LDAP Connector API

Edit MD

On this page

Available since 1.18.0

The following APIs are provided to manage LDAP Connectors.

Create the LDAP Connector#

Request#

Create a LDAP Connector with a randomly generated Id.

POST/api/connector

OpenAPI Spec

Create a LDAP Connector with the provided unique Id.

POST/api/connector/{connectorId}

OpenAPI Spec

The type in the request JSON is used to determine that you are creating a LDAP Connector.

Path Parameters#

connectorId

Type: UUID
Optional
Defaults to secure random UUID

The Id to use for the new Connector. If not specified a secure random UUID will be generated.

Request Body#

connector.authenticationURL

Type: String
Required

The fully qualified LDAP URL to authenticate.

connector.baseStructure

Type: String
Required

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout

Type: Integer
Required

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.data

Type: Object
Optional

An object that can hold any information about the Connector that should be persisted.

connector.debug

Type: Boolean
Optional
Defaults to false

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.identifyingAttribute

Type: String
Required

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.lambdaConfiguration.reconcileId

Type: UUID
Required

The Id of an existing Lambda. The lambda is executed after the user authenticates with the connector. This lambda can create a user, registrations, and group memberships in FusionAuth based on attributes returned from the connector.

connector.loginIdAttribute

Type: String
Required

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name

Type: String
Required

The unique LDAP Connector name.

connector.readTimeout

Type: Integer
Required

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes

Required

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod

Type: String
Required

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN

Type: String
Required

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword

Type: String
Required

The password of an entry that has read access to the directory.

connector.type

Type: String
Required

This field must be set to LDAP.

Example LDAP Connector Request JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "identifyingAttribute": "uid",
    "lambdaConfiguration": {
      "reconcileId": "b3360a2d-e81d-4314-b9f1-244a916ca52f"
    },
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Response#

Response Codes

Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body#

connector.authenticationURL

Type: String

The fully qualified LDAP URL to authenticate.

connector.baseStructure

Type: String

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout

Type: Integer

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.data

Type: Object

An object that can hold any information about the Connector that should be persisted.

connector.debug

Type: Boolean

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.id

Type: UUID

The unique Id of the LDAP Connector.

connector.identifyingAttribute

Type: String

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstant

Type: Long

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileId

Type: UUID

connector.lastUpdateInstant

Type: Long

The instant when the LDAP Connector was last updated.

connector.loginIdAttribute

Type: String

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name

Type: String

The unique LDAP Connector name.

connector.readTimeout

Type: Integer

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod

Type: String

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN

Type: String

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword

Type: String

The password of an entry that has read access to the directory.

connector.type

Type: String

This field must be set to LDAP.

Example LDAP Connector Response JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Retrieve the LDAP Connector#

Request#

Retrieve the LDAP Connector by Id

GET/api/connector/{connectorId}

OpenAPI Spec

Path Parameters#

connectorId

Type: UUID
Required

The Id of the Connector to retrieve.

Response#

Response Codes

Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you requested doesn't exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body#

connector.authenticationURL

Type: String

The fully qualified LDAP URL to authenticate.

connector.baseStructure

Type: String

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout

Type: Integer

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.data

Type: Object

An object that can hold any information about the Connector that should be persisted.

connector.debug

Type: Boolean

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.id

Type: UUID

The unique Id of the LDAP Connector.

connector.identifyingAttribute

Type: String

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstant

Type: Long

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileId

Type: UUID

connector.lastUpdateInstant

Type: Long

The instant when the LDAP Connector was last updated.

connector.loginIdAttribute

Type: String

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name

Type: String

The unique LDAP Connector name.

connector.readTimeout

Type: Integer

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod

Type: String

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN

Type: String

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword

Type: String

The password of an entry that has read access to the directory.

connector.type

Type: String

This field must be set to LDAP.

Example LDAP Connector Response JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Update the LDAP Connector#

This API is used to update an existing LDAP Connector.

You must specify all of the properties of the LDAP Connector when calling this API with the PUT HTTP method. When used with PUT, this API doesn't merge the existing LDAP Connector and your new data. It replaces the existing LDAP Connector with your new data.

Utilize the PATCH HTTP method to send specific changes to merge into an existing LDAP Connector.

Request#

Update the LDAP Connector by Id

PUT/api/connector/{connectorId}

OpenAPI Spec

PATCH/api/connector/{connectorId}

OpenAPI Spec

Note

For backward compatibility, the PATCH method accepts the same media type (specified by a Content-Type of application/json) and body as the PUT request. You can also use the following media types for different behavior:

JSON Patch/RFC 6902: application/json-patch+json
JSON Merge Patch/RFC 7396: merge-patch+json

For details, see the PATCH documentation.

Using a media type of application/json merges the provided request parameters into the existing object. As a result, all parameters are optional with PATCH: only provide the values you want to change. To remove a value, provide a null value. Patching an Array appends all values in the new list to the old list.

Path Parameters#

connectorId

Type: UUID
Required

The Id of the Connector to update.

Request Body#

connector.authenticationURL

Type: String
Required

The fully qualified LDAP URL to authenticate.

connector.baseStructure

Type: String
Required

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout

Type: Integer
Required

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.data

Type: Object
Optional

An object that can hold any information about the Connector that should be persisted.

connector.debug

Type: Boolean
Optional
Defaults to false

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.identifyingAttribute

Type: String
Required

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.lambdaConfiguration.reconcileId

Type: UUID
Required

connector.loginIdAttribute

Type: String
Required

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name

Type: String
Required

The unique LDAP Connector name.

connector.readTimeout

Type: Integer
Required

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes

Required

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod

Type: String
Required

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN

Type: String
Required

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword

Type: String
Required

The password of an entry that has read access to the directory.

connector.type

Type: String
Required

This field must be set to LDAP.

Example LDAP Connector Request JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "identifyingAttribute": "uid",
    "lambdaConfiguration": {
      "reconcileId": "b3360a2d-e81d-4314-b9f1-244a916ca52f"
    },
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Response#

The response for this API contains the LDAP Connector.

Response Codes

Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you are trying to update doesn't exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body#

connector.authenticationURL

Type: String

The fully qualified LDAP URL to authenticate.

connector.baseStructure

Type: String

The top of the LDAP directory hierarchy. Typically this contains the dc (domain component) element.

connector.connectTimeout

Type: Integer

The connect timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.data

Type: Object

An object that can hold any information about the Connector that should be persisted.

connector.debug

Type: Boolean

Determines if debug should be enabled to create an event log to assist in debugging integration errors.

connector.id

Type: UUID

The unique Id of the LDAP Connector.

connector.identifyingAttribute

Type: String

The entry attribute name which is the first component of the distinguished name of entries in the directory.

connector.insertInstant

Type: Long

The instant when the LDAP Connector was created.

connector.lambdaConfiguration.reconcileId

Type: UUID

connector.lastUpdateInstant

Type: Long

The instant when the LDAP Connector was last updated.

connector.loginIdAttribute

Type: String

The entity attribute name which stores the identifier that is used for logging the user in.

connector.name

Type: String

The unique LDAP Connector name.

connector.readTimeout

Type: Integer

The read timeout for the HTTP connection, in milliseconds. Value must be greater than 0.

connector.requestedAttributes

The attributes to request for an entry from the DIT (Directory Information Tree).

connector.securityMethod

Type: String

The LDAP security method. Possible values are:

None - Requests will be made without encryption.
LDAPS - A secure connection will be made to a secure port over using the LDAPS protocol.
StartTLS - An un-secured connection will initially be established, followed by secure connection established using the StartTLS extension.

connector.systemAccountDN

Type: String

The distinguished name of an entry that has read access to the directory.

connector.systemAccountPassword

Type: String

The password of an entry that has read access to the directory.

connector.type

Type: String

This field must be set to LDAP.

Example LDAP Connector Response JSON

{
  "connector": {
    "authenticationURL": "ldap://localhost:389",
    "baseStructure": "dc=mydomain,dc=org",
    "connectTimeout": 100,
    "data": {
      "modifiedBy": "richard"
    },
    "debug": true,
    "id": "1c212e59-0d0e-6b1a-ad48-f4f92793be32",
    "identifyingAttribute": "uid",
    "insertInstant": 1503513015493,
    "lambdaConfiguration": {
      "reconcileId": "fbd1210-2818-4353-adb2-952613eb5d96"
    },
    "lastUpdateInstant": 1503513549421,
    "loginIdAttribute": "mail",
    "name": "My LDAP Connector",
    "readTimeout": 100,
    "requestedAttributes": [
      "mail",
      "uid",
      "objectClass",
      "cn",
      "employeeType",
      "labeledURI",
      "telephoneNumber"
    ],
    "securityMethod": "None",
    "systemAccountDN": "uid=admin,ou=system",
    "systemAccountPassword": "secret",
    "type": "LDAP"
  }
}

Delete the LDAP Connector#

Request#

Delete the LDAP Connector by Id

DELETE/api/connector/{connectorId}

OpenAPI Spec

Path Parameters#

connectorId

Type: UUID
Required

The Id of the Connector to delete.

Response#

This API does not return a JSON response body.

Response Codes

Code	Description
200	The request was successful.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The object you requested doesn't exist. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

APIs

Learn about the APIs for creating, retrieving, and updating Generic Connectors.

identity connectoruser data connectorcreate connector

APIs

Learn about the APIs for creating, retrieving, updating and deleting identity providers.

identity connectoruser data connectorcreate connector

APIs

API documentation for the FusionAuth Create a Lambda API.

fusionauth apirest apihttp api

APIs

API documentation for the FusionAuth Delete a Lambda API.

fusionauth apirest apihttp api