LDAP Server#

The LDAP Server strategy signs in users with their account on an LDAP directory server. The Security Portal finds the user with an LDAP search filter and validates the password against the directory. For Microsoft Active Directory, use the Windows Active Directory strategy, which matches users in DOMAIN\user form.

Before configuring the strategy, collect the address of the LDAP server, the base distinguished name where the user search starts, a user with permission to search the directory, and the search filter that identifies users.

Configuration#

Not available out of the box. Add it to the tenant through a customization package. See Deployment via CmfEntrypoint ↗ in the Developer Portal.

Parameters#

Strategy type	Plugin
`local-LDAP`	`@criticalmanufacturing/auth-plugin-local`

Table: LDAP Server strategy type and plugin

Each strategy entry also accepts the common strategy properties.

Parameter	Required	Description
`ldap.url`	Yes	Address of the LDAP server, for example `ldap://example.com`. Use an `ldaps://` address to connect over LDAPS.
`ldap.base`	Yes	Base distinguished name where the search starts, for example `dc=example,dc=com`.
`ldap.user`	Yes	User with permission to search the LDAP server.
`ldap.password`	Yes	Password of `ldap.user`.
`ldap.searchFilter`	No	LDAP search filter ↗ that finds the user. `{{ username }}` is replaced by the user name entered at sign-in. Default: `(cn={{ username }})`.
`ldap.disableCertificateValidation`	No	Set to `true` to skip the validation of the LDAPS server certificate. Default: `false`.
`ldap.caCertificatePath`	No	Path of the CA certificate that validates the LDAPS server certificate. If omitted, the system certificate store is used.

Table: LDAP Server strategy parameters

Example#

{
  "id": "LDAP",
  "type": "local-LDAP",
  "config": {
    "ldap": {
      "url": "ldap://<example.com>",
      "base": "dc=<example>,dc=<com>",
      "user": "<User>",
      "password": "<Password>",
      "searchFilter": "(uid={{ username }})"
    }
  }
}