LDAP Integration

The Lightweight Directory Access Protocol (LDAP) is commonly used by organizations for centralized user authentication and Single Sign-On (SSO). By integrating LDAP with Frappe, users can log in using their existing LDAP credentials instead of maintaining separate application accounts.

Tip:

LDAP integration simplifies user management by allowing authentication and role assignment to be controlled from a central directory service.

Access LDAP Settings

Navigate to:

Home > Integrations > LDAP Settings

Note:

After completing the configuration, enable the Enabled option to activate LDAP authentication. Frappe validates the configuration before saving the settings.

LDAP Server

Configure the LDAP directory server that Frappe will use for authentication.

LDAP Directory Server

Choose the directory type that matches your environment:

Active Directory – Microsoft Active Directory
OpenLDAP – OpenLDAP servers
Custom – For custom LDAP implementations requiring custom group attributes

LDAP Server URL

Specify the LDAP server address using one of the following formats:

ldap://yourserver:port

ldaps://yourserver:port

LDAP Authentication

Provide the credentials that Frappe will use to connect to the LDAP directory.

Base Distinguished Name (DN) – User account used to bind to the LDAP server.
Password for Base DN – Password for the bind account.

The bind account must have permission to access the configured search paths.

LDAP Search Paths

Specify the directory locations where users and groups are stored.

LDAP Search Path for Users – Location containing users allowed to log in.
LDAP Search Path for Groups – Location containing LDAP groups.
LDAP Search String – Filter used to locate users during login.

Search paths must be provided in LDAP Distinguished Name (DN) format.

ou=users,dc=example,dc=com

Best Practice:

Ensure the bind account has the required permissions to access the configured user and group search paths.

Search Filter Examples

The login name placeholder {0} is replaced with the value entered on the login screen.

(uid={0})

(sAMAccountName={0})

(&(description=*ACCESS:Frappe*)(uid={0}))

(&(sAMAccountName={0})(memberOf=cn=Domain Users,ou=Groups,dc=example,dc=com))

LDAP User Mapping

Configure how LDAP user attributes are mapped to Frappe user fields.

LDAP Email Field – Typically mail.
LDAP Username Field – Typically sAMAccountName for Active Directory or uid for OpenLDAP.
LDAP First Name Field – Commonly givenName or sn.

Optional mappings are also available for:

Middle Name
Phone
Mobile

Security Warning:

Avoid using the mail attribute as the username unless your directory guarantees that email addresses are unique.

LDAP Security

Configure secure communication between Frappe and the LDAP server.

SSL/TLS Mode

Choose how encrypted connections should be established.

StartTLS – Upgrades an LDAP connection to TLS.
None – Uses an unencrypted connection.

Require Trusted Certificate

Choose whether the LDAP server’s certificate must be trusted.

Yes – Only trusted certificates are accepted.
No – Allows self-signed certificates.

If trusted certificates are required, configure the following certificate files:

Private Key File
Server Certificate
CA Certificate File

Certificate file paths must be absolute paths on the Frappe server.

Custom LDAP Directory

If Custom is selected as the directory type, configure the following additional settings:

Group Object Class
Group Member Attribute
Custom Group Search

These settings allow Frappe to work with LDAP providers that use custom group implementations.

LDAP Group Mapping

LDAP groups can be mapped to Frappe roles so that user permissions are assigned automatically during login.

Default Role on Creation

Select the role that will be assigned when a new LDAP user is created in Frappe.

LDAP Group Mappings

Map LDAP group names to Frappe roles.

LDAP Group	Frappe Role
Domain Users	Guest
Domain Administrators	Administrator

Automatic Role Synchronization:

Whenever an LDAP user logs in, Frappe automatically checks the user’s LDAP group memberships and adds or removes roles as required.

Logging in with LDAP

Once LDAP has been configured and enabled, the login page displays a Login via LDAP option.

Users can authenticate using their LDAP credentials, and Frappe will validate the login against the configured LDAP directory before granting access.

Rating: 0 / 5 (0 votes)