> For the complete documentation index, see [llms.txt](https://docs.digibee.com/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.digibee.com/documentation/connectors-and-triggers/connectors/security/ldap.md).

# LDAP

**LDAP** performs search, add, modify, and delete operations on an LDAP server from your Digibee pipeline.

## **Parameters**

Configure the connector using the parameters below. Fields that support [Double Braces expressions](/documentation/connectors-and-triggers/double-braces/overview.md) are marked in the **Supports DB** column.

{% tabs %}
{% tab title="General" %}

<table><thead><tr><th width="112">Parameter</th><th width="231">Description</th><th width="83">Data type</th><th width="81">Supports DB</th><th width="100">Default value</th><th width="125">Visible when</th></tr></thead><tbody><tr><td><strong>Account</strong></td><td>Account used to authenticate the connector against the LDAP server. Must be a Basic account type, configured in <a href="/spaces/jvO5S91EQURCEhbZOuuZ/pages/fS1QLzAg8rGSSJFwtrvy">Accounts</a> on the Platform.</td><td>String</td><td>❌</td><td>N/A</td><td>—</td></tr><tr><td><strong>SSL</strong></td><td>If enabled, the connector encrypts the connection using SSL. Configure the certificate through the <strong>Custom SSL Certificate</strong> parameter.</td><td>Boolean</td><td>❌</td><td><code>false</code></td><td>—</td></tr><tr><td><strong>Custom SSL Certificate</strong></td><td>Custom account used for the SSL connection.</td><td>String</td><td>❌</td><td>N/A</td><td><strong>SSL</strong> is enabled</td></tr><tr><td><strong>Operation</strong></td><td>LDAP operation the connector executes: Search, Add, Delete, or Modify.</td><td>String</td><td>❌</td><td><code>Search</code></td><td>—</td></tr><tr><td><strong>Search Operation</strong></td><td>Scope of the search: Object, One level, or Sub trees.</td><td>String</td><td>❌</td><td><code>Object</code></td><td><strong>Operation</strong> is <strong>Search</strong></td></tr><tr><td><strong>Modify Operation</strong></td><td>Type of change applied to the entry: Add Attribute, Remove Attribute, Replace Attribute, or Increment Attribute.</td><td>String</td><td>❌</td><td><code>Add Attribute</code></td><td><strong>Operation</strong> is <strong>Modify</strong></td></tr><tr><td><strong>Hostname</strong></td><td>Name or IP address of the LDAP server.</td><td>String</td><td>✅</td><td><code>199.199.199.1</code></td><td>—</td></tr><tr><td><strong>Port</strong></td><td>Port used to connect to the LDAP server.</td><td>Integer</td><td>✅</td><td><code>389</code></td><td>—</td></tr><tr><td><strong>Authentication DN</strong></td><td>Distinguished Name (DN) used to connect the LDAP server. If left blank, the account username is used as the complete bind DN, with no changes applied. If filled in, the connector combines it with the account username using the format <code>CN=&#x3C;username>,&#x3C;Authentication DN></code>.</td><td>String</td><td>✅</td><td><code>CN=Users,DC=digibee,DC=io</code></td><td>—</td></tr><tr><td><strong>Operation DN</strong></td><td>Distinguished Name (DN) the operation applies to.</td><td>String</td><td>✅</td><td><code>{{message.$.dnOperation}}</code></td><td>—</td></tr><tr><td><strong>Filter</strong></td><td>Filter expression used to narrow down the search results.</td><td>String</td><td>✅</td><td>N/A</td><td>—</td></tr><tr><td><strong>Entries</strong></td><td>JSON expression representing the entry attributes to add or modify.</td><td>String</td><td>✅</td><td>N/A</td><td><strong>Operation</strong> is <strong>Modify</strong> or <strong>Add</strong></td></tr><tr><td><strong>Binary Entries</strong></td><td>List of entries added through the connector UI. Select <strong>+ Add</strong> to add a new item, and use the reorder and delete controls to manage items.</td><td>List</td><td>❌</td><td>N/A</td><td><strong>Operation</strong> is <strong>Modify</strong> or <strong>Add</strong></td></tr><tr><td><strong>Entry Name</strong></td><td>Name of the entry, set within a Binary Entries item.</td><td>String</td><td>❌</td><td>N/A</td><td>Inside a <strong>Binary Entries</strong> item</td></tr><tr><td><strong>Fail On Error</strong></td><td>If enabled, the execution of the pipeline with an error is interrupted, and the exception includes both the translated message and the original error detail. Otherwise, the pipeline execution proceeds, but the result shows a <code>false</code> value for the <code>"success"</code> property.</td><td>Boolean</td><td>❌</td><td><code>false</code></td><td>—</td></tr></tbody></table>

{% endtab %}

{% tab title="Documentation" %}

| Parameter         | Description                                                                             | Data type | Supports DB | Default value |
| ----------------- | --------------------------------------------------------------------------------------- | --------- | ----------- | ------------- |
| **Documentation** | Optional field to describe the connector configuration and any relevant business rules. | String    | ❌           | N/A           |
| {% endtab %}      |                                                                                         |           |             |               |
| {% endtabs %}     |                                                                                         |           |             |               |

## **Configuring the Authentication DN parameter**

The **Authentication DN** parameter determines how the connector builds the bind DN used to authenticate against the LDAP server. The account username, configured in the **Username** field of a [**Basic**](/documentation/developer-guide/development-cycle/build-overview/accounts.md#basic) account on the platform, is always part of this bind DN. Whether Authentication DN is filled in or left blank determines whether the username is combined with the Authentication DN to form the bind DN, or used on its own as the complete bind DN, as detailed below.

### **Authentication DN filled in**

The connector builds the bind DN by combining `CN=`, the account username, and the Authentication DN value:

```
CN=<account username>,<Authentication DN>
```

If you already have the user's full DN, split it into these two parts:

* **Username** (registered in the [**Username**](/documentation/developer-guide/development-cycle/build-overview/accounts.md#basic) field, under **Accounts** on the platform): Only the CN value, without the `CN=` prefix. Example: `UserExample`.
* **Authentication DN** (the connector parameter): Everything after the CN segment. Example: `OU=FOLDER1,DC=abc,DC=com,DC=br`.

With those values, the connector binds as `cn=UserExample,OU=FOLDER1,DC=abc,DC=com,DC=br`.

{% hint style="info" %}

#### Important information:

* Don't include `CN=` in either field. The connector adds it automatically.
* The username configured in the account must match the "name" field configured in the LDAP server.
  {% endhint %}

### **Authentication DN left blank**

The connector uses the account username exactly as registered, with no changes applied. In this case, the **Username** field under **Accounts** must contain the complete bind DN, including its RDN attribute, for example:

```
UID=jsilva,OU=people,DC=abc,DC=com,DC=br
```

Use this mode when the user's RDN isn't `CN`, for example directories that authenticate with `UID=`, `sAMAccountName`, or a UPN such as `user@domain`.

{% hint style="info" %}
When Authentication DN is blank, the connector validates the configuration at deploy time: the account username can't be empty, the DN must be parseable, and the account password can't be blank. Configuration errors are reported immediately instead of only surfacing at execution time.
{% endhint %}

## **Building expressions for LDAP parameters**

Several LDAP parameters accept a fixed value, a [Double Braces expression](/documentation/connectors-and-triggers/double-braces/overview.md), or a combination of both. Double Braces expressions use JSON Path syntax; see the [JsonPath specification](https://github.com/json-path/JsonPath) for the full syntax reference.

### **Operation DN**

You can:

* Use a fixed value: `dnOperation = "ou=system,cn=users"`
* Reference a field from the message: `dnOperation = "{{ message.$.dn }}"`
* Combine both: `dnOperation = "ou={{ message.$.dn }}"`

### **Filter**

You can:

* Use a fixed value: `filter = "(objectClass=)"`
* Reference a field from the message: `filter = "{{ message.$.filter }}"`
* Combine both: `filter = "objectClass={{ message.$.filter }}"`

### **Entries**

The Entries parameter is a JSON expression used to add or modify entries in the LDAP server.

You can:

* Use a fixed value: `entries = {"objectClass": ["top", "person"], "cn": "test_ad", "sn": "test_sn"}`
* Reference a field from the message: `entries = "{{ message.$.entries }}"`
* Combine both: `entries = {"objectClass": ["top", "person"], "cn": "{{ message.$.entries }}", "sn": "test_sn"}`

### **Search Operation values**

| Value | Meaning      |
| ----- | ------------ |
| 0     | Base Object  |
| 1     | One Level    |
| 2     | Full Subtree |

### **Modify Operation values**

| Value | Meaning              |
| ----- | -------------------- |
| 0     | Add attribute        |
| 1     | Exclude attribute    |
| 2     | Substitute attribute |
| 3     | Increment attribute  |

### **Operation, SSL, and error handling**

* **Operation**: The operation to execute on the LDAP server: `SEARCH`, `ADD`, `MODIFY`, or `DELETE`.
* **SSL**: If `true`, the connection uses SSL. If `false`, the connection isn't encrypted.
* **Fail On Error**: If `true`, an error suspends the pipeline execution.

## **Messages flow**

### **Operation search**

#### **Input**

```json
{
  "type": "connector",
  "name": "ldap-connector",
  "accountLabel": "ldap",
  "stepName": "ldap",
  "params": {
    "operation": "SEARCH",
    "host": "LDAP_IP",
    "port": 389,
    "dnAuthentication": "DC=digibee,DC=io",
    "dnOperation": "DC=digibee,DC=io",
    "filter": "(objectClass=)",
    "searchOperation": 0,
    "useSsl": false,
    "failOnError": false
  }
}
```

#### **Output**

```json
{
    "result": [
        {
            "pwdhistorylength": "24"
        },
        {
            "msds-alluserstrustquota": "1000"
        },
        {
            "otherwellknownobjects": [
                "B:32:683A24E2E8164BD3AF86AC3C2CF3F981:CN=Keys,DC=digibee,DC=io",
                "B:32:1EB93889E40C45DF9F0C64D23BBB6237:CN=Managed Service Accounts,DC=digibee,DC=io"
            ]
        }
    ]
}
```

### **Operation add**

#### **Input**

```json
{
  "type": "connector",
  "name": "ldap-connector",
  "accountLabel": "ldap",
  "stepName": "ldap",
  "params": {
    "operation": "ADD",
    "host": "LDAP_IP",
    "port": 389,
    "dnAuthentication": "DC=digibee,DC=io",
    "entries": "{{ message.$.entries }}",
    "dnOperation": "DC=digibee,DC=io",
    "useSsl": false,
    "failOnError": false
  }
}
```

#### **Payload**

```json
{
     "entries": {
            "objectClass": ["top", "person"],
            "cn": "test_ad",
            "sn": "test_sn"
     }
 }
```

#### **Output**

```json
{
    "message": "Entry added successfully",
    "success": true
}
```

### **Operation modify**

#### **Input**

```json
{
  "type": "connector",
  "name": "ldap-connector",
  "accountLabel": "ldap",
  "stepName": "ldap",
  "params": {
    "operation": "MODIFY",
    "host": "LDAP_IP",
    "port": 389,
    "dnAuthentication": "DC=digibee,DC=io",
    "entries": "{{ message.$.entries }}",
    "dnOperation": "DC=digibee,DC=io",
    "modifyOperation": 0,
    "useSsl": false,
    "failOnError": false
  }
}
```

#### **Payload**

```json
{
     "entries": {
            "objectClass": ["top", "person"],
            "cn": "test_ad",
            "sn": "test_sn"
     }
}
```

#### **Output**

```json
{
    "message": "Entry modified successfully",
    "success": true
}
```

### **Operation delete**

#### **Input**

```json
{
    "type": "connector",
    "name": "ldap-connector",
    "accountLabel": "ldap",
    "stepName": "ldap",
    "params": {
        "operation": "DELETE",
        "host": "LDAP_IP",
        "port": 389,
        "dnAuthentication": "DC=digibee,DC=io",
        "dnOperation": "DC=digibee,DC=io",
        "useSsl": false,
        "failOnError": false
    }
}
```

#### **Output**

```json
{
    "message": "Entry deleted successfully",
    "success": true
}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.digibee.com/documentation/connectors-and-triggers/connectors/security/ldap.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.