LDAP, SAML, Entra ID and NFC: Settings

The Authentication article describes the screen where administrators add, test and delete login modules. This chapter covers the exact settings for each module type – LDAP, Microsoft Entra ID, SAML and NFC – and SMTP OAuth, which is a separate mail-sending setting, not a login module.

The form depends on the module type
The module settings fields on the Authentication screen are generated according to the module type – this is why the SAML settings show the technical tabs “anyOf-0”/“anyOf-1”: they are two variants of the IdP certificate field (a single certificate, or several certificates at once), not an error.

LDAP

FieldMeaning
ServerLDAP server address, e.g. 192.168.0.10. For an encrypted connection, use an address with the ldaps:// prefix.
PortLDAP server port (default 389).
RDNBase distinguished name (base DN) of the directory.
PeopleDistinguished name of the branch in which users are searched for.
Group search base (groupSearchBase)Base from which group membership is looked up. Leave empty if you do not use groups.
Login userDN of the account TAS uses to connect to the directory (bind DN).
Login user passwordPassword of the bind account. Use an account with read-only access to the directory.
Login suffixAppended to the entered user name, e.g. @firma.cz.
User filterAdditional LDAP filter that can narrow down the set of valid users.
Login attributeDirectory attribute against which the entered name is compared (default sAMAccountName).
External IDAttribute by which TAS recognises the same user during repeated synchronisation (default objectGUID).
TimeoutConnection timeout in milliseconds (default 10,000).
Synchronise photoAlso downloads the user's photo during synchronisation.
Create usersA non-existent user is created automatically on first login / synchronisation.
Update on loginUser details are updated from the directory on every login, not only during synchronisation.
Script after create/updateCustom script run after a user is created or updated.
Record middlewareScript that can modify the raw directory record before it is mapped to a TAS user.
Use competence rulesGroup membership (memberOf) can be used in competence rules for assigning roles – see the Roles and Competences article.
Recursive membershipWhen evaluating groups, also takes nested groups into account, not just direct membership.
Mapping e-mail and name
The LDAP module has no separate fields for mapping the e-mail or display name – this is handled in the Record middleware script or the Script after create/update.

Microsoft Entra ID (Azure AD)

FieldMeaning
Tenant IDEntra ID tenant ID.
Client IDID of the application registered in Entra ID.
Response typeid_token or id_token token (default). The second option is required if TAS should also download the user's profile photo.
Response modeOnly form_post is supported.
ScopeList of requested permissions, default profile, email, openid, User.Read.
Redirect URLCustom redirect address; if left empty, the default /auth/azure-ad/callback/<id modulu> is used.
Domain hint / login hint / promptOptional parameters passed directly to the Entra ID sign-in page (e.g. pre-filling the domain).
Download profile photoRequires Response type id_token token and the User.Read scope.
Allow http for redirect URLAllows unencrypted http:// as the redirect address (for testing only).
Script after loginScript that finds or creates a TAS user from the token claims.
No Client secret
The Entra ID module signs in via the browser (OIDC implicit flow), so it has no field for a Client secret or certificate – TAS does not use them for this module type.

SAML 2.0

FieldMeaning
Entry point (entryPoint)Sign-in URL of the identity provider (IdP).
IssuerIdentifier of TAS as the service provider (SP entity ID).
Callback URLAddress to which the IdP sends its response after sign-in (ACS URL); the actual path is always /auth/saml2/callback.
Identifier formatOptionally requested NameID format.
IdP certificate (anyOf-0 / anyOf-1)Identity provider certificate(s) for signature verification – either a single certificate or several at once. In practice it is usually not filled in manually: TAS retrieves it itself from the metadata (Cert field) or from a file (Certificate path).
Cert (metadata URL or certificate)Address of the IdP XML metadata (or the certificate itself) from which TAS loads the certificate.
Certificate pathAlternative to the Cert field – path to the certificate file on the server.
Require signed responseRejects an IdP response without a valid signature.
Require signed assertionsRejects individual assertions without a valid signature.
Script after loginScript that finds or creates a TAS user from the SAML profile.

NFC

FieldMeaning
InstructionsText (in Czech, English, German) displayed to the user at the reader.
Script after loginThe default script reads the card serial number from the request and finds or creates the corresponding user; it can be modified so that the card maps to a different user attribute.
Requires the NFC reader to be enabled
The NFC module can only be added and saved when the NFC reader switch is turned on in Configuration (featureFlag.nfcReaderEnabled, off by default). Without it, TAS refuses to save the module.

Apache Kerberos and Foreign (in brief)

Apache Kerberos has only three fields: the address of the authentication endpoint (default <adresa serveru>/kerberos), the login suffix removed from the remote user header, and the script after login.

Foreign (redirect to any external sign-in page) has a single field – the target URL to which login is redirected.

Password (login with a user name and password stored in TAS) has no settings.

SMTP OAuth authentication

This setting does not concern the login modules above – it determines how TAS authenticates sending mail through an SMTP server that requires an OAuth2 token instead of a password. It is set in Configuration, not on the Authentication screen:

KeyMeaning
integrations.mail.typeoauth2 enables this method (alongside basic, sendmail, msgraph).
integrations.mail.host, .portSMTP server address and port.
integrations.mail.basicAuth.userMailbox on whose behalf e-mails are sent.
integrations.mail.oauth2.hostAddress where TAS obtains the OAuth2 token.
integrations.mail.oauth2.clientId, .clientSecretApplication credentials for the token endpoint.
integrations.mail.oauth2.grantTypeOAuth2 grant type (typically client_credentials).
integrations.mail.oauth2.scopeRequested permission scope.

The Microsoft Graph integration (sending via integrations.mail.type: "msgraph", reading mailboxes) is described separately in the MS Graph (e-mail) article – it is not the same as SMTP OAuth, although both can target the same Microsoft 365 mailbox.

Related: Authentication, Roles and Competences, MS Graph (e-mail), Vault.

SMTP OAuth authentication

Configuring authentication modules
Syca (opens in a new tab)

Powered by HelpDocs (opens in a new tab)