LDAP Authentication Advanced Configuration

Configuration

This plugin is compatible with DB-less mode.

Compatible protocols

The LDAP Authentication Advanced plugin is compatible with the following protocols:

grpc, grpcs, http, https, ws, wss

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

• name

  string required

  The name of the plugin, in this case ldap-auth-advanced.

• instance_name

  string

  An optional custom name to identify an instance of the plugin, for example ldap-auth-advanced_my-service. Useful when running the same plugin in multiple contexts, for example, on multiple services.

• service.name or service.id

  string

  The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level /plugins endpoint. Not required if using /services/SERVICE_NAME|SERVICE_ID/plugins.

• route.name or route.id

  string

  The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level /plugins endpoint. Not required if using /routes/ROUTE_NAME|ROUTE_ID/plugins.

• enabled

  boolean default: true

  Whether this plugin will be applied.

• config

  record required
  • ldap_host

    string required

    Host on which the LDAP server is running.

  • ldap_password

    string referenceable encrypted

    The password to the LDAP server.

  • ldap_port

    number default: 389

    TCP port where the LDAP server is listening. 389 is the default port for non-SSL LDAP and AD. 636 is the port required for SSL LDAP and AD. If ldaps is configured, you must use port 636.

  • bind_dn

    string referenceable

    The DN to bind to. Used to perform LDAP search of user. This bind_dn should have permissions to search for the user being authenticated.

  • ldaps

    boolean required default: false

    Set it to true to use ldaps, a secure protocol (that can be configured to TLS) to connect to the LDAP server. When ldaps is configured, you must use port 636. If the ldap setting is enabled, ensure the start_tls setting is disabled.

  • start_tls

    boolean required default: false

    Set it to true to issue StartTLS (Transport Layer Security) extended operation over ldap connection. If the start_tls setting is enabled, ensure the ldaps setting is disabled.

  • verify_ldap_host

    boolean required default: false

    Set to true to authenticate LDAP server. The server certificate will be verified according to the CA certificates specified by the lua_ssl_trusted_certificate directive.

  • base_dn

    string required

    Base DN as the starting point for the search; e.g., “dc=example,dc=com”.

  • attribute

    string required

    Attribute to be used to search the user; e.g., “cn”.

  • cache_ttl

    number required default: 60

    Cache expiry time in seconds.

  • hide_credentials

    boolean default: false

    An optional boolean value telling the plugin to hide the credential to the upstream server. It will be removed by Kong before proxying the request.

  • timeout

    number default: 10000

    An optional timeout in milliseconds when waiting for connection with LDAP server.

  • keepalive

    number default: 60000

    An optional value in milliseconds that defines how long an idle connection to LDAP server will live before being closed.

  • anonymous

    string len_min: 0

    An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure 4xx. Note that this value must refer to the consumer id or username attribute, and not its custom_id.

  • header_type

    string default: ldap

    An optional string to use as part of the Authorization header. By default, a valid Authorization header looks like this: Authorization: ldap base64(username:password). If header_type is set to “basic”, then the Authorization header would be Authorization: basic base64(username:password). Note that header_type can take any string, not just "ldap" and "basic".

  • consumer_optional

    boolean default: false

    Whether consumer mapping is optional. If consumer_optional=true, the plugin will not attempt to associate a consumer with the LDAP authenticated user. If consumer_optional=false, LDAP authenticated users can still access upstream resources.

    To prevent access from LDAP users that are not associated with consumers, set consumer_optional=false, set the anonymous field to an existing consumer_id, then use the Request Termination plugin to deny any requests from the anonymous consumer.

  • consumer_by

    array of type string default: username, custom_id Must be one of: username, custom_id

    Whether to authenticate consumers based on username, custom_id, or both.

  • group_base_dn

    string

    Sets a distinguished name (DN) for the entry where LDAP searches for groups begin. This field is case-insensitive.

  • group_name_attribute

    string

    Sets the attribute holding the name of a group, typically called name (in Active Directory) or cn (in OpenLDAP). This field is case-insensitive.

  • group_member_attribute

    string default: memberOf

    Sets the attribute holding the members of the LDAP group. This field is case-sensitive.

  • log_search_results

    boolean default: false

    Displays all the LDAP search results received from the LDAP server for debugging purposes. Not recommended to be enabled in a production environment.

  • groups_required

    array of type string

    The groups required to be present in the LDAP search result for successful authorization. This config parameter works in both AND / OR cases.

    • When ["group1 group2"] are in the same array indices, both group1 AND group2 need to be present in the LDAP search result.
    • When ["group1", "group2"] are in different array indices, either group1 OR group2 need to be present in the LDAP search result.