# Using LDAP for Authentication

| Environment Variable      | Description                                                                                                                                                                                                                               | Default Value | Other                                                                                          |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ---------------------------------------------------------------------------------------------- |
| LDAP_ENABLE               | Whether to enable LDAP login service                                                                                                                                                                                                      |               | Set to true to enable                                                                          |
| LDAP_URL                  | The address of the LDAP service in the format ldap://ip:port. For example, ldap://127.0.0.1:389                                                                                                                                           |               | Required when LDAP is enabled                                                                  |
| LDAP_BIND_USER            | The account used to connect to LDAP. For example, cn=admin,dc=example,dc=org                                                                                                                                                              |               | Required when LDAP is enabled                                                                  |
| LDAP_BIND_PASSWORD        | The password used to connect to LDAP. When anonymous access is disabled in LDAP, the administrator account and password must be configured                                                                                                |               | Required when LDAP is enabled                                                                  |
| LDAP_BASE_DN              | LDAP Base DN, the Base Dn used for LDAP username retrieval. For example, dc=example,dc=org                                                                                                                                                |               | Required when LDAP is enabled                                                                  |
| LDAP_USER_ID_ATTR         | Default is dn, based on the standard openldap LDAP service, which has a unique dn field used as the unique id for ldap user attributes; if there is a username or email, you can also configure the username (name) or email (mail)       | dn            | Required when LDAP is enabled, if there is an email field, it is recommended to use mail first |
| LDAP_LOGIN_TITLE          | Default is LDAP Login, the form name on the login page                                                                                                                                                                                    | LDAP Login    | Optional                                                                                       |
| LDAP_USERNAME_ATTR        | Used for username login, search, and display. It is recommended to keep it unique. If it appears duplicated, a random number will be added after the username. By default, it will take the uid field of openldap's standard LDAP service | uid           | Optional                                                                                       |
| LDAP_USER_EMAIL_ATTR      | Email field used for login and search. By default, it will take the mail attribute of openldap's standard LDAP service. Private users can choose not to configure mail, and using username login will not be affected                     | mail          | Optional                                                                                       |
| LDAP_EMPLOYEE_NUMBER_ATTR | Mapping field for employee number, can be used for search                                                                                                                                                                                 |               | Optional                                                                                       |
| LDAP_SEARCH_FILTER        | Search filter for ldap service                                                                                                                                                                                                            |               | Optional                                                                                       |

### Configuration Example

```
- name: LDAP_ENABLE
  value: 'true'
- name: LDAP_URL
  value: >-
    ldap://192.168.10.64:389
- name: LDAP_BIND_USER
  value: >-
    CN=Administrators,CN=Users,DC=apidog,DC=com
- name: LDAP_BIND_PASSWORD
  value: <secret>
- name: LDAP_BASE_DN
  value: DC=apidog,DC=com
- name: LDAP_LOGIN_TITLE
  value: Continue with LDAP
- name: LDAP_USER_ID_ATTR
  value: sAMAccountName
- name: LDAP_USERNAME_ATTR
  value: sAMAccountName
- name: LDAP_EMPLOYEE_NUMBER_ATTR
  value: uidNumber
- name: LDAP_USER_EMAIL_ATTR
  value: mail
- name: LDAP_SEARCH_FILTER
  value: '(&(sAMAccountName={{username}}))'
```


## FAQs on LDAP Authentication

1. If you are using Active Directory (Microsoft AD Server Edition), it is recommended to configure the following search filter:
     - `LDAP_SEARCH_FILTER='(&(sAMAccountName={{username}}))'`
2. If you're using **Active Directory synchronization mode**, consider switching to a different **domain controller** for improved performance and reliability.
3. To restrict login to members of a specific group in LDAP, configure the search filter as follows: 
        
        `LDAP_SEARCH_FILTER='(&(sAMAccountName={{username}})(memberOf=......))'`, 
        
        For-example:

    ```shell
    LDAP_SEARCH_FILTER='(&(sAMAccountName={{username}})(memberOf=CN=g.some_group,OU=Distribution Groups,OU=Groups,OU=Corp,OU=Common,DC=example,DC=com))'
    ```