LDAP

Active DirectoryLDAP

Configure plain LDAP (port 389) against your domain controller for development or trusted networks.

Overview

LDAP sends credentials without TLS by default. Use only on trusted networks or when LDAP signing/channel binding is enforced. For production, prefer LDAPS.

Environment

Point AD_LDAP_URL at your DC with the ldap:// scheme. Ensure port 389 is reachable from the API host.

EnvironmentLDAP example
AD_LDAP_ENABLED=true
AD_LDAP_URL=ldap://dc.example.com:389
AD_LDAP_BASE_DN=DC=example,DC=com
AD_LDAP_BIND_DN=CN=svc-ldap,CN=Users,DC=example,DC=com
AD_LDAP_BIND_PASSWORD=your-service-account-password
AD_LDAP_DEFAULT_ROLES=user

Related guides

Active Directory hubLDAPS guide →