When reminders get lost in the inbox
You know the situation: an invoice is overdue, nobody followed up, reminders are sent too late or replies get lost in the accounting inbox. Such situations cost time and worsen incoming payments. A role-based approval can only be achieved sustainably if the internal user management is reliably connected to receivables management. For on‑prem Debentra instances this means: SSO/LDAP integration, clear role mapping and an approving workflow for payment reminders.
What you want to achieve
The goal is concrete: your employees' SSO/LDAP accounts are automatically imported into Debentra, groups or attributes are mapped to the roles Collector, Accounting and CFO, and reminder letters go through an audit-proof approval process. The user retains control over sending at all times — approvals are not automatically hidden inside a black box.
Preparation: Check prerequisites
- On‑prem infrastructure: Debentra runs on your own infrastructure and is administratively reachable.
- Directory service: Functional LDAP server (e.g. Active Directory, OpenLDAP) or SSO provider within your network.
- Administrative access: A Debentra administrator account and a directory bind user with read rights on the relevant attributes.
- Secure connection: TLS/SSL for LDAP (LDAPS) or SSO endpoints; valid certificates and correct hostnames.
- Test environment: A staging instance minimizes risks when testing role mapping and workflows.
Step-by-step: Connect SSO/LDAP and map roles
1. Establish the connection
Create a new directory/SSO configuration in Debentra. Enter the server address, port and bind credentials. Use LDAPS or the appropriate SSO protocol of your provider. Pay attention to time and certificate validation — connection errors are the most common pitfalls.
2. Define base DN and filter
Set the Base DN (e.g. dc=firma,dc=local) and test with a simple search filter that returns only active users (e.g. (&(objectClass=person)(mail=*)) ). Keep the query lean to avoid performance issues.
3. Perform attribute mapping
Map the necessary LDAP attributes: username → login, mail → email, displayName → first/last name. Additionally, map a group or role attribute (memberOf, groups or a custom attribute) so Debentra can assign permissions later.
4. Map groups to Debentra roles
Define a simple mapping logic in Debentra: LDAP group “Debentra‑Collector” → Debentra role Collector; “Debentra‑Buchhaltung” → Accounting; “Debentra‑CFO” → CFO. These three roles typically form the approval path: Collector creates reminder proposals, Accounting checks formalities, and the CFO gives final approval for critical cases.
5. Configure the approval workflow
In Debentra you specify under which conditions a multi-stage approval is required (e.g., reminder level, amount, or customer). Example:
- Under 1,000 EUR: approval by Accounting.
- 1,000–10,000 EUR: Accounting → CFO.
- High risk / Schufa notice: additional review by the CFO.
Important: Configure approvals to be explicit – Debentra can automate proposals, but sending must remain manual or require release by an approving person.
6. Test and validate
Create test accounts in LDAP that exactly mirror the group memberships. Test cases:
- Collector creates a payment reminder; Accounting can view and comment on it.
- Accounting forwards for CFO approval; the CFO sees the history and approves or rejects.
- Audit trail shows who performed which step and when.
Practical example: role mapping in an SME environment
Company X uses Active Directory. Three groups are created: AD_Debentra_Collector, AD_Debentra_Buchhaltung, AD_Debentra_CFO. Staff from the receivables department are at least in AD_Debentra_Collector; team leaders in AD_Debentra_Buchhaltung; management in AD_Debentra_CFO. When creating a reminder the Collector produces a draft; Accounting performs a formal review in Debentra; for higher amounts the reminder is automatically sent to the CFO role for final approval.
Important: tamper-proof documentation and user control
At each step Debentra should log date, time, user and action. Define rules for immutable retention of approval entries and ensure regular backups of your on‑prem database. Automation may assist, but must leave approval responsibility with humans: therefore configure explicit approval actions instead of tacit mass sends.
Common pitfalls and how to avoid them
- Incorrect search filter: Test filters on a copy of the directory, otherwise you may synchronize accounts by mistake.
- Certificate errors: Pay attention to expiration dates and hostnames; LDAPS connections are sensitive.
- Group latency: Changes in LDAP may become visible with delay. Plan regular sync intervals or on‑demand refresh.
- Missing fallback accounts: Keep a local admin account in Debentra available in case SSO fails.
- Unclear responsibilities: Define clearly who grants which approvals, and document delegation rules.
Editions and Benefits
Debentra is available in the BASIS, PRO and PREMIUM editions. For pure SSO/LDAP connectivity and role mapping, BASIS or PRO are sufficient in many cases. PRO further reduces manual assignment work for open items; PREMIUM offers additional integration options with your accounting if you want to couple approvals with posting processes. Review the desired level of functionality before rollout.
Rollout Plan and Go‑Live
- Pilot phase with selected users: two to four weeks.
- Bug fixing, feedback loops, adjustment of role rules.
- Gradual rollout by department; monitoring of audit logs and support interfaces.
- In‑person training for collectors, accounting and the CFO on the approval routine.
Conclusion
Clean SSO/LDAP integration into your on‑prem Debentra instance creates reliable roles and a traceable approval chain for payment reminders. The balance is important: automation to ease work, but explicit control for approvals. With clear mapping, tests and a phased rollout you reduce sources of error and establish an auditable process that lightens your receivables follow‑up.
Act now: Choose the appropriate edition for your requirements and start the integration. Choose edition: https://debentra.de
Next step
Try Debentra yourself
Central overview and process control for open items and payments with full data sovereignty; reduces manual assignment work (PRO) and enables integrated accounting (PREMIUM); selectable installation and licensing models.