To sync LDAP or Microsoft Active Directory accounts with ONLYOFFICE DocSpace, enable LDAP Authentication under Settings > Integration > LDAP Settings, enter the directory connection and search parameters, then save and confirm the import. Enable Auto sync afterward so directory changes continue to reach DocSpace without repeating the initial setup.
This procedure applies to DocSpace's LDAP integration, not to a standalone ONLYOFFICE Docs document-editing server. For ONLYOFFICE Workspace, the equivalent settings are under Control Panel > Portal Settings > LDAP. According to the current ONLYOFFICE documentation checked in October 2026, LDAP is a paid Business feature in the DocSpace SaaS offering; check the capabilities of your particular self-hosted edition separately. See the official DocSpace LDAP reference and the Workspace server instructions.
Illustrative scenario: Acme Corp has an Active Directory domain named acme.local. Its IT administrator wants a DocSpace account for each employee in the Employees organizational unit (OU), while optionally importing security groups from a separate Groups OU. The names, paths, and account examples below are hypothetical configuration values, not results from a deployed environment.
Before touching DocSpace, confirm that its server can reach a domain controller, determine which accounts must be included, and arrange a directory account with read access. Use a dedicated read-only service identity rather than a domain administrator. Record the exact LDAP distinguished names (DNs), which identify directory locations, and the login and email attributes already used in AD.
Acme's example search base is OU=Employees,DC=acme,DC=local. Starting at this OU reduces the chance of importing service accounts or unrelated users. For an existing portal with users or documents, create a suitable backup and verify recovery procedures before changing LDAP filters: ONLYOFFICE warns that changes to server, user, or group search settings can affect previously imported accounts and their data. Review its backup and restore documentation.
Sign in as a DocSpace administrator. From the lower-left options menu, choose Settings, then open Integration > LDAP Settings. Turn on LDAP Authentication; if the configuration form is collapsed, use Show to expand it. Do not mistake the separate SAML single sign-on page for LDAP synchronization.
Choose Enable StartTLS for an LDAP connection upgraded to TLS, normally on TCP port 389, or Enable SSL for LDAPS, normally on TCP port 636. For the Acme scenario, suppose its domain controller is configured for LDAPS with a valid server certificate: use LDAPS://dc1.acme.local and 636. Choose one supported secure method; do not send bind passwords over unprotected LDAP.
LDAPS on an AD domain controller requires an appropriate certificate, a matching DNS name, and network access. Microsoft documents these requirements in Configure certificates for LDAP over SSL. Resolve certificate trust problems on the server rather than weakening TLS validation.
Set Server to the LDAP or LDAPS URL and Port Number to the selected port. Enable the form's Authentication option when a directory account is needed to read user and group records, and enter the authorized login and password. The sample service identity might be svc_docspace@acme.local; use your directory's actual accepted bind format. Passwords and real account names should never be placed in a published guide or screenshot.
Enter OU=Employees,DC=acme,DC=local in User DN. For Active Directory, the ONLYOFFICE-recommended starting filter is (userPrincipalName=*). This selects records with a user principal name within the selected search scope; it is not, by itself, a guarantee that every result is an enabled human employee. Review the OU contents or use a carefully validated filter if your organization requires narrower membership.
In an OpenLDAP directory, the documented defaults are different: (uid=*) for User Filter and uid for Login Attribute. Do not copy those defaults unchanged into an Active Directory deployment.
For AD, set Login Attribute to sAMAccountName, as the ONLYOFFICE instructions specify. The configured login attribute determines what users type at the DocSpace sign-in page; supported formats include the simple login, login plus LDAP domain, and domain backslash login. Test the format with a nonadministrator employee account after import.
In Attribute Mapping, map First Name to givenName, Second Name to sn, and Mail to mail when those fields exist in your AD schema. These are example mappings to check against your actual directory, not assumed values for every environment. Email matters: ONLYOFFICE says the Mail mapping is used for the DocSpace email address; missing mail data may produce an address derived from the login and LDAP domain and can prevent notifications from reaching the user.
If Acme also wants directory groups, enable Group membership. In this example, use OU=Groups,DC=acme,DC=local for Group DN and (objectClass=group) for Group Filter. The AD mapping documented by ONLYOFFICE uses distinguishedName as User Attribute and member as Group Attribute; use the existing Group Name Attribute appropriate for the directory.
Check membership before saving: ONLYOFFICE explicitly notes that enabling group import restricts the imported users to those who belong to at least one matching group. If Acme's pilot employees do not belong to the selected groups, leave group import off initially or correct the directory scope before import. Do not expand the group filter across the entire domain merely to make the user count larger.
Review the search bases, account mappings, and intended directory membership, then click Save. In the Confirmation of import dialog, select OK to begin. Allow time for the directory search and import; the duration depends on the environment. For a large AD deployment, the ONLYOFFICE documentation calls out a 1,000-entry AD query limit. Coordinate any paging or directory-limit changes with the AD administrator rather than changing domain-controller settings without review.
Check the imported accounts in Accounts; LDAP-linked profiles have an LDAP indicator in the administrator view. Keep the first run deliberately narrow so a wrong filter, mail mapping, or group rule can be corrected before adding the full organization. Avoid claiming that a successful save proves users can authenticate.
Back on LDAP Settings, enable Auto sync and choose an interval supported by your DocSpace version: hourly, daily, weekly, or monthly. Save the schedule. For an immediate update, select Sync users at the bottom of the LDAP page. ONLYOFFICE also documents per-user updates after an LDAP user logs in; that login behavior is not a substitute for regular directory-wide synchronization when groups and account records need refreshing.
Use a pilot employee account to sign in with its AD credentials, then confirm that the DocSpace profile shows the expected name and email address. If groups were enabled, verify the employee belongs to an imported group and can access only the rooms granted through DocSpace permissions. Finally, change a noncritical directory field on the pilot account, run Sync users, and check that its DocSpace profile reflects the change.
The setup is confirmed only when the selected users are imported, a pilot user can authenticate with directory credentials, the intended group restrictions apply, and at least one later profile change synchronizes correctly.
Connect ONLYOFFICE DocSpace to Active Directory or OpenLDAP, import users and groups safely, map account fields, and schedule reliable synchronization.
Move portal data from Disk Default to a supported cloud storage provider, or relocate Docker data safely by changing its host volume mapping.
Identify whether Document Server uses a Linux package or Docker, remove only its components, and check remaining data without deleting shared services by mistake.
Trace slow collaborative editing to Docker resource pressure, proxy connections, or document load, then choose the fix that matches your measurements.
Install custom fonts in ONLYOFFICE Document Server, compare persistent Docker mounts with direct copies, rebuild the font list, and verify the result.
Choose where TLS should terminate, mount a trusted certificate and private key safely, and verify HTTPS access to a Dockerized ONLYOFFICE Docs server.
Embed the ONLYOFFICE editor in your PHP app, sign its configuration with JWT, and save edited files through a secure callback.
Set the proofing language for the whole document or selected text, confirm spell checking is active, and identify when a server dictionary is missing.
Enable persistent Track Changes for everyone in one ONLYOFFICE document, verify edits are recorded, and understand the limits of this setting.
Find whether Nginx, Docker networking, or an internal ONLYOFFICE service is returning 502, then verify the corrected upstream and health check.
