You can use this article to configure LDAP synchronization from Rainbow Web Admin and validate the result before enabling automation. It helps you control which users and contacts are synchronized, how attributes are mapped, and how synchronization runs are monitored.
Open LDAP configuration in Rainbow Web Admin
Navigation
Open Rainbow Web Admin and go to Members - Import - LDAP. If prerequisites are met, the LDAP connector administration page is available.
Connector administration page
The page is organized around maintenance, domain selection, LDAP/user criteria and business directory settings.
| Area | Purpose |
|---|---|
| Maintenance | Connector name, creation date, last seen, status, version, revoke icon and report request. |
| Domain selector | Switch, rename or add a domain. Each domain has its own configuration. |
| LDAP server | Bind account, host URL, synchronization period and next synchronization. |
| User criteria | Base DN, filter, automatic sync, enrollment email, deletion and attribute mapping. |
| Business directory | Base DN, filter and mapping for shared directory contacts. |
Configure LDAP server and synchronization scope
LDAP server settings
- Login: bind DN or technical account used to authenticate against AD/LDAP.
- Password: stored encrypted at rest on the connector host.
-
Hostname or IP address: use
ldap://hostname[:port]orldaps://hostname[:port]. Default ports are 389 and 636. - Synchronization period: interval between automatic synchronizations.
- Next synchronization: date and time of the next planned automatic run.
User criteria
- Keep automatic user synchronization disabled while fine-tuning configuration.
- Use Base DN and Filter to select the LDAP records that should become Rainbow users.
- Use Define Attribute Mapping to map LDAP attributes to Rainbow fields.
- Use enrollment email only when new users should receive an activation email.
User deletion
User deletion behavior must be validated with a test user before enabling automatic synchronization. Depending on the chosen strategy, Rainbow users can be suspended when the LDAP record is missing or moved to a deletion subtree.
Business directory settings
The business directory uses its own Base DN, filter and mapping. Contacts previously created by the connector are reloaded in bulk during synchronization; contacts created by other tools are preserved.
ldap_id values so users can be reassociated by loginEmail when a new configuration is registered.Configure attribute mapping and subscriptions
Mandatory fields
| Rainbow field | Microsoft AD default | Generic LDAP suggestion | Purpose |
|---|---|---|---|
| ldap_id | objectGUID | uid or entryUUID | Stable unique identifier used to track synchronized records. |
| loginEmail | Rainbow login email. | ||
| firstName | givenName | givenName | User first name. |
| lastName | sn | sn | User last name. |
Common optional fields
| Rainbow field | Typical LDAP attribute |
|---|---|
| jobTitle | title |
| department | department or ou |
| businessPhone0 | telephoneNumber |
| mobilePhone0 | mobile |
| email0 | |
| nickName | displayName |
PBX and device association
PBX/device fields can associate a synchronized user with telephony resources. Confirm your target company PBX model and expected identifiers before enabling this mapping.
| Field | Use |
|---|---|
| pbxShortNumber | Short number used to associate the user with a PBX device. |
| pbxLdapId | Environment-specific PBX identifier when required. |
| phoneNumber / business phone fields | Numbers displayed in Rainbow user profiles and directory. |
Rainbow Hub fields
Rainbow Hub and Hybrid user creation can rely on dedicated mapped fields. Use them only when the company deployment mode requires Hub or Hybrid provisioning.
Operations on mapping values
Mapping operations can normalize LDAP values before sending them to Rainbow. Keep transformations simple and document any rule specific to your environment so support can reproduce synchronization behavior.
Multi-value LDAP attributes
For optional fields, multi-value attributes can be accepted depending on the target Rainbow field. For mandatory fields, map a single stable value only.
Multi-PBX mapping
Multi-PBX mapping is used when users from the same Rainbow company are associated with several PBX systems. Validate the mapping with a dry run and a pilot user before enabling automatic synchronization.
Default subscription
Select the default Business or Enterprise subscription that synchronized users should receive. User creation can fail when no eligible license is available.
Validate and run synchronization
Dry run
Dry run executes the full connector pipeline up to CSV generation and asks Rainbow to simulate the import without applying changes.
- Use dry run after each mapping, filter or Base DN change.
- Check the report for users or contacts to create, update or delete.
- If the result is empty or unexpected, use Save logs from the local console and inspect generated CSV files and rejected records.
Manual synchronization
After dry run results match expectations, launch a manual synchronization. Review the import report and resolve per-record errors such as duplicate loginEmail, license exhaustion or PBX conflicts.
Automatic synchronization
Enable automatic synchronization only after dry run, first effective import and deletion behavior have been validated. Configure the synchronization period and next synchronization date in Rainbow Web Admin.
User flow versus directory flow
| Flow | Behavior |
|---|---|
| User synchronization | Creates, updates and optionally deletes Rainbow users. User records are tracked through ldap_id. |
| Business directory synchronization | Reloads connector-managed business directory contacts in bulk. Contacts from other sources are preserved. |
Active Directory detection
The connector adapts some behavior when the server is detected as Microsoft Active Directory, for example default mapping and avatar synchronization. For non-AD servers, review ldap_id and mandatory mappings carefully.
Monitoring
- Use Rainbow Web Admin synchronization reports for import result and backend errors.
- Use the local console to monitor connector connection status, LDAP counters and last/next synchronization.
- Use the History - Equipment audit trail in Rainbow Web Admin for connector registration, start/stop, configuration and sync events.
Manage synchronized users
Behavior with existing Rainbow users
When a synchronized LDAP record matches an existing Rainbow user, the connector can associate the LDAP record with that user instead of creating a duplicate. The main matching key is typically loginEmail.
User creation
- A matching LDAP record can create a Rainbow user when mandatory mapped fields are present.
- User creation requires an available eligible license in the company.
- Enrollment email can be sent to newly created users when enabled in Rainbow Web Admin.
- PBX or device association can be applied when the required mapping is configured.
Deletion strategies
| Strategy | Behavior | When to use |
|---|---|---|
| Delete missing LDAP records | Users no longer returned by the LDAP search are suspended or deleted according to configuration. | Simple directories where missing from search means user left scope. |
| Deletion subtree | Users are considered deleted when moved to a dedicated LDAP subtree. | Directories where removal from the main OU is not enough to mean deletion. |
Avatar synchronization
Avatar synchronization is available for Microsoft Active Directory. The connector reads the mapped photo attribute, typically thumbnailPhoto, detects changes and uploads the avatar after user processing.
- The LDAP service account must be allowed to read the photo attribute.
- Large directories can require additional time because avatars are processed after users.
- If avatars are not updated, verify mapping, permissions and connector logs.
Differential mode
Differential synchronization is planned. In the current connector behavior, full synchronization is performed at each run even if the UI exposes a differential synchronization setting.