Skip to main content

MagicINFO LDAP problems: LDAPS 636, AD groups, one user

Most LDAP trouble in MagicINFO comes down to three things: it syncs containers (organizational units), not groups; you can add a single directory user without syncing anything; and LDAPS on port 636 needs your company's CA in the server's own Java trust store. This page covers those. The settings themselves are in Connect MagicINFO to LDAP or Active Directory.

Symptoms​

  • The LDAP settings save fine without the SSL box ticked (port 389) and fail as soon as you tick it (636).
  • Organization sync offers nothing to choose, or a test against a public LDAP test directory "finds nothing".
  • Your AD security group is not offered, or giving the group a role does nothing.
  • You want one directory user, not the whole OU, and the LDAP search is nowhere to be seen.

Why it happens​

Only containers can be synced​

Reported as product behaviour on MagicINFO 7 to 9: Use Organization Sync offers container objects (organizationalUnit / ou / container). Group objects (groupOfNames, groupOfUniqueNames, the kind public test directories use) are not offered. An AD security group cannot be synced as a unit or used to grant roles. Nested OUs are not depth-limited by MagicINFO. To check on your build, follow Sync LDAP Organizations into User Groups and see which entries appear under LDAP Organization.

Fix: put the people you want in an OU and sync that, or add users individually (next section). When you test against a public directory, pick one whose people sit in OUs.

One user instead of a whole OU​

Reported: in Add User, choose the organization and group first. Only then does the LDAP search option appear. Search for the person and add them. The form is described in Add or Delete User Accounts. If you cannot see the option, you have probably not yet picked the group.

If the search finds people but the ID or e-mail arrives empty, look at the ldap.user.attribute.* keys in config.properties; the LDAP manual page lists them.

LDAPS fails on 636 while 389 works​

MagicINFO connects with its bundled Java (C:\MagicInfo Premium\jre\). That Java keeps its own list of trusted authorities, which does not include your company's private CA, so the directory's certificate is not trusted and the connection fails. The name you type under Server Address must also match the name in the directory server's certificate.

Fix: import your CA for LDAPS​

  1. Get your root CA certificate (and any intermediate) as a file, for example C:\certs\company-root-ca.cer.
  2. Open Command Prompt as administrator.
  3. Import it with the bundled tool:
"C:\MagicInfo Premium\jre\bin\keytool.exe" -importcert -alias company-root-ca -file C:\certs\company-root-ca.cer -keystore "C:\MagicInfo Premium\jre\lib\security\cacerts"
  1. keytool asks for the password of the bundled Java's trust store. Type it at the prompt rather than putting it in a script or batch file. Answer yes when asked whether to trust the certificate.
  2. Restart the MagicInfo-i Premium Edition Server service and wait several minutes.
  3. Under Setting > Server management > Server Settings, tick SSL, set Server Address to the name on the certificate, and click Save.
warning

Do not "fix" LDAPS by falling back to plain port 389 across a network you do not control: directory passwords would travel unencrypted. Import the CA instead.

An upgrade can replace the bundled Java and with it your import. After every upgrade, list the trust store (keytool -list with the same -keystore path and your alias) and import again if the entry is gone. Add the import to your list of local changes.

How to confirm it worked​

  • Clicking Save on the LDAP Server settings with SSL ticked succeeds. MagicINFO connects and logs in at that moment and shows an error if it cannot.
  • The OU you want appears under LDAP Organization when you add an entry in User > Sync LDAP Organization.
  • After Sync, the people from that OU show up in the user group, or the single user you added can sign in with their directory account.

Checked against MagicINFO Server 21.1070 on Windows, October 2026. Items marked reported come from other installs on MagicINFO 7 to 9.

Prefer not to run the server yourself? MiCloud hosts MagicINFO for you.

Last updated on