Using LDAP for Authentication

Environment Variable	Description	Default Value	Other
LDAP_ENABLE	Whether to enable LDAP login service		Set to true to enable
LDAP_URL	The address of the LDAP service in the format ldap://ip:port. For example, ldap://127.0.0.1:389		Required when LDAP is enabled
LDAP_BIND_USER	The account used to connect to LDAP. For example, cn=admin,dc=example,dc=org		Required when LDAP is enabled
LDAP_BIND_PASSWORD	The password used to connect to LDAP. When anonymous access is disabled in LDAP, the administrator account and password must be configured		Required when LDAP is enabled
LDAP_BASE_DN	LDAP Base DN, the Base Dn used for LDAP username retrieval. For example, dc=example,dc=org		Required when LDAP is enabled
LDAP_USER_ID_ATTR	Default is dn, based on the standard openldap LDAP service, which has a unique dn field used as the unique id for ldap user attributes; if there is a username or email, you can also configure the username (name) or email (mail)	dn	Required when LDAP is enabled, if there is an email field, it is recommended to use mail first
LDAP_LOGIN_TITLE	Default is LDAP Login, the form name on the login page	LDAP Login	Optional
LDAP_USERNAME_ATTR	Used for username login, search, and display. It is recommended to keep it unique. If it appears duplicated, a random number will be added after the username. By default, it will take the uid field of openldap's standard LDAP service	uid	Optional
LDAP_USER_EMAIL_ATTR	Email field used for login and search. By default, it will take the mail attribute of openldap's standard LDAP service. Private users can choose not to configure mail, and using username login will not be affected	mail	Optional
LDAP_EMPLOYEE_NUMBER_ATTR	Mapping field for employee number, can be used for search		Optional
LDAP_SEARCH_FILTER	Search filter for ldap service		Optional

Configuration Example

- name: LDAP_ENABLE
  value: 'true'
- name: LDAP_URL
  value: >-
    ldap://192.168.10.64:389
- name: LDAP_BIND_USER
  value: >-
    CN=Administrators,CN=Users,DC=apidog,DC=com
- name: LDAP_BIND_PASSWORD
  value: <secret>
- name: LDAP_BASE_DN
  value: DC=apidog,DC=com
- name: LDAP_LOGIN_TITLE
  value: Continue with LDAP
- name: LDAP_USER_ID_ATTR
  value: sAMAccountName
- name: LDAP_USERNAME_ATTR
  value: sAMAccountName
- name: LDAP_EMPLOYEE_NUMBER_ATTR
  value: uidNumber
- name: LDAP_USER_EMAIL_ATTR
  value: mail
- name: LDAP_SEARCH_FILTER
  value: '(&(sAMAccountName={{username}}))'

FAQs on LDAP Authentication

If you are using Active Directory (Microsoft AD Server Edition), it is recommended to configure the following search filter:

LDAP_SEARCH_FILTER='(&(sAMAccountName={{username}}))'

If you're using Active Directory synchronization mode, consider switching to a different domain controller for improved performance and reliability.

To restrict login to members of a specific group in LDAP, configure the search filter as follows:

LDAP_SEARCH_FILTER='(&(sAMAccountName={{username}})(memberOf=......))',

For-example:

Configuration Example#

FAQs on LDAP Authentication#

Configuration Example

FAQs on LDAP Authentication