- 8 minutes to read

Prerequisites for the Nodinite LDAP Web API

Prepare your environment for a successful Nodinite LDAP Web API deployment. This page details all prerequisites for installing and hosting the latest version, whether on-premises or in the cloud.

✅ Install the .NET 10 Hosting Bundle, the same runtime as Nodinite v7
✅ Verify software and platform requirements for IIS or Azure App Service
✅ Ensure correct access rights for clients and the Web API
✅ Configure firewall and network settings for secure connectivity
✅ Stay up to date with supported versions and release notes

This page describes the prerequisites for successfully installing and hosting the latest version of the Nodinite LDAP Web API.

graph LR subgraph "Client Consumer" roClient(fal:fa-code Logic Apps/MuleSoft/WSO2/Custom Code...) end subgraph "LDAP Environment" roClient --> roLDAP(fal:fa-cloud-upload LDAP Web API) roLDAP-->roLA(fal:fa-folder LDAP Catalog Service) end

Diagram: High-level architecture for Nodinite LDAP Web API deployment.

You can install the Nodinite LDAP Web API on-premises on a Windows Server with IIS, or in the cloud/off-site if the target server has network access to the LDAP catalog. You can also host the LDAP Web API inside your App Service Environment.

Verified Topic
Software Requirements
What rights does the client for Nodinite LDAP Web API require?
What Access Rights Does the Nodinite LDAP Web API Require?
What Firewall settings are required for the Nodinite LDAP Web API?

Software Requirements

You can install the Nodinite LDAP Web API in IIS or in your App Service Environment.

The Nodinite LDAP Web API is an ASP.NET Core application built on .NET 10 New 3.1.0, the same runtime as Nodinite v7. In IIS, the .NET 10 Hosting Bundle provides everything the API needs to run: the .NET Runtime, the ASP.NET Core Runtime, and the ASP.NET Core Module V2, which lets IIS start and forward requests to the API.

Product Version Comment
.NET 10 Hosting Bundle .NET 10.0 New 3.1.0 IIS hosting. Install the Hosting Bundle, not the Runtime or the SDK. Always install the latest .NET 10 patch
Azure App Service .NET 10 (Windows) App Service hosting. Select the .NET 10 runtime stack; no Hosting Bundle is needed
Browser Microsoft Edge or Google Chrome Add /swagger to the address to test the API

Runtime by version

LDAP Web API version Runtime Status
3.1.0 and later .NET 10 ✅ Supported
3.0.6 – 3.0.x ASP.NET Core 8.0 ⚠️ Update to 3.1.0 or later
3.0.0 – 3.0.5 ASP.NET Core 7.0 ❌ Runtime out of support
2.0.0 – 2.0.1 ASP.NET Core 3.1 ❌ Runtime out of support
Earlier than 2.0.0 ASP.NET Core 2.0.6 ❌ Runtime out of support

Install the .NET 10 Hosting Bundle

Important

Install the IIS Windows features before the .NET 10 Hosting Bundle. If you install the Hosting Bundle first, the installer doesn't register the ASP.NET Core Module V2 in IIS, and the API fails with an HTTP 500.19 error. If that happens, run the Hosting Bundle installer again and select Repair.

  1. Install IIS with the required Windows features, see IIS Windows Features.
  2. Download and run the .NET 10.0 Hosting Bundle installer.
  3. Restart IIS (iisreset) or reboot the server.
  4. Verify that the ASP.NET Core Module V2 is present, see Verify ASP.NET Core Module.

If the server also hosts Nodinite v7, the Hosting Bundle is already installed; keep it on the latest .NET 10 patch. For background, see Host ASP.NET Core on Windows with IIS.

You should review the Disable PAC Verification user guide and consider the changes required for better performance.

IIS

If you host the Nodinite LDAP Web API in IIS, you must install the following components:

Product Comment
Windows Server Windows Server 2025
Windows Server 2022
Windows Server 2019
Windows Server 2016
Windows Server 2012 R2 ⚠️ ESU only
Windows Server 2012 ⚠️ ESU only
IIS Configure the App Pool with No Managed Code and a named account that has read/write rights to the folder where the binaries are located
.NET 10 Hosting Bundle See Install the .NET 10 Hosting Bundle

Note

.NET 10 supports Windows Server 2012 and 2012 R2 only with Extended Security Updates (ESU). Use Windows Server 2022 or later for new installations.

Warning

You must reboot after installation.

App Service Environment (ASE)

You can host the Nodinite LDAP Web API in an Azure App Service Environment (ASE). The App Service uses a Managed Identity to authenticate with the settings (you should store passwords in Key Vault).

  • Assign the Azure Key Vault Administrator permission to the App Service role.
  • The App Service requires an App Configuration container to store the settings in use.

Supported Versions

Cloud technologies evolve quickly. As Microsoft deprecates older versions of their Services and APIs, Nodinite always supports the APIs supported by Microsoft. You need to update the Nodinite LDAP Web API from time to time.

Subscribe to the Release Notes to stay informed.

What rights does the client for Nodinite LDAP Web API require?

You use an identifier (a Guid) in your code or system integration platform to select which connection to use when executing an LDAP statement. The API is not secured, but you should use HTTPS and can further restrict access by white-listing IP addresses.

What Access Rights Does the Nodinite LDAP Web API Require?

  • The account you use for LDAP queries must have proper read/write access to targeted objects in the LDAP/AD catalog.
  • The server must be domain joined, and you must target Active Directory if you do not provide explicit connection information in the adapter.

What Firewall settings are required for the Nodinite LDAP Web API?

This section is the one home for the ports of both LDAP products: the LDAP Web API and the BizTalk LDAP Adapter use the same directory connections. The Web API receives REST calls from your integration platform and opens LDAP connections to the directory; it also needs DNS, and Kerberos when it signs in with a domain account. The diagram shows each host, with the port on the arrow, drawn from the side that opens the connection.

graph LR subgraph "Client Consumer" roClient["fa:fa-code Logic Apps, MuleSoft, WSO2, custom code"] end subgraph "LDAP Web API Server - IIS or Azure App Service" roAPI["fa:fa-cloud-arrow-up LDAP Web API"] end subgraph "LDAP Catalog Server" roLDAP["fa:fa-address-book Active Directory, AD LDS, DirX, eDirectory, OpenLDAP"] end subgraph "Domain Controller" roDC["fa:fa-server DNS, Kerberos, Global Catalog"] end subgraph "Azure - App Service hosting only" roAzure["fa:fa-cloud Key Vault, App Configuration, Entra ID"] end roClient -->|"HTTPS, site port"| roAPI roAPI -->|"389 or 636"| roLDAP roAPI -->|"53, 88, 3268 or 3269"| roDC roAPI -.->|"HTTPS 443"| roAzure

Diagram: the client calls the LDAP Web API over HTTPS, and the API opens LDAP or LDAPS connections to the directory and uses the domain controller for DNS, Kerberos, and the Global Catalog. The dotted arrow applies only when you host the API in Azure App Service.

Between the Client/Consumer and the Nodinite LDAP Web API

Direction Source Destination Protocol Port(s) Purpose Notes
Inbound Client Consumer LDAP Web API Server TCP (HTTPS) 443, or the IIS site port REST calls that run LDAP operations You choose the port in the IIS binding; App Service uses 443. Restrict the source IP addresses, because the API itself doesn't authenticate callers. See HTTPS Hardening
Inbound Client Consumer LDAP Web API Server TCP (HTTP) 80, or the IIS site port REST calls without TLS ⚠️ Not recommended; test environments only

Between the Nodinite LDAP Web API and the LDAP Catalog Service

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound LDAP Web API Server LDAP Catalog Server TCP 389 LDAP Default port for Active Directory, AD LDS, DirX, eDirectory, and OpenLDAP
Outbound LDAP Web API Server LDAP Catalog Server TCP 636 LDAPS (LDAP over TLS) Recommended; needs a trusted certificate on the directory, see SSL-LDAPS for Active Directory
Outbound LDAP Web API Server LDAP Catalog Server TCP 1389, 10389, or the directory's port LDAP on a non-default port For example OpenDS (1389) or Apache Directory Server (10389); use the port in the connection settings

Between the Nodinite LDAP Web API and the domain controller

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound LDAP Web API Server DNS server (often the domain controller) TCP/UDP 53 DNS name resolution Resolve the directory host names; hosts-file entries are a fallback
Outbound LDAP Web API Server Domain Controller TCP/UDP 88 Kerberos When the API signs in with a domain account or the App Pool identity
Outbound LDAP Web API Server Domain Controller TCP 3268 or 3269 Global Catalog, or Global Catalog over TLS Only for forest-wide searches across domains

Between the Nodinite LDAP Web API and Azure services

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound LDAP Web API (App Service) Azure Key Vault, Azure App Configuration, Microsoft Entra ID TCP (HTTPS) 443 Read settings and secrets with the Managed Identity App Service or App Service Environment hosting only. The App Service also needs a network path, such as VNet integration, to the directory ports above
Outbound LDAP Web API Server File server TCP 445 SMB, for a Serilog file sink on a network share Only if you log to a remote share

What to get right

  • Default and changed ports: LDAP uses 389 and LDAPS 636 by default; other directories may use other ports. The API's own port is the one in your IIS binding.
  • MSDTC: directories don't take part in distributed transactions, so no RPC or MSDTC rule toward the directory is needed.
  • Versions: the ports are the same for every version of the LDAP products.
  • DNS (53): the API host must resolve the directory and domain controller names; Kerberos needs host names, not IP addresses.

Tip

To test each port, and for other protocols your network may require between the domain controllers themselves, see TCP and UDP ports.

Frequently asked questions

You will find additional solutions to common problems and the FAQ for the Nodinite LDAP Web API in the Troubleshooting user guide.

Next Steps

Install the Nodinite LDAP Web API