How to Set Up LDAP and SSO Authentication Integration

Lightweight Directory Access Protocol (LDAP) and external Single Sign-On (SSO) are secure authentication solutions that allow users to log in to Mavis easily and securely. Once configured by an administrator, personnel in your organization can log in without additional credentials.

Important Notes Before Starting

• Mavis only allows one external login authentication method at a time.

• Once an external authentication is enabled, users created in Mavis will be blocked from logging in via Mavis (Mavis administrators can still log in via Mavis).

• When enabling SSO (Microsoft), if a Mavis account matches the email from the SSO provider, the user will link to the same Mavis account. If no match exists, a new user will be created using the SSO email as the account name.

Configuration Overview

1. Configure LDAP integration in Mavis

2. Set up Microsoft authentication integration

3. Set up Google SSO login integration

1. Configure LDAP Integration in Mavis

Version Differences: V1.16.2 & V1.15.3

----------------------------------------------------------------------------------------------------

• For Version V1.16.2 and Later

• Only users with administrator role can manage users via the management interface.

• Go to Management Interface

• Select System Administration

• Select Login Authentication

• Click Edit

•  

Check the LDAP option

Field Descriptions:

Configuration Steps:
6. LDAP Provider: Select Windows AD
7. Enter LDAP URL
8. Port: Default 389
9. Enter Bind Account / DN
10. Enter Bind Password
11. Base DN: e.g., DC=mavisdemo,DC=com
12. Enable Auto-Sync (synchronize every 2 minutes)
13. Group Preview: Click Refresh Preview to view groups under Base DN
14. Select groups to import users and assign roles:

• Administrator: Imported users are administrators

• User: Imported users are general users

• Skip: Do not import

Note: Custom Filter can be used to further refine user selection. Not configured in this example.

15. Preview Sync Result: Test to preview the synchronization result

16. User Preview: Displays users matching the configuration

17. Click Save

Manual Sync: When executed, LDAP user data is immediately synchronized to Mavis

-----------------------------------------------------------------------------------

• LDAP Integration (Versions Prior to V1.15.3)

• Users must have an administrator role to manage users via the Management Interface.

• Steps:

• Select Management Interface

• Select System Administration

• Select Login Authentication

• Click Edit

•  

Check the source LDAP

Field Descriptions:

System Sync: LDAP user accounts under the specified server path are synchronized to Mavis every 24 hours.

Note: LDAP integration may take 2–3 minutes after configuration. Users can choose LDAP authentication at the login page (login buttons will reflect available options).

Troubleshooting

Microsoft Authentication Integration

1. Log in: https://portal.azure.com/#home

2. Select Azure Active Directory

3. Select App Registrations

Click New Registration

Enter a custom name

Supported account types: Single-tenant (only this organizational directory)

Click Register

Application (Client) ID

Directory (Tenant) ID

Go to Authentication

Click Add a Platform

Select Web

Redirect URI: https://<Mavis URL>/sso/microsoft (example: https://shun.mavisdemo.com/sso/microsoft)

Click Configure

14. Click Certificates & Secrets
15. Select Client Secret
16. Click New Client Secret
17. Check Expiration: set a custom expiration date
18. Click Add

Secret Value: Obtain the secret key information. Note: this field will be hidden if the page is reloaded.

Required for Mavis configuration:

• Tenant ID

• Client ID

• Secret Value

Mavis Configuration:

1. Go to Management Interface → System Administration → Login Authentication → Edit

2. Source: Select Microsoft

3. Enter Tenant ID, Client ID, Secret Value

4. Click Save

Integration may take 2–3 minutes. Users can then log in using Microsoft account.

Source: Select Microsoft

Enter Tenant ID

Enter Client ID

Enter Secret Value

Click Save

Please note that after configuration, it may take 2–3 minutes for the system to integrate with Microsoft (Azure AD).

Once the Microsoft (Azure AD) integration is complete, users can choose to authenticate using Microsoft when logging in. (Users will also see different login buttons on the login page.)

3. How to Integrate Login Authentication via Google SSO

Set up Workspace on Google

1. Create a Project (skip if you already have one)

Go to the following URL to create a new project and enter your project name:
https://console.cloud.google.com/projectcreate

1. Enter the project name
2. Select your organization
3. Click CREATE to create the new project

2. Set up OAuth consent

Go to the following URL to configure OAuth consent:
https://console.cloud.google.com/apis/credentials/consent

1. Enter the target audience
2. Set User Type to Internal

Note: In Internal mode, only users within your organization’s Google Workspace can access the app.
In External mode, users both inside your organization and general Gmail users can access the app.

3. Click Credentials
4. Click Create Credentials

5. Select Web Application
6. Enter a custom name
7. Authorized JavaScript origins: enter your Mavis URL (e.g., https://shun.mavisdemo.com)
8. Authorized redirect URIs: enter https://{Mavis URL}/sso/google (e.g., https://shun.mavisdemo.com/sso/google)
9. Click Create

10. Copy and save the Client ID
11. Copy and save the Client Secret
12. Click Done

Once these steps are complete, you should have the following information:

• Client ID

• Client Secret

3. Configure Login Authentication on Mavis

Only users with administrator roles can manage users via the admin interface.

1. Go to Admin Interface
2. Select System Management
3. Select Login Authentication
4. Click Edit

5. Source: Select Google
6. Enter Client ID
7. Enter Client Secret
8. Click Save