Configuring the Nodinite LDAP Web API

Set up your Nodinite LDAP Web API for secure, flexible integration. This guide walks you through configuring product keys, connection information, authentication, and logging to ensure robust and compliant operations.

✅ Protect sensitive data with encrypted settings
✅ Support multiple connections and authentication types
✅ Enable detailed logging for traceability and compliance
✅ Easily update product keys and manage licenses

Before you use the Nodinite LDAP Web API, configure connectivity and optional logging options.

• Product Key
• Connection information
• Logging

You manage two configuration files:

• appsettings.json – product key and debug settings
• settings.json – connection information (this file automatically encrypts sensitive data like passwords)

Screenshot: Example of appsettings.json and settings.json files for Nodinite LDAP Web API.

Understanding the Configuration

The client sends the Id (a GUID) of a connection with every call. The LDAP Web API looks up that Id in settings.json, binds to the directory with the connection's account, authentication type, server, and port, and runs the operations. appsettings.json holds the product key and the Logging settings that apply to every call.

Diagram: how the connection Id in a call selects a connection from settings.json, which the LDAP Web API uses to bind to the directory.

appsettings.json

Edit the appsettings.json file manually. Use Notepad++ or another text editor. Open the file with administrative privileges so you can save your changes.

Product Key

You must provide the CustomerName and a Key. These are time-limited and you must exchange them every year.

You can buy a license from most of our Partners. You can also contact us at info@nodinite.com for guidance and recommendations to get started quickly.

settings.json

Edit the settings.json file manually. Use Notepad++ or another text editor. Open the file with administrative privileges so you can save your changes.

Connection information

Connections is a top-level array in settings.json. You can define any number of connections. The client/consumer provides this identity part of the call to the LDAP Web API.

You can use multiple accounts with different rights for different operations. As part of your API call, you send the Id of the configuration to use (a GUID).

{
  "Connections": [
    {
      "Id": "5a95449b-95a6-4a9b-bfb4-f5292cbd3122",
      "AuthenticationType": 65,
      "DSAServer": "WILDWESTAD01",
      "DSAServerPort": 389,
      "UserName": "WildWest\\LDAPServiceAccount",
      "Password": "myverys3cretP4$$w0rd!"
    },
    {
      "Id": "6a95449b-95a6-4a9b-bfb4-f5292cbd3123",
      "AuthenticationType": 1,
      "DSAServer": "WILDWESTAD01",
      "DSAServerPort": 636,
      "UserName": "WildWest\\LDAPServiceAccount",
      "Password": "myverys3cretP4$$w0rd!"
    }
  ],
  "LogRequest": false,
  "LogResponse": false,
  "LogHttpHeaders": false
}

Note

Azure App Service: put the same values in Azure App Configuration under the LdapSettings section, for example LdapSettings:Connections:0:Id, LdapSettings:Connections:0:DSAServer, and so on. See Install - AppSettings.

Warning

UserName and Password are required. Empty values are sent to the domain controller as a real login and fail with "The user name or password is incorrect" (0x8007052E). Leaving them empty does not mean "use the application pool account".

Important

The password must be in clear text for first-time usage. The password will then be detected as plain text and will be encrypted on the first invocation of any operation (for example, run the search in Test, Step 5). The encryption locks the current configuration to the named account. If you change the user name or password, you must specify the password in clear text again, and it will be re-encrypted.

AuthenticationTypes

The AuthenticationTypes is a flags enum, so you can combine several options by adding their values.

For example, the value 65 means Secure + Signing

AuthenticationType per port

The AuthenticationType must fit the DSAServerPort. The wrong combination fails with unclear errors:

2 (SecureSocketsLayer, also named Encryption) means LDAPS and only works together with 1 on port 636. Don't use it on port 389.

How to enable LDAP signing in Windows Server

Important

Run as securely as possible!

Review the How to enable LDAP signing in Windows Server user guide

Tip

You can significantly improve the security of a directory server by configuring the server to reject Simple Authentication and Security Layer (SASL) LDAP binds that do not request signing (integrity verification), or to reject LDAP simple binds that are performed on a clear text (non-SSL/TLS-encrypted) connection.

Connection Id

The Id (a GUID) identifies this connection in the Connections array.

Once you set this Id, only change it if you explicitly want client operations to fail. If you change this value, clients must also be updated to reflect the change.

Example: 5a95449b-95a6-4a9b-bfb4-f5292cbd3122

DSAServer

The DSAServer is usually the DNS name for the target domain controller for Active Directory. You may use an IP address for some operations, and also for some other LDAP Catalog services. Consult the documentation from that vendor for additional information.

Example: WILDWESTAD01

DSAServerPort

The DSAServerPort is the TCP or UDP port to use for connecting with the LDAP Catalog Service. For Active Directory, the default is 389 or 636 for encrypted communication. The latter requires a valid certificate. Review the SSL-LDAPS for Active Directory user guide for additional information.

Example: 636

Note

The Nodinite LDAP products use additional TCP and UDP ports. The firewall settings list every port per hop, and the TCP and UDP ports user guide shows how to test them.

Tip

Encrypt some operations, usually using port 636. Some operations are not supported using encrypted communication: GetDomainControllers and the Schema operations fail on a port 636 connection. The solution is to use different connections, using different ports.

Logging

Review the 'Enable Logging' user guide for more information.

Next Steps

Test
Develop

Related Topics

Prerequisites
Install
SSL-LDAPS for Active Directory
Troubleshooting