LDAP or SAML for ECM integration with Active Directory?

The recommended approach is to separate authentication from identity lifecycle management: use SAML (or preferably OIDC) for SSO/authentication and SCIM or LDAP/LDAPS for synchronizing users and groups with the ECM. For modern ECM platforms, SAML/OIDC + SCIM is preferred; for legacy on-premises systems, SAML + LDAP/LDAPS is a practical hybrid, with AD/Entra groups mapped to ECM roles for RBAC.

Use both - they solve different problems, not competing ones. LDAP (ideally LDAPS) syncs users and AD group memberships into the ECM, and you map those groups to roles, which is what actually drives your RBAC. SAML (via ADFS or Azure AD/Entra ID) handles authentication and gives users SSO instead of a separate password. LDAP alone gets you accurate roles but no SSO; SAML alone gets you SSO but no automated way to keep group-based permissions in sync, so you'd end up managing access manually. In practice, deployments pair SAML for login with LDAP for the backend sync, test that disabled AD accounts lose ECM access promptly, and consider SCIM as a more modern alternative to LDAP if you're moving to Azure AD/Entra ID.

In most enterprise deployments, using both LDAP and SAML provides the best balance. LDAP is ideal for synchronizing users, groups, and role information from Active Directory, while SAML handles secure Single Sign-On (SSO), improving both user experience and security. This separation of responsibilities is a common best practice for ECM platforms, especially when centralized identity management and role-based access control are required.