authentik/website/docs/providers/ldap/generic_setup.md

title

title
Create an LDAP provider

Create Service account

1. Create a new user account to bind with under Directory -> Users -> Create, in this example called ldapservice.

   Note the DN of this user will be cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io

:::info Note: The default-authentication-flow validates MFA by default, and currently everything but SMS-based devices and WebAuthn devices are supported by LDAP. If you plan to use only dedicated service accounts to bind to LDAP, or don't use SMS-based authenticators, then you can use the default flow and skip the extra steps below and continue at Create LDAP Application & Provider :::

LDAP Flow

Create Custom Stages

1. Create a new identification stage. Flows & Stage -> Stages -> Create
2. Name it ldap-identification-stage. Select User fields Username and Email (and UPN if it is relevant to your setup).
3. Create a new password stage. Flows & Stage -> Stages -> Create
4. Name it ldap-authentication-password. Leave the defaults for Backends.
5. Create a new user login stage. Flows & Stage -> Stages -> Create
6. Name it ldap-authentication-login.

Create Custom Flow

1. Create a new authentication flow under Flows & Stage -> Flows -> Create, and name it ldap-authentication-flow
2. Click the newly created flow and choose Stage Bindings.
3. Click Bind Stage choose ldap-identification-stage and set the order to 10.
4. Click Bind Stage choose ldap-authentication-login and set the order to 30.
5. Edit the ldap-identification-stage.
6. Change the Password stage to ldap-authentication-password.

Create LDAP Application & Provider

1. Create the LDAP Application under Applications -> Applications -> Create With Wizard and name it LDAP.

Assign LDAP permissions

1. Navigate to the LDAP Provider under Applications -> Providers -> Provider for LDAP.
2. Switch to the Permissions tab.
3. Click the Assign to new user button to select a user to assign the full directory search permission to.
4. Select the ldapservice user in the modal by typing in its username. Select the Search full LDAP directory permission and click Assign

Create LDAP Outpost

1. Create (or update) the LDAP Outpost under Applications -> Outposts -> Create. Set the Type to LDAP and choose the LDAP application created in the previous step.

:::info The LDAP Outpost selects different providers based on their Base DN. Adding multiple providers with the same Base DN will result in inconsistent access :::

ldapsearch Test

Test connectivity by using ldapsearch.

:::info ldapsearch can be installed on Linux system with these commands

sudo apt-get install ldap-utils -y # Debian-based systems
sudo yum install openldap-clients -y # CentOS-based systems

:::

ldapsearch \
  -x \
  -H ldap://<LDAP Outpost IP address>:<Port number 389> \ # In production it is recommended to use SSL, which also requires `ldaps://` as the protocol and the SSL port
  -D 'cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io' \
  -w '<ldapuserpassword>' \
  -b 'DC=ldap,DC=goauthentik,DC=io' \
  '(objectClass=user)'

:::info This query will log the first successful attempt in an event in the Events -> Logs area, further successful logins from the same user are not logged as they are cached in the outpost. :::