# LDAP authentication

> Connect Cloud Management Platform (CMP) to an LDAP or Active Directory server so that users can log in with their directory credentials

---

Site [llms.txt](/llms.txt)

---

## Add LDAP utility

Set up a connection to your LDAP utility.

1. Go to **Admin** > **LDAP Authentication Settings**.
1. Select **Add**.
1. Complete the **Add LDAP Utility** form:

   | Field | Notes |
   | --- | --- |
   | IP Address | IP address or FQDN of AD/LDAP server. |
   | Port | Port to connect to the AD/LDAP server. Defaults are 389 (LDAP) and 636 (LDAPS). |
   | Protocol | Select ldap or ldaps. To use ldaps, LDAPS must be enabled on the directory server. See the [OpenLDAP](https://www.openldap.org/doc/admin26/tls.html) or [Active Directory](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/enable-ldap-over-ssl-3rd-certification-authority) documentation. |
   | LDAP Version | Select Version 2 or Version 3. Contact your directory admin for guidance. |
   | Account | The service account in AD/LDAP that can search for users and, if applicable, join servers to the domain. For Active Directory, use the form `username@domain`. |
   | Password | The password used to authenticate the service account. If the password vault feature is enabled, this field offers **Locally Stored** or **Vault Managed**. Select **Vault Managed** to read the secret from a configured vault provider. See [Use password vaults](/docs/cmp/configure/access-and-security/security/use-password-vaults/). |

1. Select **Save**.

## Edit LDAP settings

After saving the LDAP credentials, select **Settings** from the LDAP utility to edit the LDAP settings. This must be completed before the LDAP utility can be used.

| Field | Description |
| --- | --- |
| **Domain** | The domain for the AD/LDAP (for example, `www.domain.com`). |
| **Base DN** | Enter a base Distinguished Name (DN) as the starting point for searching for users in the directory. |
| **Search Filter** | This can be used to limit the users returned in the first phase of authentication. It uses the LDAP filter syntax. |
| **Disabled User Filter** | Users that match this filter are set to inactive in CMP. |
| **Username Field** | The AD/LDAP attribute to use for the username when creating a CMP user. For AD, it usually is `sAMAccountName`. For most other directory servers, it should be `uid`. |
| **Firstname Field** | The AD/LDAP attribute to use for the first name when creating a CMP user. Defaults to `givenName`. |
| **Lastname Field** | The AD/LDAP attribute to use for the last name when creating a CMP user. Defaults to `sn`. |
| **Email Field** | The AD/LDAP attribute to use for the email address when creating a CMP user. Defaults to `mail`. |
| **Email format** | Not all directories store email information, or an admin may want to override the email settings for each user. In CMP, you can define an email template based on other user attributes, for example `first.last@domain` or `username@your-domain.com`. Possible references: first, last, username, or domain. |
| **Auto create user** | Any valid LDAP user can access CMP, even if no matching CMP user existed prior to the first login attempt. See [Auto-creation of users](#auto-creation-of-users) below. |
| **Portals** | The portals to be listed for this domain at login. |

Select **Save** once completed.

## Local credential store

The **Local credential store** switch on the **LDAP Authentication Settings** page controls whether local user accounts on this instance can log in with their CMP credentials.

- **Enabled:** Local user accounts created on this instance can use their credentials to log in.
- **Disabled:** Local credentials cannot be used to log in to this instance. Disabling the local credential store does not delete or modify local accounts.

## Verify the connection

CMP ships with the OpenLDAP ldapsearch utility. To verify the AD/LDAP connection, log in to the CMP console and run ldapsearch, passing uri, binddn, and search based on the way AD/LDAP is configured in CMP.

```bash
ldapsearch -H "PROTOCOL://IP:PORT" -D "ACCOUNT" -b BASEDN -w PASSWORD -s sub -x -v  "FILTER"
```

## Modify the LDAP network connection timeout

By default, the **LDAP network connection timeout** is set to **5 seconds**. This timeout controls how long CMP waits when establishing a connection to the LDAP server. In environments with higher latency or slow directory servers, this value may be too low, leading to connection failures.

To modify the LDAP network connection timeout:

1. SSH into your CMP server as the root user.
1. Open **`/var/opt/cloudbolt/proserv/customer_settings.py`** for editing.
1. Add the following line with an appropriate value in seconds, and save the file:

   ```python
   # Example: LDAP_NETWORK_TIMEOUT = 30
   LDAP_NETWORK_TIMEOUT = <timeout_in_seconds>
   ```

1. Restart the Apache HTTP Server and the job engine:

   ```bash
   systemctl restart httpd
   supervisorctl restart jobengine:*
   ```

## Verify the LDAPS server certificate

Use this setting only if your LDAP utility uses the ldaps protocol.

By default, CMP encrypts LDAPS connections but does not verify the directory server's certificate. To have CMP verify the certificate, set `LDAP_CACERTFILE` to the certificate authority (CA) certificate that signed it. CMP then rejects the connection if the server's certificate was not issued by that CA.

The setting applies to every LDAP utility that uses ldaps. If your directory servers use certificates from different CAs, combine the CA certificates into one file.

To add the LDAPS CA certificate:

1. Get the CA certificate (not the server certificate) in PEM format from your directory administrator.
1. SSH into your CMP server as root.
1. Copy the CA certificate to `/var/opt/cloudbolt/proserv/`.
1. Open **`/var/opt/cloudbolt/proserv/customer_settings.py`** for editing.
1. Add the following line with the path to the CA certificate, and save the file:

   ```python
   # Example: LDAP_CACERTFILE = "/var/opt/cloudbolt/proserv/exampleldap_ca.crt"
   LDAP_CACERTFILE = "<path_to_ca_certificate>"
   ```

1. Restart the Apache HTTP Server and the job engine:

   ```bash
   systemctl restart httpd
   supervisorctl restart jobengine:*
   ```

1. Log in to CMP as an LDAP user to confirm that the connection works.

If LDAP users cannot log in after the change, check the path, and check that the file contains the CA that issued the directory server's certificate. To return to the default behavior, remove the line from `customer_settings.py` and restart both services again.

## Auto-creation of users

- For LDAP/AD, if you check the box for auto-creating users, any user with valid AD/LDAP credentials is granted an account in CMP on their first login.
- For Google authentication, auto-creation of users is always enabled (for the domains specified in the whitelist).
- Auto-created users have no permissions and belong to no groups until a group admin explicitly grants them permissions or adds them to a group.

## See also

[User permission and attribute synchronization](/docs/cmp/configure/access-and-security/groups-roles-permissions/permission-sync/)