--- title: "Rocket Chat LDAP Premium Settings Explained" slug: "ldap-premium-settings" description: "Explore premium LDAP settings in Rocket Chat. Strengthen secure access, compliance, and resilience for enterprise-grade deployments." tags: ["Enterprise"] updated: 2026-10-26T16:48:56Z published: 2026-10-26T16:48:56Z canonical: "docs.rocket.chat/ldap-premium-settings" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt > Use this file to discover all available pages before exploring further. # LDAP Premium Settings ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Premium(1).svg) > [!WARNING] > From Rocket.Chat 9.0.0, LDAP is available on Starter workspaces and on all premium plans (Commercial, Government, and Defense). It is not available on Community workspaces. See [Our Plans](/v1/docs/our-plans) for details. **LDAP Premium Settings** provide advanced controls for user synchronization, account lifecycle management, and attribute handling within your LDAP integration. ## Background Sync Configure automated synchronization between Rocket.Chat and your LDAP directory. | Setting Name | Description | | --- | --- | | **Background Sync** | Enables or disables automatic background synchronization between Rocket.Chat and the LDAP directory. | | **Background Sync Interval** | Defines how often synchronization runs using [Cron Text](https://bunkat.github.io/later/parsers.html#text) format (for example: `0 */6 * * *` for every six hours, `0 0 * * *` for once every 24 hours). | | **Background Sync Import New Users** | Imports users that exist in LDAP but not in Rocket.Chat, based on your configured LDAP filters. | | **Background Sync Update Existing Users** | Updates attributes (such as avatar, fields, or username) for users already imported from LDAP. | | **Background Sync Merge Existing Users** | Merges accounts that exist in both LDAP and Rocket.Chat. Requires the **Merge Existing Users** option in the *Data Sync* tab to be enabled. | | **Automatically Disable Users Not Found in LDAP** | Deactivates Rocket.Chat users whose LDAP entry no longer exists. Disabled users appear under **Administration → Workspace → Users** with the status **Disabled**. Room ownership is reassigned or removed when applicable. | | **Avatar Background Sync** | Enables a separate synchronization process for updating user avatars. | | **Avatar Background Sync Interval** | Defines how often avatar synchronization runs using Cron format. | > [!WARNING] > **“Automatically Disable Users Not Found in LDAP”** can delete rooms. If a disabled user was the only owner and only member of a private room, that room and every discussion inside it are deleted with no prompt. See the note under [Sync User Active State](/v1/docs/ldap-premium-settings#sync-user-active-state) section for details. ## Sync ABAC Attributes ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Defense.svg) The **Sync ABAC Attributes** settings control how Rocket.Chat synchronizes LDAP user attributes used for [Attribute-Based Access Control (ABAC).](/v1/docs/attribute-based-access-control-abac) > [!NOTE] > These settings are available on [Starter](/v1/docs/our-plans#starter-plan) workspaces and [Defense plan.](/v1/docs/our-plans#defense-plan) | Setting | Description | | --- | --- | | **ABAC Attributes Background Sync** | Enables a separate background process to synchronize user ABAC attributes from LDAP. When enabled, Rocket.Chat periodically updates mapped ABAC attributes for users. | | **ABAC Attributes Background Sync Interval** | Defines how often ABAC attribute synchronization runs. Uses **Cron Text format** (for example: `0 0 * * *`). | | **ABAC Attribute Mapping** | Defines how LDAP user attributes map to Rocket.Chat ABAC attributes. The value must be a JSON object where: • Each **key** is an LDAP attribute name. • Each **value** is the ABAC attribute name stored in Rocket.Chat. | ### ABAC attribute mapping format The mapping must be a JSON object. Example: ```json {  "department": "dept",  "region": "region" } ``` > [!NOTE] > See the [Configure ABAC](/v1/docs/configure-abac#configure-ldap-abac-attribute-mapping) user guide for more information. --- ## Sync Teams The **Sync Teams** settings allow you to map and synchronize LDAP teams with Rocket.Chat teams. | Setting | Description | | --- | --- | | **Enable team mapping from LDAP to Rocket.Chat** | Enables team mapping between LDAP and Rocket.Chat. When enabled, team assignments are synchronized based on the configured mapping and LDAP query. | | **Team mapping from LDAP to Rocket.Chat** | Defines the mapping between LDAP teams and Rocket.Chat teams. The value must be a JSON object that maps LDAP identifiers to Rocket.Chat team names. | | **Validate mapping for each login** | Determines whether users' teams are updated every time they log in. If disabled, team assignments are loaded only during the user’s first login. | | **LDAP Teams BaseDN** | Specifies the LDAP BaseDN used to look up user teams. | | **LDAP Team Name Attribute** | Specifies the LDAP attribute Rocket.Chat should use to load the team's name. Multiple attributes can be provided by separating them with commas (for example: `ou,cn`). | | **LDAP query to get user groups** | Defines the LDAP query used to identify which groups a user belongs to (for example: `(&(ou=*)(uniqueMember=#{userdn}))`). | ### Team mapping from LDAP to Rocket.Chat format The **Team mapping from LDAP to Rocket.Chat** field must contain a JSON object. Example: ```json {  "ldap-team-1": "RocketChatTeamA",  "ldap-team-2": "RocketChatTeamB" } ``` - Each **key** represents an LDAP team identifier. - Each **value** represents the corresponding Rocket.Chat team name. Only mappings defined in this object are synchronized. --- ## Auto Logout Deactivated Users Configure automatic logout for users who have been deactivated. | Setting | Description | | --- | --- | | **Enable Auto Logout** | When enabled, Rocket.Chat automatically logs out users who have been deactivated. | | **Auto Logout Interval** | Defines how often Rocket.Chat checks for deactivated users and logs them out. The interval uses the Cron Text format. | ### Auto Logout interval format The **Auto Logout Interval** field uses standard cron syntax. Example: ```markdown */5 * * * * ``` This configuration logs out deactivated users every five minutes. You can adjust the schedule based on your operational or security requirements. --- ## Sync Custom Fields Configure Rocket.Chat to synchronize custom fields from your LDAP directory. | Setting | Description | | --- | --- | | **Sync Custom Fields** | Enables synchronization of custom fields from LDAP to Rocket.Chat. When enabled, Rocket.Chat will process the configured mapping and update user custom fields accordingly. | | **Custom Fields Mapping** | Defines how LDAP attributes map to Rocket.Chat custom fields. The value must be a JSON object that specifies the relationship between LDAP attributes and Rocket.Chat custom field names. | ## Custom Fields mapping format The **Custom Fields Mapping** field must contain a JSON object. Example: ```json {  "departmentNumber": "department",  "employeeType": "roleType",  "extensionAttribute1": "region" } ``` - Each **key** represents an LDAP attribute. - Each **value** represents the corresponding Rocket.Chat custom field name. Only the attributes defined in this JSON object are considered in the mapping. --- ## Advanced Sync Configure advanced LDAP synchronization settings to manage user states and query attributes. ### Sync User Active State Controls whether Rocket.Chat activates or deactivates users based on their account status in LDAP. It applies only to users that Rocket.Chat finds in LDAP. Rocket.Chat treats a user as disabled when the LDAP account is disabled. The default is **Disable users**. | Option | Description | | --- | --- | | **Do nothing** | Rocket.Chat doesn't change the user's active state. | | **Disable Users** | Deactivates users whose LDAP account is disabled. It never reactivates users. | | **Enable Users** | Reactivates users whose LDAP account is enabled. It never deactivates users. | | **Enable and Disable Users** | Keeps the user's active state the same as in LDAP. | This setting is separate from **Automatically disable users that are no longer found on LDAP**, which deactivates users that the sync can't find, for example after they're removed from your search filter. With the default **Disable users**, those users stay deactivated even after they're added back. To reactivate them automatically, choose **Enable users** or **Enable and disable users**. > [!WARNING] > **Deactivating a user can change room ownership or delete rooms.** This applies whether the user is deactivated by this setting or by **Automatically disable users that are no longer found on LDAP**. > > - If the user was the last owner of a room with other members, the member who joined earliest becomes the new owner. > - If the user was the only owner and the only member of a private room, the room and all its discussions are deleted. There's no confirmation prompt and no setting to prevent this. > [!NOTE] > With **Enable users** or **Enable and disable users**, users you deactivated manually in Rocket.Chat are reactivated if their LDAP account is still enabled. To decide whether an LDAP account is disabled, Rocket.Chat checks the following provider-specific attributes. What happens next depends on the selected **Sync User Active State** option. - **eDirectory**: Uses `loginDisabled` to check whether the account was manually disabled by an administrator. - **Oracle Directory**: Uses `orclIsEnabled`. If the account status is not `ENABLED`, the user is treated as disabled. - **Active Directory**: Uses `userAccountControl`. The account is treated as disabled when the `ACCOUNTDISABLE` flag (value `2`) is set. > [!NOTE] > To verify user status, navigate to: **Manage → Workspace → Users** > [!WARNING] > If you customize **Attributes to Query**, include the relevant provider-specific attribute used for active-state sync, such as `loginDisabled`, `orclIsEnabled`, or `userAccountControl`. ### Attributes to Query Defines which attributes should be returned in LDAP queries. Separate multiple attributes with commas. - `*` = All regular attributes - `+` = All operational attributes Make sure to include every attribute required for Rocket.Chat sync options. --- ## Sync Channels Configure how your LDAP groups map to Rocket.Chat channels. | Setting | Description | | --- | --- | | **Auto Sync LDAP Groups to Channels** | Automatically add users to channels based on their LDAP group. If you also want to remove users from a channel, see the option **Auto Remove Users from Channels**. | | **Channel Admin** | When channels are auto-created that do not exist during a sync, this user automatically becomes the admin for the channel. | | **LDAP Group BaseDN** | The BaseDN used for group lookups. | | **Group membership validation strategy** | Determines how users' memberships to LDAP groups are validated. | | **User Group Filter** | The LDAP search filter used to check if a user is in a group. | | **LDAP Group Channel Map** | Map LDAP groups to Rocket.Chat channels using JSON format. | | **Auto Remove Users from Channels** | Remove users from channels if they are no longer in the corresponding LDAP group. | ### Group membership validation strategy #### Apply filter for each group - Applies the LDAP user group filter for each group (key) defined in the **LDAP Group Channel Map**. - Slower, since it performs a separate check per group. - Useful when using the `#{groupName}` replacement tag in the **User Group Filter**. #### Apply filter once to get all memberships - Applies the LDAP user group filter once per user. - A user is considered a member of all groups returned by the LDAP search. - Faster option. - Do not use the `#{groupName}` replacement tag with this strategy. > [!NOTE] > Switching to **Apply filter once to get all memberships** may not work with your current LDAP search filter. If you use this option, update the **User Group Filter** so it retrieves all groups in a single query. ### User Group Filter The LDAP search filter used to check if a user is part of a group. #### Supported placeholders - `#{username}` → The user’s Rocket.Chat username - `#{groupName}` → The group’s name in LDAP - `#{userdn}` → The user’s LDAP DN Example: ```scss (&(cn=#{groupName})(memberUid=#{username})) ``` ### LDAP Group Channel Map Map LDAP groups to Rocket.Chat channels using JSON format. Example: ```json {  "employee": "general",  "techsupport": [    "helpdesk",    "support"  ] } ``` - `"employee": "general"` → Adds users in the LDAP group `employee` to the `general` channel. - A group can map to a single channel or to multiple channels using an array. ### Auto Remove Users from Channels When enabled, users are removed from channels if they are no longer members of the corresponding LDAP group. --- ## Sync Roles You can sync user roles from your LDAP groups to your Rocket.Chat workspace. | Setting | Description | | --- | --- | | **Sync LDAP Groups** | Enable this setting to activate role mapping from LDAP groups. | | **Auto Remove User Roles** | Automatically remove roles from users if they are not assigned in LDAP. This only removes roles that are defined in the **User Data Group Map**. | | **LDAP Group BaseDN** | The LDAP BaseDN used to look up users. | | **Group membership validation strategy** | Determines how users' memberships to LDAP groups are validated. | | **User Group Filter** | The LDAP search filter used to check if a user is in a group. | | **User Data Group Map** | Map LDAP groups to Rocket.Chat user roles using JSON format. | ### Group membership validation strategy #### Apply filter for each group - Applies the **User Group Filter** for each group (key) defined in the **User Data Group Map**. - Slower, since it performs a separate check per group. - Useful when using the `#{groupName}` replacement tag in the **User Group Filter**. #### Apply filter once to get all memberships - Applies the **User Group Filter** once per user. - A user is considered a member of all groups returned by the LDAP search. - Faster option. - Do not use the `#{groupName}` replacement tag with this strategy. > [!NOTE] > Switching to **Apply filter once to get all memberships** may not work with the currently configured LDAP search filter. If you use this option, update the **User Group Filter** to retrieve all groups in a single query. Do not use the `#{groupName}` replacement tag with this strategy. ### User Group Filter Defines the LDAP search filter used to check if a user belongs to a group. If the search returns results, the user is considered a group member. #### Supported placeholders - `#{username}` → Replaced with the Rocket.Chat username - `#{groupName}` → Replaced with the LDAP group name - `#{userdn}` → Replaced with the LDAP Distinguished Name (DN) of the user Example: ```scss (&(cn=#{groupName})(memberUid=#{username})) ``` ### User Data Group Map Maps LDAP groups to Rocket.Chat roles in JSON format. Example: ```json {  "rocket-admin": "admin",  "tech-support": "support",  "manager": ["leader", "moderator"] } ``` In this example: - The `rocket-admin` LDAP group maps to the `admin` role. - The `tech-support` LDAP group maps to the `support` role. - The `manager` LDAP group maps to the `leader` and `moderator` roles.