Quick answer: GLPI connects to Active Directory natively. No plugin is needed. Go to Setup > Authentication > LDAP directories, add your domain controller with the Active Directory preset (login field samaccountname, sync field objectguid), test the connection, then import users from Administration > Users > LDAP directory link. This guide covers GLPI 10 and GLPI 11 (released 30 September 2025), with LDAPS, group-based profiles, automatic sync and the errors people hit most.
What you need before you start
- GLPI 10.0 or 11 with the PHP LDAP extension installed (on Debian/Ubuntu:
apt install php-ldap, then restart your web server or PHP-FPM). - The fully qualified name of a domain controller, for example
dc01.corp.example.com. - Network access from the GLPI server to the DC on port 389 (LDAP) or 636 (LDAPS).
- A dedicated AD service account. A normal domain user is enough; it only needs to read the directory. Never use a Domain Admin account.
Step 1: Create the service account and find your BaseDN
On a domain controller, open PowerShell as an administrator:
# Create a read-only service account for GLPI
New-ADUser -Name "svc-glpi" -SamAccountName "svc-glpi" -UserPrincipalName "svc-glpi@corp.example.com" -Path "OU=Service Accounts,DC=corp,DC=example,DC=com" -AccountPassword (Read-Host -AsSecureString "Password") -Enabled $true -PasswordNeverExpires $true
# Get the account's full DN (you need it for the RootDN field)
Get-ADUser svc-glpi | Select-Object DistinguishedName
# Get your domain's BaseDN
Get-ADDomain | Select-Object DistinguishedNameIf your users live in one OU, you can use that OU as the BaseDN (for example OU=Staff,DC=corp,DC=example,DC=com) so GLPI does not import service and admin accounts.
Step 2: Add Active Directory as an LDAP directory in GLPI
- Log in to GLPI as a Super-Admin.
- Open Setup > Authentication > LDAP directories (called Configuration in some languages) and click + Add.
- Click the Active Directory preconfiguration link at the top of the form. It fills in the recommended filter and fields.
- Complete the form using the values below, then click Add.
| Field | Value for Active Directory |
|---|---|
| Name | Any label, e.g. CORP AD |
| Default server / Active | Yes / Yes |
| Server | dc01.corp.example.com (or ldaps://dc01.corp.example.com for LDAPS) |
| Port | 389 (LDAP) or 636 (LDAPS) |
| Connection filter | (&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) – users only, disabled accounts excluded |
| BaseDN | DC=corp,DC=example,DC=com |
| Use bind | Yes |
| RootDN (bind DN) | Full DN of the service account, e.g. CN=svc-glpi,OU=Service Accounts,DC=corp,DC=example,DC=com (svc-glpi@corp.example.com also works with AD) |
| Password | The service account password |
| Login field | samaccountname |
| Synchronization field | objectguid – keeps the same GLPI user even if someone is renamed |
Step 3: Test the connection
Open the directory you just created and click the Test tab, then Test. A green message means GLPI can bind and search. If it fails, jump to the troubleshooting table below before importing anything.
Step 4: Map user fields
On the Users tab, check which AD attributes fill GLPI fields. The Active Directory preset already maps the common ones (surname sn, first name givenname, email mail, phone telephonenumber, title title). Add department or physicaldeliveryofficename if you use them for locations.
Step 5: Import users from Active Directory
- Go to Administration > Users.
- Click LDAP directory link, then Import new users.
- Choose your directory and click Search. Use the filter fields to narrow the list if you have many accounts.
- Tick the users you want, choose Actions > Import, and confirm.
You do not have to import everyone in advance. Any AD user in your BaseDN and filter can log in to GLPI with their Windows password, and GLPI creates their account on first login.
Step 6: Give profiles and entities by AD group
By default, imported users get GLPI's default profile (usually Self-Service). To make technicians and admins automatic:
- On the directory's Groups tab, set Search type to In users and User attribute containing its groups to
memberof. - Go to Administration > Rules > Authorizations assignment rules and add a rule such as: criterion “(LDAP) memberOf” contains
CN=GLPI-Technicians→ action assign profile Technician in your entity. - Create one AD group per GLPI role (for example
GLPI-Technicians,GLPI-Admins) so access is managed in AD, not by hand in GLPI.
Step 7: Keep GLPI in sync automatically
Changes in AD (new staff, name changes, leavers) reach GLPI through synchronization. Run it from the GLPI folder:
cd /var/www/glpi
php bin/console glpi:ldap:synchronize_users --help
php bin/console glpi:ldap:synchronize_usersThen schedule it, for example every night at 02:00 as the web server user:
# crontab -u www-data -e
0 2 * * * cd /var/www/glpi && php bin/console glpi:ldap:synchronize_users --no-interactionOld GLPI 0.8x/9.x guides use scripts/ldap_mass_sync.php. That script is obsolete; use the console command.
Use LDAPS (port 636) instead of plain LDAP
On port 389 the service account password travels in clear text, and Microsoft keeps tightening LDAP signing requirements on domain controllers, so plain binds increasingly fail. To switch to LDAPS:
- Make sure the DC has a server certificate (usually from your AD Certificate Services).
- In GLPI set Server to
ldaps://dc01.corp.example.comand Port to636. - On the GLPI server, trust your internal CA: copy the root certificate to
/usr/local/share/ca-certificates/and runupdate-ca-certificates(Debian/Ubuntu). - Test again from the Test tab.
Quick check from the GLPI server: openssl s_client -connect dc01.corp.example.com:636 should show the DC certificate without errors.
Single sign-on (SSO) with Active Directory
LDAP gives users one password, but they still type it. For true Windows SSO, let the web server authenticate users with Kerberos (for example Apache with mod_auth_gssapi), then in GLPI open Setup > Authentication > Other authentication methods and set the HTTP login field to REMOTE_USER. Keep the LDAP directory configured: GLPI still uses it to create and update user details. GLPI 11 also adds two-factor authentication for accounts that sign in with a password.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| "Can't contact LDAP server" on Test | Firewall, wrong server name, or PHP LDAP extension missing | Check port 389/636 from the GLPI server; install php-ldap and restart PHP |
| "Invalid credentials" | Wrong RootDN or password | Use the full DN from Get-ADUser, or user@domain; check the account is not locked |
| "Strong(er) authentication required" | The DC requires LDAP signing | Switch to LDAPS (636) |
| Test works but Search finds no users | BaseDN points to the wrong OU, or the filter excludes them | Widen the BaseDN; keep the Active Directory preset filter |
| Only 1,000 users imported | AD returns 1,000 results per page by default | On Advanced information, enable Use paged results |
| Duplicate users after a rename | Sync field is not objectguid | Set Synchronization field to objectguid |
| Everyone lands in Self-Service | No authorization rules | Step 6 |
FAQ
Do I need a plugin to connect GLPI to Active Directory?
No. LDAP and Active Directory support is built into GLPI under Setup > Authentication > LDAP directories.
What is the correct login field for Active Directory?
samaccountname, so users log in with their Windows username. Use userprincipalname if you want them to log in with name@domain.
Can I connect more than one domain?
Yes. Add one LDAP directory per domain. Mark one as the default server; users can pick the directory on the login page.
Are disabled AD accounts blocked in GLPI?
Yes. The preset filter excludes disabled accounts, so they cannot log in. Run synchronization regularly so GLPI also updates their status.
Does this work with GLPI 11?
Yes. The LDAP menu, fields and the glpi:ldap:synchronize_users command are the same in GLPI 10 and 11.
Sources
Related guides: Install Active Directory Domain Services · All Windows Server and Exchange guides · Linux and hosting guides
Thank you for your message.