Single Sign-On (SSO) and Employee Directory: Integrating LDAP/OIDC and HR on the Corporate Portal

A modern corporate portal is not just a bulletin board, but a single window for all internal services. The central element of such a solution is a single sign-on (SSO) system and a structured employee directory. Implementing SSO based on LDAP and OIDC protocols allows you to eliminate dozens of passwords, and integration with HR systems keeps the directory up-to-date without manual updates. In this article, we will discuss how to build such an architecture and what benefits it brings to the business.

What is Single Sign-On and Why Do You Need It

Single Sign-On (SSO) is a technology where a user authenticates once (e.g., enters username/password, passes two-factor verification) and gains access to all connected applications without re-entering credentials. In the context of a corporate portal, SSO unifies login to intranet, corporate email, CRM, ERP, file storage, and other work tools.

Key advantages of SSO:

• Reduced support burden — up to 40% of IT helpdesk requests are related to password recovery; SSO drastically reduces this number (example).
• Enhanced security — a single entry point allows centralized enforcement of password policies, multi-factor authentication, and anomaly monitoring.
• Employee convenience — users are less distracted by routine operations and get to work faster.

When developing corporate portals, we strive to make authentication as transparent as possible, integrating it with the client's existing infrastructure. You can learn about how we design corporate intranet portals on a separate page.

The Employee Directory as the Foundation of a Corporate Portal

The employee directory is more than just a phone book. It is a dynamic database that reflects organizational structure, contact information, competencies, project roles, and colleague availability schedules. A well-designed directory accelerates communication, helps newcomers quickly integrate into the team, and serves as a foundation for collaboration.

Key Features of a Modern Directory

• Search by name, position, department, skills.
• Organizational structure visualization (tree diagram).
• Profiles with photo, work email, phone, work schedule.
• Integration with calendars and presence statuses (online/offline/away).
• Connection to project teams and tools like task trackers.

Without automatic synchronization with an HR system, the directory quickly becomes outdated. ESK Solutions implements two-way data exchange between the portal and HR platforms, eliminating manual entry and errors. This approach is part of comprehensive web development that takes all business processes into account.

Technical Implementation: LDAP and OIDC

Today, two main protocols are used to implement single sign-on: LDAP (Lightweight Directory Access Protocol) and OIDC (OpenID Connect). LDAP has historically been used for working with user directories (Active Directory, OpenLDAP), while OIDC has become the modern standard built on top of OAuth 2.0, providing authentication for web and mobile applications.

LDAP Integration

If Active Directory is already deployed in the company, the portal can connect to it via LDAP. This allows users to keep their familiar corporate credentials without creating separate accounts. The portal server verifies the entered credentials by sending an LDAP query, and upon success, grants access. Additionally, attributes such as full name, department, and email address can be pulled from the LDAP directory to automatically populate the employee directory profile.

OIDC and Modern IdP Providers

OIDC offers more flexibility. It allows connecting the portal to external identity providers (Google Workspace, Microsoft Entra ID, Okta, Keycloak) and implementing scenarios like Single Logout, token refresh, and delegated access. This protocol is especially useful when, in addition to the internal portal, you need to provide seamless authentication for SaaS tools. We use OIDC when developing cloud services to ensure compatibility with various platforms.

The choice between LDAP and OIDC depends on the current infrastructure. A hybrid approach is often used: root authentication via LDAP, and OIDC for public and mobile access points. Our team helps select the optimal architecture based on security and usability requirements.

Integration with HR Systems

Automatically populating the employee directory is one of the most sought-after tasks. When a company uses SAP SuccessFactors, 1C:Payroll and Human Resource Management, BambooHR, or another HR system, manual data transfer takes hours, and discrepancies lead to confusion. Integrating the portal with the HR platform solves this problem.

Synchronization Scenarios

• Exporting new and modified records — when an employee is hired, their profile automatically appears on the portal; when they leave, it is deactivated and hidden.
• Bulk import — initial population of the directory when the portal is launched.
• Delta synchronization — regular (e.g., once per hour) transfer of only changed fields.
• Feedback — some portal data (e.g., confirmed phone number, avatar) can be sent back to HR.

Technically, such integrations are built via REST APIs, webhook events, or direct queries to the HR system's database. We often package the integration layer into a microservice, which can then be part of a corporate SaaS solution or a separate portal module. And if synchronization is also needed with CRM, these processes are tied together into a unified logic — for example, when implementing CRM systems, we provide a unified client or employee profile.

Frequently Asked Questions

Can SSO be connected if the company already has Active Directory?

Yes, this is one of the most common scenarios. The portal connects to AD via LDAP or Kerberos, and employees use their domain accounts. No additional accounts need to be created.

What if some employees work remotely and do not have access to the local domain?

In such cases, it is convenient to deploy a hybrid solution: internal users authenticate via LDAP, while remote users authenticate via a cloud IdP (e.g., Microsoft Entra ID) using the OIDC protocol. All sessions are managed centrally.

How often is the employee directory data updated?

The frequency is configurable. Real-time synchronization is possible when an HR record changes (webhook), or delayed delta synchronization every 15–60 minutes. We select the mode to avoid excessive load on systems.

Do we need to develop the directory from scratch or can we use a ready-made module?

Ready-made modules speed up launch, but often require customization for a specific company's organizational structure. We practice customizing open-source solutions or creating an individual directory if business requirements go beyond standard options. More details about our approach can be found in the corporate portal development section.

Implementing SSO and a "live" employee directory turns the intranet portal into a truly working tool, reduces operational costs, and significantly improves convenience. ESK Solutions is ready to help with the design, development, and integration of such solutions with your current systems.