Concerned about Okta's acquisition of Auth0?   Learn how to migrate from Auth0 to FusionAuth

FusionAuth logo
FusionAuth logo
  • Features
    FusionAuth Reactor

    FusionAuth Reactor is a powerful suite of features developed to extend FusionAuth's core functionality.

    • Flexible Architecture   Flexible Architecture
    • Auth the Way You Want It   Auth the Way You Want It
    • Security & Compliance   Security & Compliance
    • Ultimate Password Control   Ultimate Password Control
    • Customizable User Experience   Customizable User Experience
    • Advanced Registration Forms   Advanced Registration Forms
    • Built for Devs   Built for Devs
    • User Management & Reporting   User Management & Reporting
    • Scalability   Scalability
    • Single Sign-on   Single Sign-on
    • Breached Password Detection   Breached Password Detection
    • Connectors   Connectors
    • FusionAuth Reactor   FusionAuth Reactor
  • Pricing
    Cloud Pricing

    Let us host, monitor, manage, and maintain your deployments in your own private cloud.

    SEE PRICING cloud pricing   See FusionAuth Cloud Pricing
    Editions Pricing

    A powerful set of features with available support that extends FusionAuth's core functionality.

    SEE PRICING edition pricing   See FusionAuth Edition Pricing
    Editions + Cloud

    FusionAuth will handle everything so you can get back to building something awesome.

    GET STARTED Get started
  • Docs
  • Downloads
  • Resources
    FusionAuth Resources
    • Upgrade from SaaS
    • Upgrade from Open Source
    • Upgrade from Home Grown
    • Blog   Blog
    • Forum   Forum
    • Community & Support   Community & Support
    • Customer & Partners   Customers & Partners
    • Video & Podcasts   Videos & Podcasts
    • Getting Started   Getting Started
    • Auth0 Migration   Migrate from Auth0
  • Expert Advice
    Expert Advice for Developers

    Learn everything you need to know about authentication, authorization, identity, and access management from our team of industry experts.

    • Authentication   Authentication
    • CIAM   CIAM
    • Identity Basics   Identity Basics
    • OAuth   OAuth
    • Security   Security
    • Tokens   Tokens
    • Dev Tools   Dev Tools
  • Account
Navigate to...
  • Welcome
  • Getting Started
  • 5-Minute Setup Guide
  • Reactor
  • Core Concepts
    • Overview
    • Users
    • Roles
    • Groups
    • Entity Management
    • Registrations
    • Applications
    • Tenants
    • Identity Providers
    • Search
    • Authentication and Authorization
    • Integration Points
    • Localization and Internationalization
    • Roadmap
  • Installation Guide
    • Overview
    • System Requirements
    • Server Layout
    • Cloud
    • Cluster
    • Docker
    • Fast Path
    • Kickstart™
    • Homebrew
    • Packages
    • Database
    • FusionAuth App
    • FusionAuth Search
    • Securing
    • Upgrading
  • APIs
    • Overview
    • Authentication
    • Errors
    • Actioning Users
    • Applications
    • Audit Logs
    • Connectors
      • Overview
      • Generic
      • LDAP
    • Consent
    • Emails
    • Entity Types
    • Event Logs
    • Families
    • Forms
    • Form Fields
    • Groups
    • Identity Providers
      • Overview
      • Apple
      • Facebook
      • Google
      • HYPR
      • LinkedIn
      • Twitter
      • OpenID Connect
      • SAML v2
      • External JWT
    • Integrations
    • JWT
    • Keys
    • Lambdas
    • Login
    • Passwordless
    • Registrations
    • Reports
    • System
    • Tenants
    • Themes
    • Two Factor
    • Users
    • User Actions
    • User Action Reasons
    • User Comments
    • Webhooks
  • Client Libraries
    • Overview
    • Dart
    • Go
    • Java
    • JavaScript
    • .NET Core
    • Node
    • PHP
    • Python
    • Ruby
    • Typescript
  • Themes
    • Overview
    • Localization
    • Examples
  • Email & Templates
    • Overview
    • Configure Email
    • Email Templates
  • Events & Webhooks
    • Overview
    • Events
    • Writing a Webhook
    • Securing Webhooks
  • Example Apps
    • Overview
    • Go
    • Java
    • JavaScript
    • .NET Core
    • PHP
    • Python
    • Ruby
  • Lambdas
    • Overview
    • Apple Reconcile
    • External JWT Reconcile
    • Facebook Reconcile
    • Google Reconcile
    • HYPR Reconcile
    • JWT Populate
    • LDAP Connector Reconcile
    • LinkedIn Reconcile
    • OpenID Connect Reconcile
    • SAML v2 Populate
    • SAML v2 Reconcile
    • Twitter Reconcile
  • Identity Providers
    • Overview
    • Apple
    • Facebook
    • Google
    • HYPR
    • LinkedIn
    • Twitter
    • OpenID Connect
      • Overview
      • Azure AD
      • Github
      • Discord
    • SAML v2
      • Overview
      • ADFS
    • External JWT
      • Overview
      • Example
  • Connectors
    • Overview
    • Generic Connector
    • LDAP Connector
    • FusionAuth Connector
  • Integrations
    • Overview
    • CleanSpeak
    • Kafka
    • Twilio
  • OpenID Connect & OAuth 2.0
    • Overview
    • Endpoints
    • Tokens
  • SAML v2 IdP
    • Overview
    • Google
    • Zendesk
  • Plugins
    • Writing a Plugin
    • Password Encryptors
  • Guides
    • Overview
    • Advanced Registration Forms
    • Breached Password Detection
    • Migration
    • Migration From Auth0
    • Passwordless
    • Securing Your APIs
    • Silent Mode
    • Single Sign-on
  • Tutorials
    • Overview
    • Setup Wizard & First Login
    • Register/Login a User
    • Migrate Users
    • JSON Web Tokens
    • Authentication Tokens
    • Start and Stop FusionAuth
    • Switch Search Engines
    • User Account Lockout
    • Two Factor
  • Reference
    • CORS
    • Configuration
    • Data Types
    • Known Limitations
    • Password Encryptors
  • Release Notes
  • Troubleshooting

LDAP Connector APIs

Overview

This API has been available since 1.18.0

The following APIs are provided to manage LDAP Connectors.

Operations

  • Create the LDAP Connector

  • Retrieve the LDAP Connector

  • Update the LDAP Connector

  • Delete the LDAP Connector

Create the LDAP Connector

Request

Create a LDAP Connector with a randomly generated Id.

URI

POST /api/connector

Create a LDAP Connector with the provided unique Id.

URI

POST /api/connector/{connectorId}

The type in the request JSON is used to determine that you are creating a LDAP Connector.

Request Parameters

connectorId [UUID] Optional defaults to secure random UUID

The Id to use for the new Connector. If not specified a secure random UUID will be generated.

Request Body

connector.authenticationURL [String] Required

The fully qualified LDAP URL to authenticate.

connector.baseStructure [String] Required

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout [Integer] Required

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connect.data [Object] Optional

An object that can hold any information about the Connector that should be persisted.

connector.debug [Boolean] Optional defaults to false

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.identifyingAttribute [String] Required

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.lambdaConfiguration.reconcileId [UUID] Required

The Id of an existing Lambda. The lambda is executed after the user authenticates with the connector. This lambda can create a user, registrations, and group memberships in FusionAuth based on attributes returned from the connector.

connector.loginIdAttribute [String] Required

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name [String] Required

The unique LDAP Connector name.

connector.readTimeout [Integer] Required

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes [Array<String>] Required

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod [String] Required

The LDAP security method. Possible values are:

  • None - Requests will be made without encryption.

  • LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.

  • StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN [String] Required

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword [String] Required

The password of an entry that has read access to the directory.

connector.type [String] Required

This field must be set to LDAP.

Example LDAP Connector Request JSON
{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "debug": true,
    "identifyingAttribute": "uid",
    "lambdaConfiguration": {
      "reconcileId": "b3360a2d-e81d-4314-b9f1-244a916ca52f"
    },
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Response

Table 1. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

connector.authenticationURL [String]

The fully qualified LDAP URL to authenticate.

connector.baseStructure [String]

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout [Integer]

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connect.data [Object]

An object that can hold any information about the Connector that should be persisted.

connector.debug [Boolean] [default]#

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.id [UUID]

The unique Id of the LDAP Connector.

connector.identifyingAttribute [String]

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstant [Long]

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileId [UUID]

The Id of an existing Lambda. The lambda is executed after the user authenticates with the connector. This lambda can create a user, registrations, and group memberships in FusionAuth based on attributes returned from the connector.

connector.lastUpdateInstant [Long]

The instant when the LDAP Connector was last updated.

connector.loginIdAttribute [String]

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name [String]

The unique LDAP Connector name.

connector.readTimeout [Integer]

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes [Array<String>]

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod [String]

The LDAP security method. Possible values are:

  • None - Requests will be made without encryption.

  • LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.

  • StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN [String]

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword [String]

The password of an entry that has read access to the directory.

connector.type [String]

This field must be set to LDAP.

Example LDAP Connector Response JSON
{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "${name}",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Retrieve the LDAP Connector

Request

Retrieve the LDAP Connector by Id

URI

GET /api/connector/{connectorId}

Request Parameters

connectorId [UUID] Required

The Id of the Connector to retrieve.

Response

Table 2. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The object you requested doesn’t exist. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

connector.authenticationURL [String]

The fully qualified LDAP URL to authenticate.

connector.baseStructure [String]

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout [Integer]

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connect.data [Object]

An object that can hold any information about the Connector that should be persisted.

connector.debug [Boolean] [default]#

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.id [UUID]

The unique Id of the LDAP Connector.

connector.identifyingAttribute [String]

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstant [Long]

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileId [UUID]

The Id of an existing Lambda. The lambda is executed after the user authenticates with the connector. This lambda can create a user, registrations, and group memberships in FusionAuth based on attributes returned from the connector.

connector.lastUpdateInstant [Long]

The instant when the LDAP Connector was last updated.

connector.loginIdAttribute [String]

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name [String]

The unique LDAP Connector name.

connector.readTimeout [Integer]

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes [Array<String>]

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod [String]

The LDAP security method. Possible values are:

  • None - Requests will be made without encryption.

  • LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.

  • StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN [String]

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword [String]

The password of an entry that has read access to the directory.

connector.type [String]

This field must be set to LDAP.

Example LDAP Connector Response JSON
{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "${name}",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Update the LDAP Connector

Request

Update the LDAP Connector by Id

URI

PUT /api/connector/{connectorId}

PATCH /api/connector/{connectorId}

Available since 1.12.0

When using the PATCH method, use the same request body documentation that is provided for the PUT request. The PATCH method will merge the provided request parameters into the existing object, this means all parameters are optional when using the PATCH method and you only provide the values you want changed. A null value can be used to remove a value. Patching an Array will result in all values from the new list being appended to the existing list, this is a known limitation to the current implementation of PATCH.

 

Request Parameters

connectorId [UUID] Required

The Id of the Connector to update.

Request Body

connector.authenticationURL [String] Required

The fully qualified LDAP URL to authenticate.

connector.baseStructure [String] Required

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout [Integer] Required

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connect.data [Object] Optional

An object that can hold any information about the Connector that should be persisted.

connector.debug [Boolean] Optional defaults to false

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.identifyingAttribute [String] Required

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.lambdaConfiguration.reconcileId [UUID] Required

The Id of an existing Lambda. The lambda is executed after the user authenticates with the connector. This lambda can create a user, registrations, and group memberships in FusionAuth based on attributes returned from the connector.

connector.loginIdAttribute [String] Required

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name [String] Required

The unique LDAP Connector name.

connector.readTimeout [Integer] Required

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes [Array<String>] Required

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod [String] Required

The LDAP security method. Possible values are:

  • None - Requests will be made without encryption.

  • LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.

  • StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN [String] Required

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword [String] Required

The password of an entry that has read access to the directory.

connector.type [String] Required

This field must be set to LDAP.

Example LDAP Connector Request JSON
{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "debug": true,
    "identifyingAttribute": "uid",
    "lambdaConfiguration": {
      "reconcileId": "b3360a2d-e81d-4314-b9f1-244a916ca52f"
    },
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Response

The response for this API contains the LDAP Connector.

Table 3. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The object you are trying to updated doesn’t exist. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

connector.authenticationURL [String]

The fully qualified LDAP URL to authenticate.

connector.baseStructure [String]

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout [Integer]

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connect.data [Object]

An object that can hold any information about the Connector that should be persisted.

connector.debug [Boolean] [default]#

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.id [UUID]

The unique Id of the LDAP Connector.

connector.identifyingAttribute [String]

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstant [Long]

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileId [UUID]

The Id of an existing Lambda. The lambda is executed after the user authenticates with the connector. This lambda can create a user, registrations, and group memberships in FusionAuth based on attributes returned from the connector.

connector.lastUpdateInstant [Long]

The instant when the LDAP Connector was last updated.

connector.loginIdAttribute [String]

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name [String]

The unique LDAP Connector name.

connector.readTimeout [Integer]

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes [Array<String>]

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod [String]

The LDAP security method. Possible values are:

  • None - Requests will be made without encryption.

  • LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.

  • StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN [String]

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword [String]

The password of an entry that has read access to the directory.

connector.type [String]

This field must be set to LDAP.

Example LDAP Connector Response JSON
{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "${name}",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Delete the LDAP Connector

Request

Delete the LDAP Connector by Id

URI

DELETE /api/connector/{connectorId}

connectorId [UUID] Required

The Id of the Connector to delete.

Response

This API does not return a JSON response body.

Table 4. Response Codes
Code Description

200

The request was successful. The response will be empty.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The object you are trying to delete doesn’t exist. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Feedback

How helpful was this page?

See a problem?

File an issue in our docs repo

Quick Links

  • Download
  • Cloud Pricing
  • Editions Pricing
  • Contact Us
  • Jobs (come work with us)
  • My Account

Resources

  • Docs
  • Blog
  • Community & Support
  • Upgrade from SaaS
  • Upgrade from Homegrown
  • Upgrade from Open Source

Everything Else

  • Privacy Policy
  • Product Privacy Policy
  • License
  • License FAQ
  • Security (contact, bug bounty, etc)
  • Technical Support

Connect with Us

logo
Subscribe for Updates
We only send dev friendly newsletters. No marketing fluff!
© 2021 FusionAuth