You are browsing documentation for an outdated plugin version.
Configuration
This plugin is compatible with DB-less mode.
Compatible protocols
The LDAP Authentication Advanced plugin is compatible with the following protocols:
grpc
, grpcs
, http
, https
, ws
, wss
Parameters
Here's a list of all the parameters which can be used in this plugin's configuration:
-
string required
The name of the plugin, in this case
ldap-auth-advanced
.- If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is
name
. - If using the KongPlugin object in Kubernetes, the field is
plugin
.
- If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is
-
string
The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level
/plugins
endpoint. Not required if using/services/{serviceName|Id}/plugins
. -
string
The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level
/plugins
endpoint. Not required if using/routes/{routeName|Id}/plugins
. -
boolean default:
true
Whether this plugin will be applied.
-
record required
-
string required
Host on which the LDAP server is running.
-
string referenceable encrypted
The password to the LDAP server.
-
number default:
389
TCP port where the LDAP server is listening. 389 is the default port for non-SSL LDAP and AD. 636 is the port required for SSL LDAP and AD. If
ldaps
is configured, you must use port 636.
-
string referenceable
The DN to bind to. Used to perform LDAP search of user. This
bind_dn
should have permissions to search for the user being authenticated.
-
boolean required default:
false
Set it to
true
to useldaps
, a secure protocol (that can be configured to TLS) to connect to the LDAP server. Whenldaps
is configured, you must use port 636. If theldap
setting is enabled, ensure thestart_tls
setting is disabled.
-
boolean required default:
false
Set it to
true
to issue StartTLS (Transport Layer Security) extended operation overldap
connection. If thestart_tls
setting is enabled, ensure theldaps
setting is disabled.
-
boolean required default:
false
Set to
true
to authenticate LDAP server. The server certificate will be verified according to the CA certificates specified by thelua_ssl_trusted_certificate
directive.
-
string required
Base DN as the starting point for the search; e.g., “dc=example,dc=com”.
-
string required
Attribute to be used to search the user; e.g., “cn”.
-
number required default:
60
Cache expiry time in seconds.
-
boolean default:
false
An optional boolean value telling the plugin to hide the credential to the upstream server. It will be removed by Kong before proxying the request.
-
number default:
10000
An optional timeout in milliseconds when waiting for connection with LDAP server.
-
number default:
60000
An optional value in milliseconds that defines how long an idle connection to LDAP server will live before being closed.
-
string len_min:
0
An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure
4xx
. Note that this value must refer to the consumerid
orusername
attribute, and not itscustom_id
.
-
string default:
ldap
An optional string to use as part of the Authorization header. By default, a valid Authorization header looks like this:
Authorization: ldap base64(username:password)
. Ifheader_type
is set to “basic”, then the Authorization header would beAuthorization: basic base64(username:password)
. Note thatheader_type
can take any string, not just"ldap"
and"basic"
.
-
boolean default:
false
Whether consumer mapping is optional. If
consumer_optional=true
, the plugin will not attempt to associate a consumer with the LDAP authenticated user. Ifconsumer_optional=false
, LDAP authenticated users can still access upstream resources.To prevent access from LDAP users that are not associated with consumers, set
consumer_optional=false
, set theanonymous
field to an existingconsumer_id
, then use the Request Termination plugin to deny any requests from the anonymous consumer.
-
array of type
string
default:username, custom_id
Must be one of:username
,custom_id
Whether to authenticate consumers based on
username
,custom_id
, or both.
-
string
Sets a distinguished name (DN) for the entry where LDAP searches for groups begin. This field is case-insensitive.
-
string
Sets the attribute holding the name of a group, typically called
name
(in Active Directory) orcn
(in OpenLDAP). This field is case-insensitive.
-
string default:
memberOf
Sets the attribute holding the members of the LDAP group. This field is case-sensitive.
-
boolean default:
false
Displays all the LDAP search results received from the LDAP server for debugging purposes. Not recommended to be enabled in a production environment.
-
array of type
string
The groups required to be present in the LDAP search result for successful authorization. This config parameter works in both AND / OR cases.
- When
["group1 group2"]
are in the same array indices, bothgroup1
ANDgroup2
need to be present in the LDAP search result. - When
["group1", "group2"]
are in different array indices, eithergroup1
ORgroup2
need to be present in the LDAP search result.
- When
-