Auth Mappings

The Auth Mappings section (/auth-mappings, System → Auth Mappings) determines which organizational unit an employee is automatically placed into when they log in through a corporate directory (LDAP / Active Directory). The roles and permissions a user receives depend on their organizational unit — see Users, Groups, and Roles for more on roles and groups.

This is the server-side part of the same mechanism described for end users in Logging In — SSO.

How it works

1. An employee logs in with their directory (LDAP/AD) login/password — see the LDAP tab in Settings
2. Orbita retrieves the list of groups the user belongs to from the directory
3. The mappings are searched for a rule whose Group matches one of the user's groups
4. If several rules match, the one with the highest Priority is chosen
5. The user is assigned the Org Unit from the matched rule

If no rule matches, the default org unit set on the LDAP tab in Settings (the Default Org Unit field) is used — but only if the user doesn't already have a unit assigned.

User's groups in the directory
        │
        ▼
 Look up a mapping by group name
   (match found?) ──no──► Default org unit (if set)
        │ yes
        ▼
 Multiple matches? ──yes──► The mapping with the higher priority is used
        │
        ▼
 The user is assigned the mapping's org unit

Rule fields

Field	Description
Group	The group name in the external directory (for example, a DN string from Active Directory like CN=IT_Helpdesk,DC=domain,DC=local, or an LDAP/Authentik group name)
Org Unit	The Orbita org unit the user is placed into when the group matches
Priority	A number; if several rules match the same user, the rule with the highest value is applied

If the directory can be queried, the group list loads automatically when creating or editing a rule — just pick the one you need from the dropdown. If the directory connection is unavailable, the group name can be entered manually.

Creating a mapping

1. Open Auth Mappings
2. Click the add button
3. Select (or enter) a Group from the directory
4. Select the Org Unit that members of this group should be placed into
5. Set a Priority if needed — to resolve conflicts when a user belongs to several groups with different rules
6. Save

Changing or deleting a rule doesn't retroactively change org units already assigned to existing users — a mapping is applied on each new login.

Where this applies

The mapping is used during login via LDAP / Active Directory. The directory connection itself is configured separately — see the LDAP tab in Settings.