---
alias: operation-guide-security-portal-strategy-ldap
description: "Sign in users with their account on an LDAP directory server."
---

# LDAP Server

The **LDAP Server** strategy signs in users with their account on an LDAP directory server. The Security Portal finds the user with an LDAP search filter and validates the password against the directory. For Microsoft Active Directory, use the [[operation-guide-security-portal-strategy-activedirectory|Windows Active Directory]] strategy, which matches users in `DOMAIN\user` form.

Before configuring the strategy, collect the address of the LDAP server, the base distinguished name where the user search starts, a user with permission to search the directory, and the search filter that identifies users.

## Configuration

Not available out of the box. Add it to the tenant through a customization package. See [Deployment via CmfEntrypoint](https://developer.criticalmanufacturing.com/explore/guides/customizations/securityportal/configuration/#deployment-via-cmfentrypoint) in the Developer Portal.

### Parameters

| **Strategy type** | **Plugin**                                 |
|-------------------|--------------------------------------------|
| `local-LDAP`      | `@criticalmanufacturing/auth-plugin-local` |

Table: LDAP Server strategy type and plugin

Each strategy entry also accepts the [common strategy properties](../security-portal-configuration/security_portal_config_securityportal.md#common-strategy-properties).

| **Parameter**                       | **Required** | **Description**                                                                                                                                                                  |
|-------------------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `ldap.url`                          | Yes          | Address of the LDAP server, for example `ldap://example.com`. Use an `ldaps://` address to connect over LDAPS.                                                                   |
| `ldap.base`                         | Yes          | Base distinguished name where the search starts, for example `dc=example,dc=com`.                                                                                                |
| `ldap.user`                         | Yes          | User with permission to search the LDAP server.                                                                                                                                  |
| `ldap.password`                     | Yes          | Password of `ldap.user`.                                                                                                                                                         |
| `ldap.searchFilter`                 | No           | [LDAP search filter](https://docs.ldap.com/specs/rfc4515.txt) that finds the user. `{{username}}` is replaced by the user name entered at sign-in. Default: `(cn={{username}})`. |
| `ldap.disableCertificateValidation` | No           | Set to `true` to skip the validation of the LDAPS server certificate. Default: `false`.                                                                                          |
| `ldap.caCertificatePath`            | No           | Path of the CA certificate that validates the LDAPS server certificate. If omitted, the system certificate store is used.                                                        |

Table: LDAP Server strategy parameters

### Example

```json
{
  "id": "LDAP",
  "type": "local-LDAP",
  "config": {
    "ldap": {
      "url": "ldap://<example.com>",
      "base": "dc=<example>,dc=<com>",
      "user": "<User>",
      "password": "<Password>",
      "searchFilter": "(uid={{username}})"
    }
  }
}
```