> For the complete documentation index, see [llms.txt](https://docs.we360.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.we360.ai/deployment-and-it-ops/deployment/infrastructure-management-on-premise/ldap-kerberos-login.md).

# LDAP / Kerberos Login (SSO)

On-premise deployments can authenticate users against your existing directory instead of separate We360 credentials. Two modes are supported:

* **Directory login** — users sign in with their existing directory (LDAP / Active Directory) username and password.
* **Silent SSO (Kerberos)** — on domain-joined Windows machines, users are logged in automatically from their existing Windows session, with no username/password prompt.

Both are optional and are configured per deployment.

{% hint style="info" %}
**We360 performs the configuration.** You do not need to set up anything in the application. We only need some details about your directory environment, listed below. The Kerberos (silent SSO) mode is optional — set it up only if you want zero-prompt login.
{% endhint %}

## Information we need from you

To enable this, we ask your IT / directory administrator for the following. The downloadable form at the bottom of this page has a fill-in table for each item.

1. **Directory server** — type (Active Directory / other LDAP), version, host name(s), port, and whether the connection uses LDAPS/TLS (plus the CA certificate if it is issued by a private CA).
2. **Service (bind) account** — a dedicated **read-only** account we use to look up users: its distinguished name (DN) and password.
3. **Directory structure** — the base DN and the specific container(s)/OU where the users who should log in are located, and whether all of them or only a subset (e.g. a group) get access.
4. **User attributes** — which fields hold the login username, email, and name, and a stable unique identifier.
5. **Kerberos / SSO** *(optional)* — the Kerberos realm, KDC (domain controller) host names, confirmation that machines are domain-joined, and a service account + SPN + **keytab** your AD administrator generates for the login service.
6. **Network & environment** — connectivity from the We360 server to the directory (and KDC), DNS resolution, and clock synchronization.
7. **Test accounts** *(optional)* — one or two non-critical accounts so we can validate login before rollout.

{% hint style="warning" %}
**Handle secrets securely.** Passwords, certificates, keytab files, and test credentials must be shared through a secure channel that your We360 contact provides — never by email or inside the form document.
{% endhint %}

## Requirements form

Download, complete the **"Your value"** column, and return the form to your We360 contact. Items marked **(secure)** are sent separately via the secure channel.

{% file src="/files/Wvl1XcJ6WE8aRwoNiCMl" %}
We360 — Directory Integration (LDAP / Active Directory) Information Request
{% endfile %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.we360.ai/deployment-and-it-ops/deployment/infrastructure-management-on-premise/ldap-kerberos-login.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.