Project: Flagsmith (Observability and Analysis / Feature Flagging)
File: 04-LDAP.md

title: LDAP import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; :::tip LDAP authentication requires a self-hosted . ::: Flagsmith can be configured to use LDAP for authentication with . When enabled, it works by authenticating the user with username and password using the ldap server, fetching the user details from the LDAP server (if the authentication was successful) and creating the user in the Django database. By default, Flagsmith supports logging in via OpenLDAP. To connect to a Microsoft Active Directory, you need to modify the following environment variables. For simple usernames (e.g. "username"): ```txt LDAPAUTHFORMATUSERNAME="djangopython3ldap.utils.formatusernameactivedirectory" ``` For down-level login name formats (e.g. "DOMAIN\username"): ```txt LDAPAUTHFORMATUSERNAME="djangopython3ldap.utils.formatusernameactivedirectory" LDAPAUTHACTIVEDIRECTORYDOMAIN="DOMAIN" ``` For user-principal-name formats (e.g. "user@domain.com"): ```txt LDAPAUTHFORMATUSERNAME="djangopython3ldap.utils.formatusernameactivedirectory_principal" LDAPAUTHACTIVEDIRECTORYDOMAIN="domain.com" ``` Depending on how your Active Directory server is configured, the following additional settings may match your server better than the defaults used by django-python3-ldap: ```txt LDAPAUTHUSERFIELDS=username=sAMAccountName,email=mail,firstname=givenName,last_name=sn LDAPAUTHOBJECT_CLASS="user" ``` You can synchronise Flagsmith users and groups with your LDAP (Directory) users and groups by running the following command: ```bash python manage.py syncldapusersandgroups ``` Running this command will: Remove users from Flagsmith if they have been removed from Directory Remove groups from Flagsmith if they have been removed from Directory Remove users from group if they no longer belong to that group in Directory Add users to group if they belong to a new group in Directory :::note Before running this command, please make sure to set the following environment variables: LDAPSYNCUSER_USERNAME LDAPSYNCUSER_PASSWORD LDAPSYNCEDGROUPS LDAPAUTHSYNCUSERRELATIONS LDAPDEFAULTFLAGSMITHORGANISATIONID ::: Note that some environment variables may be different depending on the image that you are using (`flagsmith/flagsmith-api-ee` or `flagsmith/flagsmith-private-cloud`). Please select the correct tab below to ensure you are using the correct environment variables. <Tabs groupId="ImageType"> <TabItem value="ee" label="flagsmith-api-ee"> | Variable | Example Value | Description | Default Value | | | -- | - | - | | LDAP_AUTH_URL | ldap://localhost:389 | The URL of the LDAP server | None | | LDAP_AUTH_USE_TLS | False | Setting this to true will initiate TLS on connection | False | | LDAP_AUTH_SEARCH_BASE | ou=people,dc=example,dc=com | The LDAP search base for looking up users | ou=people,dc=example,dc=com | | LDAP_AUTH_OBJECT_CLASS | inetOrgPerson | The LDAP class that represents a user | inetOrgPerson | | LDAP_AUTH_USER_FIELDS | username=uid,email=email | User model fields mapped to the LDAP attributes that represent them. | username=uid,email=email,firstname=givenName,lastname=sn | | LDAP_AUTH_ACTIVE_DIRECTORY_DOMAIN | DOMAIN | Sets the login domain for Active Directory users. | None | | LDAP_AUTH_CONNECT_TIMEOUT | 60 | Set connection timeouts (in seconds) on the underlying `ldap3` library. | None | | LDAP_AUTH_RECEIVE_TIMEOUT | 60 | Set receive timeouts (in seconds) on the underlying `ldap3` library. | None | | LDAP_AUTH_FORMAT_USERNAME | djangopython3ldap.<br/>utils.formatusernameopenldap | Path to a callable used to format the username to bind to the LDAP server | djangopython3ldap.utils.formatusernameopenldap | | LDAP_DEFAULT_FLAGSMITH_ORGANISATION_ID | 1 | All newly created users will be added to this originisation | None | | LDAP_AUTH_SYNC_USER_RELATIONS | customauth.ldap.syncusergroups | Path to a callable used to sync user relations. Note: if you are setting this value to `customauth.ldap.syncusergroups` please make sure `LDAPDEFAULTFLAGSMITHORGANISATIONID` is set. | djangopython3ldap.utils.syncuserrelations | | LDAP_AUTH_FORMAT_SEARCH_FILTERS |

| Path to a callable used to add search filters to login to restrict login to a certain group | djangopython3ldap.utils.formatsearchfilters | | LDAP_SYNCED_GROUPS | CN=Readers,CN=Roles,CN=webapp01,<br/>dc=admin,dc=com:CN=Marvel,CN=Roles,<br/>CN=webapp01,dc=admin,dc=com | colon(:) seperated list of DN's of ldap group that will be copied over to flagmsith (lazily, i.e: On user login we will create the group(s) and add the current user to the group(s) if the user is a part of them). Note: please make sure to set `LDAPAUTHSYNCUSERRELATIONS` to `customauth.ldap.syncuser_groups` in order for this to work. | [] | | LDAP_LOGIN_GROUP | CN=Readers,CN=Roles,CN=webapp01,<br/>dc=admin,dc=com | DN of the user allowed login user group. Note: Please make sure to set `LDAPAUTHFORMATSEARCHFILTERS` to `customauth.ldap.logingroupsearchfilter` in order for this to work. | None | | LDAP_SYNC_USER_USERNAME | john | Username used by in order to connect to the server. | None | | LDAP_SYNC_USER_PASSWORD | password | Password used by in order to connect to the server. | None | </TabItem> <TabItem value="pc" label="flagsmith-private-cloud"> | Variable | Example Value | Description | Default Value | | | -- | -- | - | | LDAP_AUTH_URL | ldap://localhost:389 | The URL of the LDAP server | None | | LDAP_AUTH_USE_TLS | False | Setting this to true will initiate TLS on connection | False | | LDAP_AUTH_SEARCH_BASE | ou=people,dc=example,dc=com | The LDAP search base for looking up users | ou=people,dc=example,dc=com | | LDAP_AUTH_OBJECT_CLASS | inetOrgPerson | The LDAP class that represents a user | inetOrgPerson | | LDAP_AUTH_USER_FIELDS | username=uid,email=email | User model fields mapped to the LDAP attributes that represent them. | username=uid,email=email,firstname=givenName,lastname=sn | | LDAP_AUTH_ACTIVE_DIRECTORY_DOMAIN | DOMAIN | Sets the login domain for Active Directory users. | None | | LDAP_AUTH_CONNECT_TIMEOUT | 60 | Set connection timeouts (in seconds) on the underlying `ldap3` library. | None | | LDAP_AUTH_RECEIVE_TIMEOUT | 60 | Set receive timeouts (in seconds) on the underlying `ldap3` library. | None | | LDAP_AUTH_FORMAT_USERNAME | djangopython3ldap.<br/>utils.formatusernameopenldap | Path to a callable used to format the username to bind to the LDAP server | djangopython3ldap.utils.formatusernameopenldap | | LDAP_DEFAULT_FLAGSMITH_ORGANISATION_ID | 1 | All newly created users will be added to this originisation | None | | LDAP_AUTH_SYNC_USER_RELATIONS | flagsmithldap.ldap.syncusergroups | Path to a callable used to sync user relations. Note: if you are setting this value to `flagsmithldap.ldap.syncusergroups` please make sure `LDAPDEFAULTFLAGSMITHORGANISATIONID` is set. | djangopython3ldap.utils.syncuserrelations | | LDAP_AUTH_FORMAT_SEARCH_FILTERS | flagsmithldap.ldap.logingroupsearchfilter | Path to a callable used to add search filters to login to restrict login to a certain group | djangopython3ldap.utils.formatsearchfilters | | LDAP_SYNCED_GROUPS | CN=Readers,CN=Roles,CN=webapp01,<br/>dc=admin,dc=com:CN=Marvel,CN=Roles,<br/>CN=webapp01,dc=admin,dc=com | colon(:) seperated list of DN's of ldap group that will be copied over to flagmsith (lazily, i.e: On user login we will create the group(s) and add the current user to the group(s) if the user is a part of them). Note: please make sure to set `LDAPAUTHSYNCUSERRELATIONS` to `flagsmith.ldap.syncusergroups` in order for this to work. | [] | | LDAP_LOGIN_GROUP | CN=Readers,CN=Roles,CN=webapp01,<br/>dc=admin,dc=com | DN of the user allowed login user group. Note: Please make sure to set `LDAPAUTHFORMATSEARCHFILTERS` to `flagsmithldap.ldap.logingroupsearchfilter` in order for this to work. | None | | LDAP_SYNC_USER_USERNAME | john | Username used by in order to connect to the server. | None | | LDAP_SYNC_USER_PASSWORD | password | Password used by in order to connect to the server. | None | </TabItem> </Tabs>