Skip to main content

Configure LDAP as Identity Provider

This guides shows you how to connect an LDAP server as an identity provider in ZITADEL.

info

In ZITADEL you can connect an Identity Provider (IdP) like an LDAP server to your instance and provide it as default to all organizations. Also, you can register the IdP to a specific organization only. If you allow so, your organizations members can do the same in self-service.

How it works​

When you use an LDAP provider in ZITADEL, this is the login process:

  1. ZITADEL tries to connect to the LDAP server with or without TLS depending on the configuration
  2. If the connection fails, the next server in the list will be used to try again.
  3. ZITADEL tries a bind with the BindDN and BindPassword to check if it's possible to proceed
  4. ZITADEL does a SearchQuery to find the UserDN with the provided configuration of base, filters and objectClasses
  5. ZITADEL tries a bind with the provided loginname and password
  6. LDAP attributes get mapped to ZITADEL attributes as provided by the configuration

ZITADEL Configuration​

Add custom login policy​

The login policy can be configured on two levels. Once as default on the instance and this can be overwritten for each organization. The only difference is where you configure it. Go either to the settings page of a specific organization or to the settings page of your instance. Instance: $YOUR-DOMAIN/ui/console/settings?id=general Organization: Choose the organization in the menu and go to $YOUR-DOMAIN/ui/console/org-settings?id=login

  1. Go to the Settings
  2. Modify your login policy in the menu "Login Behavior and Security"
  3. Enable the attribute "External IDP allowed"

Allow External IDP

Go to the IdP Providers Overview​

Go to the settings page of your instance or organization and choose "Identity Providers".

In the table you can see all the providers you have configured. Also, you see all provider templates that are available.

Identity Provider Overview

Select the Active Directory / LDAP Provider template.

Create a new LDAP Provider​

Fill in the following fields in the LDAP template.

caution

We highly recommend to use LDAPS or StartTLS enable servers. Otherwise, your users passwords are sent in clear text through the wire.

Name: Name of the identity provider

Servers: List of servers in a format of "schema://host:port", as example "ldap://localhost:389". If possible, replace "ldap" with "ldaps" with the corresponding port.

BaseDN: BaseDN which will be used with each request to the LDAP server

BindDn and BindPassword: BindDN and password used to connect to the LDAP for the SearchQuery, should be an admin or user with enough permissions to search for the users to login.

Userbase: Base used for the user, normally "dn" but can also be configured.

User filters: Attributes of the user which are "or"-joined in the query for the user, used value is the input of the loginname, for example if you try to login with user@example.com and filters "uid" and "email" the resulting SearchQuery contains "(|(uid=user@example.com)(email=user@example.com))"

User Object Classes: ObjectClasses which are "and"-joined in the SearchQuery and the user has to have in the LDAP.

LDAP Attributes: Mapping of LDAP attributes to ZITADEL attributes, the ID attributes is required, the rest depends on usage of the identity provider

StartTLS: If this setting is enabled after the initial connection ZITADEL tries to build a TLS connection. If your LDAP server doesn't support LDAPS, at least it should support StartTLS.

Timeout: If this setting is set all connection run with a set timeout, if it is 0s the default timeout of 60s is used.

Automatic creation: If this setting is enabled the user will be created automatically within ZITADEL, if it doesn't exist.

Automatic update: If this setting is enabled, the user will be updated within ZITADEL, if some user data is changed withing the provider. E.g if the lastname changes on the LDAP user, the information will be changed on the ZITADEL account on the next login.

Account creation allowed: This setting determines if account creation within ZITADEL is allowed or not.

Account linking allowed: This setting determines if account linking is allowed. When logging in with a LDAP user, a linkable ZITADEL account has to exist already.

info

Either account creation or account linking have to be enabled. Otherwise, the provider can't be used.

LDAP Provider

Activate IdP​

Once you created the provider, it is listed in the providers overview. Activate it by selecting the tick with the tooltip set as available.

Activate the LDAP Provider

Test the setup​

To test the setup, use incognito mode and browse to your login page. You see a new button which redirects you to ZITADELs LDAP login screen.

By default, ZITADEL shows what you define in the instance settings. If you overwrite the instance settings for an organization, you need to send the organization scope in your auth request.

The organization scope looks like this: urn:zitadel:iam:org:id:{id}. You can read more about the reserved scopes or use the ZITADEL OIDC Playground to see what happens with the login when you send different scopes.

LDAP Button

LDAP Login