# Authentik LDAP Provider

**LDAP Provider:** Link: [https://docs.goauthentik.io/add-secure-apps/providers/ldap/](https://docs.goauthentik.io/add-secure-apps/providers/ldap/)

**Create LDAP Provider:** Link: [https://docs.goauthentik.io/add-secure-apps/providers/ldap/create-ldap-provider/](https://docs.goauthentik.io/add-secure-apps/providers/ldap/create-ldap-provider/)

**Outposts:** Link: [https://docs.goauthentik.io/add-secure-apps/outposts/](https://docs.goauthentik.io/add-secure-apps/outposts/)

**Outposts Compose:** link: [https://docs.goauthentik.io/add-secure-apps/outposts/](https://docs.goauthentik.io/add-secure-apps/outposts/)

<div class="theme-doc-markdown markdown" id="bkmrk-create-an-ldap-provi"><header>### Create an LDAP provider

</header></div>Creating an authentik LDAP provider requires the following steps:

<div class="theme-doc-markdown markdown" id="bkmrk-create-an-ldap-authe">1. [Create an LDAP authentication flow *(optional)*](https://docs.goauthentik.io/add-secure-apps/providers/ldap/create-ldap-provider/#create-an-ldap-authentication-flow-optional)
2. [Create an LDAP application and provider](https://docs.goauthentik.io/add-secure-apps/providers/ldap/create-ldap-provider/#create-an-ldap-application-and-provider)
3. [Create a service account and assign the LDAP search permission](https://docs.goauthentik.io/add-secure-apps/providers/ldap/create-ldap-provider/#create-a-service-account)
4. [Create an LDAP Outpost](https://docs.goauthentik.io/add-secure-apps/providers/ldap/create-ldap-provider/#create-an-ldap-outpost)

</div>### Create an LDAP authentication flow *(optional)*

The `default-authentication-flow` validates MFA by default. Duo, TOTP, and static authenticators are supported by the LDAP provider. WebAuthn and SMS are not supported.

If you plan to use only dedicated service accounts to bind to LDAP, or only use LDAP supported MFA authenticators, then you can use the default authentication flow and skip this section and continue with the [Create an LDAP application and provider](https://docs.goauthentik.io/add-secure-apps/providers/ldap/create-ldap-provider/#create-an-ldap-application-and-provider) section.

Refer to [Code-Based MFA support](https://docs.goauthentik.io/add-secure-apps/providers/ldap/#code-based-mfa-support) for more information on LDAP and MFA.

### Create custom stages

You'll need to create the stages that make up the flow.

<div class="theme-doc-markdown markdown" id="bkmrk-log-in-to-authentik-">1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** &gt; **Stages**, and click **Create**.

</div>#### Password Stage

First, you'll need to create a Password Stage.

<div class="theme-doc-markdown markdown" id="bkmrk-select-password-stag">3. Select **Password Stage** as the stage type, click **Next**, and set the following required configurations: 
    - Provide a **Name** for the stage (e.g. `ldap-authentication-password-stage`).
    - For **Backends**, leave the default settings.
4. Click **Finish**

</div>#### Identification Stage

Next, you'll need to create an Identification Stage.

<div class="theme-doc-markdown markdown" id="bkmrk-on-the-stages-page%2C-">5. On the **Stages** page, click **Create**.
6. Select **Identification Stage** as the stage type, click **Next**, and set the following required configurations: 
    - Provide a **Name** for the stage (e.g. `ldap-identification-stage`).
    - For **User fields**, select `Username` and `Email` (and UPN if it is relevant to your setup).
    - Set **Password stage** to the Password Stage created in the previous section (e.g. `ldap-authentication-password-stage`)
7. Click **Finish**

</div>#### User Login Stage

Finally, you'll need to create a User Login Stage.

<div class="theme-doc-markdown markdown" id="bkmrk-on-the-stages-page%2C--1">8. On the **Stages** page, click **Create**.
9. Select **User Login Stage** as the stage type, click **Next**, and set the following required configurations: 
    - Provide a **Name** for the stage (e.g. `ldap-authentication-login-stage`).
10. Click **Finish**

</div>### Create an LDAP authentication flow

Now you'll need to create the LDAP authentication flow and bind the previously created stages.

<div class="theme-doc-markdown markdown" id="bkmrk-log-in-to-authentik--1">1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** &gt; **Flows**, click **Create**, and set the following required configurations: 
    - Provide a **Name**, **Title** and **Slug** for the flow (e.g. `ldap-authentication-flow`).
    - Set **Designation** to `Authentication`.
3. Click **Create**.
4. Click the name of the newly created flow, open the **Stage Bindings** tab, and click **Bind existing stage**.
5. Select the previously created LDAP Identification Stage (e.g.`ldap-identification-stage`), set the order to `10`, and click **Create**.
6. Click **Bind existing stage**.
7. Select the previously created LDAP User Login Stage (e.g.`ldap-authentication-login-stage`), set the order to `30`, and click **Create**.

</div>## Create an LDAP application and provider

The LDAP application and provider can now be created.

<div class="theme-doc-markdown markdown" id="bkmrk-log-in-to-authentik--2">1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** &gt; **Applications**, click **Create with Provider** to create an application and provider pair.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select **LDAP Provider** as the **Provider Type**, and then click **Next**.
5. On the **Configure LDAP Provider** page, provide the configuration settings and then click **Submit** to create both the application and the provider.

<div class="theme-admonition theme-admonition-info admonition_WCGJ alert alert--info"><div class="admonitionContent_pbrs">**INFO**</div></div></div>If you followed the optional [Create an LDAP authentication flow](https://docs.goauthentik.io/add-secure-apps/providers/ldap/create-ldap-provider/#create-an-ldap-authentication-flow-optional) section, ensure that you set **Bind flow** to newly created authentication flow (e.g. `ldap-authentication-flow`).

## Create a service account

Create a service account to bind to LDAP with.

<div class="theme-doc-markdown markdown" id="bkmrk-log-in-to-authentik--3">1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** &gt; **Users** and click **New User**.
3. Provide a name for the service account (e.g. `ldapservice`) and click **Create**.
4. Click the name of the newly created service account.
5. Under **Recovery**, click **Set password**, provide a secure password for the account, and click **Update password**.

<div class="theme-admonition theme-admonition-info admonition_WCGJ alert alert--info"><div class="admonitionHeading_GCBg">**Default DN of service account**</div></div></div>The default DN of this user will be `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io`

### Assign the LDAP search permission to the service account

The service account needs permissions to search the LDAP directory. You'll need to create a role with the permission and assign the service account to that role.

<div class="theme-doc-markdown markdown" id="bkmrk-log-in-to-authentik--4">1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** &gt; **Roles** and click **Create**.
3. Provide a name for the role (e.g. `LDAP search`) and then click **Create**.
4. Click on the newly created role and open the **Users** tab.
5. Click **Add existing user**, select the service account, and then click **Assign**.
6. Navigate to **Applications** &gt; **Providers**.
7. Click on the name of the newly created LDAP provider and open the **Permissions** tab.
8. Click **Assign Object Permissions**.
9. Select the role that you created (e.g. `LDAP search`), enable the **Search full LDAP directory** permission, and then click **Assign**.

</div>## Create an LDAP Outpost

The LDAP provider requires the deployment of an LDAP [Outpost](https://docs.goauthentik.io/add-secure-apps/outposts/).

<div class="theme-doc-markdown markdown" id="bkmrk-log-in-to-authentik--5">1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** &gt; **Outposts**, click **Create** and set the following required configurations:
    
    
    - Provide a **Name** for the outpost (e.g. `LDAP Outpost').
    - Set the **Type** as `LDAP`.
    - Set **Integration** to match your deployment method or manually deploy an outpost via [Docker-Compose](https://docs.goauthentik.io/add-secure-apps/outposts/manual-deploy-docker-compose/) or [Kubernetes](https://docs.goauthentik.io/add-secure-apps/outposts/manual-deploy-kubernetes/). For more information, refer to the [Outpost documentation](https://docs.goauthentik.io/add-secure-apps/outposts/).
    - Under **Applications**, select the LDAP application created in the previous section.
    - Under **Advanced settings**, set the required outpost configurations. For more information, refer to [Outpost Configuration](https://docs.goauthentik.io/add-secure-apps/outposts/#configuration)
3. Click **Create**.

<div class="theme-admonition theme-admonition-warning admonition_WCGJ alert alert--warning"><div class="admonitionContent_pbrs">**Multiple LDAP providers**</div></div></div>The LDAP Outpost selects different providers based on their Base DN. Adding multiple providers with the same Base DN will result in inconsistent access.

## Configuration verification

You can test the LDAP provider by using the `ldapsearch` tool on Linux and macOS, or the `dsquery` tool on Windows.

<div class="theme-doc-markdown markdown" id="bkmrk-ldapsearch-dsquery"><div class="theme-tabs-container tabs-container tabList_J5MA">- ldapsearch
- dsquery

<div class="margin-top--md"><div class="tabItem_wHwb" role="tabpanel">  
</div></div></div></div>To install the `ldapsearch` tool, use one of the following commands:

```shell
sudo apt-get install ldap-utils -y # Debian-based systems
sudo yum install openldap-clients -y # CentOS-based systems
brew install openldap #macOS based systems (requires Homebrew to be installed)
```

<div class="theme-doc-markdown markdown" id="bkmrk-"><div class="theme-tabs-container tabs-container tabList_J5MA"><div class="margin-top--md"><div class="tabItem_wHwb" role="tabpanel"><div class="language-shell codeBlockContainer_mQmQ theme-code-block"><div class="codeBlockContent_t_Hd"><div class="buttonGroup_B0hJ">  
</div></div></div></div></div></div></div>To search the LDAP directory using the previously created `ldapservice` service account, use the following command:

```shell
ldapsearch \
  -x \
  -H ldap://<LDAP outpost IP address>:389 \
  -D 'cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io' \
  -w '<ldapuserpassword>' \
  -b 'DC=ldap,DC=goauthentik,DC=io' \
  '(objectClass=user)'
```

This example query will return all users and log the first successful attempt in an event in **Events** &gt; **Logs**. Subsequent successful logins from the same user are not logged by default, as they are cached in the outpost. For more details see [Bind modes](https://docs.goauthentik.io/add-secure-apps/providers/ldap/#bind-modes).

<div class="theme-doc-markdown markdown" id="bkmrk-ldaps"><div class="theme-tabs-container tabs-container tabList_J5MA"><div class="margin-top--md"><div class="tabItem_wHwb" role="tabpanel"><div class="theme-admonition theme-admonition-warning admonition_WCGJ alert alert--warning"><div class="admonitionContent_pbrs">**LDAPS**</div></div></div></div></div></div>In production it is recommended to use LDAPS, which requires `ldaps://` as the protocol, and port number `636` rather than `389`. See [LDAPS](https://docs.goauthentik.io/add-secure-apps/providers/ldap/#ldaps-via-ssl-or-starttls) for more information.

<footer class="theme-doc-footer docusaurus-mt-lg" id="bkmrk--1">---

</footer>