> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prophecy.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# LDAP authentication

> Connect to your organization LDAP directory for authentication

<Callout icon="/images/icon.png" color="#FFC107">
  Available for [Express and Enterprise Editions](/administration/platform/editions) only.
</Callout>

Prophecy can connect to your organization's LDAP directory for authentication.

* You can integrate Microsoft Entra ID over LDAP by using the same configuration fields.
* Group mapping can be enabled using [group-to-team mapping](/administration/management/authentication/group-team-mapping). To automatically create new teams in Prophecy via [group mappings](/administration/management/authentication/group-team-mapping), set the `ENABLE_AUTO_TEAM_CREATION` flag to `true` in your Prophecy deployment.

## Configuration

Here are the basics steps to connect Prophecy with your LDAP directory:

1. Log in to Prophecy as an admin user.
2. Navigate to the **SSO** tab of the Prophecy **Settings** page.
3. Under **Authentication Provider**, select LDAP.
4. Fill out the rest of the information and click **Save**. More information about the available fields can be found below.

### Host and Certs

| Parameter                     | Description                                                                                                                                                      |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Host                          | Host and optional port of the LDAP server in the form `host:port`. If the port is not supplied, it will be guessed based on "Disable SSL" and "Start TLS" flags. |
| Disable SSL                   | Required if the LDAP host is not using TLS (port 389). This option inherently leaks passwords to anyone on the same network.                                     |
| Skip Certificate Verification | If a custom certificate isn't provided, this option can be used to turn on TLS certificate checks.                                                               |
| Certificates                  | Upload trusted Root certs, client certs, and client keys.                                                                                                        |

### Binds

| Parameter               | Description                                                                                                                         |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| Bind Distinguished Name | The distinguished name for an application service account. The connector uses these credentials to search for users and groups.     |
| Bind Password           | The distinguished password for an application service account. The connector uses these credentials to search for users and groups. |
| Username Prompt         | The attribute to display in the provided password prompt.                                                                           |

### User Search

| Parameter               | Description                                            |
| ----------------------- | ------------------------------------------------------ |
| Base Distinguished Name | BaseDN to start the search from.                       |
| Filter                  | Optional filter to apply when searching the directory. |
| User Name               | Username attribute used for comparing user entries.    |
| ID Attribute            | String representation of the user.                     |
| Email Attribute         | Attribute to map to Email.                             |
| Name Attribute          | Maps to display name of users.                         |

### Group Search

| Parameter               | Description                                            |
| ----------------------- | ------------------------------------------------------ |
| Base Distinguished Name | BaseDN to start the search from.                       |
| Filter                  | Optional filter to apply when searching the directory. |
| Name Attribute          | Maps to display name of users.                         |

### Configured LDAP Groups API

You can use the Configured LDAP Groups API to retrieve all config data for your LDAP groups.

Example:

```
curl 'https://<prophecy-env-url>/api/idp/getAllIDPsConfig' \
  -H 'Content-Type: application/json;charset=utf-8' \
  -H 'cookie: prophecy-token=<prophecy-access-token>'
```

Response:

```
{
 "data": {
  "config": [
   {
    "id": "cp_ldap",
    "type": "ldap",
    "name": "",
    "idp": "others",
    "resourceVersion": "",
    "idpConfig": {
     "host": "host-name-here:host-port",
     "insecureNoSSL": true,
     "insecureSkipVerify": true,
     "startTLS": false,
     "rootCA": "",
     "clientCert": "",
     "clientKey": "",
     "rootCAData": "",
     "clientCertData": "",
     "clientKeyData": "",
     "bindDN": "*****",
     "bindPW": "*****",
     "usernamePrompt": "cn",
     "userSearch": {
      "baseDN": "dc=example,dc=org",
      "filter": "(objectClass=person)",
      "username": "cn",
      "scope": "",
      "idAttr": "DN",
      "emailAttr": "mail",
      "nameAttr": "cn",
      "preferredUsernameAttr": "",
      "emailSuffix": ""
     },
     "groupSearch": {
      "baseDN": "ou=users,dc=example,dc=org|ou=newusers,dc=example,dc=org",
      "filter": "(objectClass=groupOfNames)",
      "scope": "",
      "userAttr": "",
      "groupAttr": "",
      "userMatchers": null,
      "nameAttr": "cn"
     }
    }
   },
   {
    "id": "cp_saml",
    "type": "saml",
    "name": "",
    "idp": "okta",
    "resourceVersion": "",
    "idpConfig": {
     "caData": "-----BEGIN CERTIFICATE-----\nCERT-HERE\r\n-----END CERTIFICATE-----\n",
     "emailAttr": "email",
     "entityIssuer": "issuer",
     "groupsDelim": ", ",
     "nameIDPolicyFormat": "persistent",
     "redirectURI": "https://env-domain/api/oauth/samlCallback",
     "ssoIssuer": "http://www.okta.com/TOKEN",
     "ssoURL": "https://SSO-URL",
     "usernameAttr": "name"
    }
   }
  ]
 },
 "success": true
}
```

## User Matchers

This list contains field pairs that are used to match a user to a group. It adds a requirement to the filter that an attribute in the group must match the user's attribute value.