Chapter 16 Clients, Groupware & CLI Admin: #pIdentity

Identity sources: Active Directory, LDAP, Entra ID, Keycloak and SCIM

Under Admin > Identity sources you connect a tenant or single domains to Active Directory or LDAP (sign-in by bind, sync of users, nested groups and contacts) or to Microsoft Entra ID, Keycloak and other OpenID Connect providers (sign-in by SSO, provisioning by SCIM 2.0). Local accounts stay fully usable next to them (mixed operation). Every account has exactly one source; matching uses the ExternalId (AD objectGUID, Entra objectId, LDAP entryUUID), never just the mail address. Fields the source manages are read-only in the admin and in "My account".

Operational Tip & Architecture Note

Keep at least one local server admin without a source as break-glass access. It is never taken over from AD, never signs in through SSO mail matching and works even when AD or Entra are unreachable. Set the nextxch lockout threshold (default 5 failures) below the AD account lockout threshold: attackers then never lock an AD account, because nextxch stops before the bind.

Entra ID: app registration for sign-in and SCIM

Sign-in: own app registration (web platform) with the redirect URI from Admin > Identity sources. Provisioning: non-gallery enterprise app with provisioning mode "Automatic", tenant URL and secret token from nextxch.

Reference / Configuration

1. Entra admin center > App registrations > New registration
   Name:            nextxch Webmail
   Account types:   Accounts in this organizational directory only (single tenant)
   Redirect URI:    Web  https://mail.example.com/api/auth/sso/callback
2. Certificates & secrets > New client secret  -> enter it in nextxch as client secret
3. Token configuration > Add optional claim: ID token "email" (otherwise preferred_username = UPN is used)
4. App roles (optional): e.g. create "Nextxch.TenantAdmins", assign users,
   in nextxch: claim "roles", value "Nextxch.TenantAdmins" -> role TenantAdmin
5. nextxch Admin > Identity sources > Add Entra ID / OIDC
   Authority:  https://login.microsoftonline.com/<directory id>/v2.0
   Client id:  <application id>
6. SCIM: Enterprise applications > New application > Create your own (non-gallery)
   Provisioning > Automatic
   Tenant URL:    https://mail.example.com/scim/v2
   Secret token:  nxscim_...   (Admin > Identity sources > Create SCIM token)
   Mappings: userName <- userPrincipalName, emails[type eq "work"].value <- mail,
             externalId <- objectId (recommended) or mailNickname

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`Active Directory: Dienstkonto`	Normal domain user without admin rights, read only (the default "Authenticated Users" read access is enough). Password does not expire. Stored encrypted, never shown.	`CN=svc-nextxch,OU=Service,...`	No domain admin. Reading is enough for photos and proxyAddresses. Optionally restrict "Log on to" to the DCs.
`LDAPS 636 / StartTLS 389`	Encrypted connection to the domain controllers. Several DCs are tried in order (failover), timeout per DC configurable.	`LDAPS, 10 s`	Trust the DC certificate (or the internal CA) on the nextxch server. "Do not check the certificate" only briefly during setup.
`Anmeldung (alle Protokolle)`	Webmail, admin, IMAP, SMTP, POP3, ActiveSync, EWS, MAPI and DAV check the AD password by bind. Login names: mail address, userPrincipalName, sAMAccountName or DOMAIN\user.	`Cache 15 min (Hash)`	The short sign-in cache stores only an HMAC, never the password, and keeps sign-in working during a short DC outage. 0 switches it off.
`Abgleich: Benutzer, Gruppen, Kontakte`	mail and proxyAddresses (SMTP: = primary, smtp: = alias), displayName, givenName, sn, telephoneNumber, mobile, title, department, company, physicalDeliveryOfficeName, manager, thumbnailPhoto; userAccountControl and accountExpires disable the mailbox. Mail-enabled groups become distribution lists (nested via LDAP_MATCHING_RULE_IN_CHAIN), contacts appear in the address book.	`Delta 15 min, voll 02:00`	Use "Preview" before the first run: shows which accounts would be created, taken over or disabled without changing anything. Filter on a "Mail users" group.
`Gelöschte Objekte`	When an object disappears from AD (or Entra sends SCIM DELETE), the mailbox is disabled at once. After the grace period the admin decides: delete, keep as shared mailbox or keep disabled.	`30 Tage`	Renames are not deletions: the old primary address stays as an alias.
`Vorlagen`	Attribute mapping for Microsoft AD, Samba AD, OpenLDAP, Univention Corporate Server and FreeIPA; every field can be overridden or switched off with "-".	`Active Directory`	OpenLDAP needs the memberOf overlay for the group filter; nextxch resolves nested groups there itself.
`OIDC (Entra ID, Keycloak)`	Authorization code flow with PKCE on the server, discovery and JWKS with automatic key rollover, RS256/ES256, checks of iss, aud, exp, nonce and the Entra tenant tid. Group or app role claims map to User, TenantAdmin and ServerAdmin.	`Knopf auf der Anmeldeseite`	Keycloak: authority https://kc.example.com/realms/<realm>, confidential client with standard flow, redirect URI as above; roles through claim realm_access.roles.
`Lokale Passwörter pro Domain`	Can be switched off separately for webmail/admin and protocols. Entra passwords never reach nextxch: mail apps (Outlook, iPhone, Thunderbird) use app passwords; webmail guides through the setup with an assistant.	`An`	Per protocol you can additionally enforce "OAuth / Kerberos only" (see chapters 16a and 16b). AD users can change their password in webmail when the source allows it.
`Kennwort ändern (AD / LDAP)`	With "Users may change their password" webmail shows a form under Settings > Security (current and new password). AD: unicodePwd over LDAPS with the old password, so AD complexity, password history and minimum age apply; other directories: RFC 3062. Admins reset passwords in the account dialog (optionally "change at next logon").	`Aus`	For the admin reset delegate only "Reset password" on the user OU to the service account. Passwords are never logged.