APIs / connectors

LDAP Connector

Overview

This API has been available since 1.18.0

The following APIs are provided to manage LDAP Connectors.

Create the LDAP Connector

Request

Create a LDAP Connector with a randomly generated Id.

POST /api/connector

Create a LDAP Connector with the provided unique Id.

POST /api/connector/{connectorId}

The type in the request JSON is used to determine that you are creating a LDAP Connector.

Request Parameters

connectorIdUUIDDefaults to secure random UUID

The Id to use for the new Connector. If not specified a secure random UUID will be generated.

Request Body

connector.authenticationURLStringrequired

The fully qualified LDAP URL to authenticate.

connector.baseStructureStringrequired

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeoutIntegerrequired

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.dataObject

An object that can hold any information about the Connector that should be persisted.

connector.debugBooleanDefaults to false

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.identifyingAttributeStringrequired

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.lambdaConfiguration.reconcileIdUUIDrequired

The Id of an existing Lambda. The lambda is executed after the user authenticates with the connector. This lambda can create a user, registrations, and group memberships in FusionAuth based on attributes returned from the connector.

connector.loginIdAttributeStringrequired

The entity attribute name which stores the identifier that is used for logging the user in.

connector.nameStringrequired

The unique LDAP Connector name.

connector.readTimeoutIntegerrequired

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributesrequired

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethodStringrequired

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDNStringrequired

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPasswordStringrequired

The password of an entry that has read access to the directory.

connector.typeStringrequired

This field must be set to LDAP.

Example LDAP Connector Request JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "identifyingAttribute": "uid",
    "lambdaConfiguration": {
      "reconcileId": "b3360a2d-e81d-4314-b9f1-244a916ca52f"
    },
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Response

Response Codes

Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

connector.authenticationURLString

The fully qualified LDAP URL to authenticate.

connector.baseStructureString

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeoutInteger

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.dataObject

An object that can hold any information about the Connector that should be persisted.

connector.debugBoolean

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.idUUID

The unique Id of the LDAP Connector.

connector.identifyingAttributeString

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstantLong

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileIdUUID

connector.lastUpdateInstantLong

The instant when the LDAP Connector was last updated.

connector.loginIdAttributeString

The entity attribute name which stores the identifier that is used for logging the user in.

connector.nameString

The unique LDAP Connector name.

connector.readTimeoutInteger

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethodString

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDNString

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPasswordString

The password of an entry that has read access to the directory.

connector.typeString

This field must be set to LDAP.

Example LDAP Connector Response JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Retrieve the LDAP Connector

Request

Retrieve the LDAP Connector by Id

GET /api/connector/{connectorId}

Request Parameters

connectorIdUUIDrequired

The Id of the Connector to retrieve.

Response

Response Codes

Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you requested doesn't exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

connector.authenticationURLString

The fully qualified LDAP URL to authenticate.

connector.baseStructureString

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeoutInteger

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.dataObject

An object that can hold any information about the Connector that should be persisted.

connector.debugBoolean

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.idUUID

The unique Id of the LDAP Connector.

connector.identifyingAttributeString

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstantLong

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileIdUUID

connector.lastUpdateInstantLong

The instant when the LDAP Connector was last updated.

connector.loginIdAttributeString

The entity attribute name which stores the identifier that is used for logging the user in.

connector.nameString

The unique LDAP Connector name.

connector.readTimeoutInteger

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethodString

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDNString

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPasswordString

The password of an entry that has read access to the directory.

connector.typeString

This field must be set to LDAP.

Example LDAP Connector Response JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Update the LDAP Connector

This API is used to update an existing LDAP Connector.

You must specify all of the properties of the LDAP Connector when calling this API with the PUT HTTP method. When used with PUT, this API doesn’t merge the existing LDAP Connector and your new data. It replaces the existing LDAP Connector with your new data.

Utilize the PATCH HTTP method to send specific changes to merge into an existing LDAP Connector.

Request

Update the LDAP Connector by Id

PUT /api/connector/{connectorId}

PATCH /api/connector/{connectorId}

When using the PATCH method, you can either use the same request body documentation that is provided for the PUT request for backward compatibility. Or you may use either JSON Patch/RFC 6902] or JSON Merge Patch/RFC 7396. See the PATCH documentation for more information.

When using the PATCH method with a Content-Type of application/json the provided request parameters will be merged into the existing object, this means all parameters are optional when using the PATCH method and you only provide the values you want changed. A null value can be used to remove a value. Patching an Array will result in all values from the new list being appended to the existing list, this is a known limitation to the current implementation of PATCH.

Request Parameters

connectorIdUUIDrequired

The Id of the Connector to update.

Request Body

connector.authenticationURLStringrequired

The fully qualified LDAP URL to authenticate.

connector.baseStructureStringrequired

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeoutIntegerrequired

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.dataObject

An object that can hold any information about the Connector that should be persisted.

connector.debugBooleanDefaults to false

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.identifyingAttributeStringrequired

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.lambdaConfiguration.reconcileIdUUIDrequired

connector.loginIdAttributeStringrequired

The entity attribute name which stores the identifier that is used for logging the user in.

connector.nameStringrequired

The unique LDAP Connector name.

connector.readTimeoutIntegerrequired

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributesrequired

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethodStringrequired

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDNStringrequired

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPasswordStringrequired

The password of an entry that has read access to the directory.

connector.typeStringrequired

This field must be set to LDAP.

Example LDAP Connector Request JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "identifyingAttribute": "uid",
    "lambdaConfiguration": {
      "reconcileId": "b3360a2d-e81d-4314-b9f1-244a916ca52f"
    },
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Response

The response for this API contains the LDAP Connector.

Response Codes

Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you are trying to update doesn't exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

connector.authenticationURLString

The fully qualified LDAP URL to authenticate.

connector.baseStructureString

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeoutInteger

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.dataObject

An object that can hold any information about the Connector that should be persisted.

connector.debugBoolean

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.idUUID

The unique Id of the LDAP Connector.

connector.identifyingAttributeString

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstantLong

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileIdUUID

connector.lastUpdateInstantLong

The instant when the LDAP Connector was last updated.

connector.loginIdAttributeString

The entity attribute name which stores the identifier that is used for logging the user in.

connector.nameString

The unique LDAP Connector name.

connector.readTimeoutInteger

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethodString

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDNString

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPasswordString

The password of an entry that has read access to the directory.

connector.typeString

This field must be set to LDAP.

Example LDAP Connector Response JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Delete the LDAP Connector

Request

Delete the LDAP Connector by Id

DELETE /api/connector/{connectorId}

connectorIdUUIDrequired

The Id of the Connector to delete.

Response

This API does not return a JSON response body.

Response Codes

Code	Description
200	The request was successful.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you requested doesn't exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Results

Recent

LDAP Connector

Overview

Create the LDAP Connector

Request

Request Parameters

Request Body

Response

Response Body

Retrieve the LDAP Connector

Request

Request Parameters

Response

Response Body

Update the LDAP Connector

Request

Request Parameters

Request Body

Response

Response Body

Delete the LDAP Connector

Request

Response

Results

Recent