on OpenLDAP.

• On Windows Server AD, the userAccountControl attribute is used instead.

To verify user status, navigate to: Manage > Workspace > Users

Attributes to Query

Defines which attributes should be returned in LDAP queries. Separate multiple attributes with commas.

• * = All regular attributes

• + = All operational attributes

Make sure to include every attribute required for Rocket.Chat sync options.

Sync Channels

Configure how your LDAP groups map to Rocket.Chat channels.

Group membership validation strategy

Apply filter for each group

• Applies the LDAP user group filter for each group (key) defined in the LDAP Group Channel Map.

• Slower, since it performs a separate check per group.

• Useful when using the #{groupName} replacement tag in the User Group Filter.

Apply filter once to get all memberships

• Applies the LDAP user group filter once per user.

• A user is considered a member of all groups returned by the LDAP search.

• Faster option.

• Do not use the #{groupName} replacement tag with this strategy.

Switching to Apply filter once to get all memberships may not work with your current LDAP search filter. If you use this option, update the User Group Filter so it retrieves all groups in a single query.

User Group Filter

The LDAP search filter used to check if a user is part of a group.

Supported placeholders

• #{username} → The user’s Rocket.Chat username

• #{groupName} → The group’s name in LDAP

• #{userdn} → The user’s LDAP DN

Example:

(&(cn=#{groupName})(memberUid=#{username}))

LDAP Group Channel Map

Map LDAP groups to Rocket.Chat channels using JSON format.

Example:

{
  "employee": "general",
  "techsupport": [
    "helpdesk",
    "support"
  ]
}

• "employee": "general" → Adds users in the LDAP group employee to the general channel.

• A group can map to a single channel or to multiple channels using an array.

Auto Remove Users from Channels

When enabled, users are removed from channels if they are no longer members of the corresponding LDAP group.

Sync Roles

You can sync user roles from your LDAP groups to your Rocket.Chat workspace.

Group membership validation strategy

Apply filter for each group

• Applies the User Group Filter for each group (key) defined in the User Data Group Map.

• Slower, since it performs a separate check per group.

• Useful when using the #{groupName} replacement tag in the User Group Filter.

Apply filter once to get all memberships

• Applies the User Group Filter once per user.

• A user is considered a member of all groups returned by the LDAP search.

• Faster option.

• Do not use the #{groupName} replacement tag with this strategy.

Switching to Apply filter once to get all memberships may not work with the currently configured LDAP search filter. If you use this option, update the User Group Filter to retrieve all groups in a single query. Do not use the #{groupName} replacement tag with this strategy.

User Group Filter

Defines the LDAP search filter used to check if a user belongs to a group.

If the search returns results, the user is considered a group member.

Supported placeholders

• #{username} → Replaced with the Rocket.Chat username

• #{groupName} → Replaced with the LDAP group name

• #{userdn} → Replaced with the LDAP Distinguished Name (DN) of the user

Example:

(&(cn=#{groupName})(memberUid=#{username}))

User Data Group Map

Maps LDAP groups to Rocket.Chat roles in JSON format.

Example:

{
  "rocket-admin": "admin",
  "tech-support": "support",
  "manager": ["leader", "moderator"]
}

In this example:

• The rocket-admin LDAP group maps to the admin role.

• The tech-support LDAP group maps to the support role.

• The manager LDAP group maps to the leader and moderator roles.