LDAPS
Active DirectoryLDAPS
Configure TLS-encrypted LDAP (port 636) for production AD authentication.
Overview
LDAPS wraps LDAP in TLS. Install a valid certificate on your DC or import the CA chain on the API host. Set AD_LDAP_TLS_REJECT_UNAUTHORIZED=false only for dev/self-signed certs.
Environment
Use ldaps://dc.example.com:636 as AD_LDAP_URL. Open port 636 from the API to the DC.
EnvironmentLDAPS example
AD_LDAP_ENABLED=true AD_LDAP_URL=ldaps://dc.example.com:636 AD_LDAP_BASE_DN=DC=example,DC=com AD_LDAP_BIND_DN=CN=svc-ldap,CN=Users,DC=example,DC=com AD_LDAP_BIND_PASSWORD=your-service-account-password AD_LDAP_TLS_REJECT_UNAUTHORIZED=true AD_LDAP_DEFAULT_ROLES=user