---
title: "How to delegate platform authentication to an LDAP directory?"
canonical: "https://onesaitplatform.refined.site/space/DOCT/2220846490/How%20to%20delegate%20platform%20authentication%20to%20an%20LDAP%20directory%3F"
format: markdown
---
[ES](https://onesaitplatform.atlassian.net/wiki/spaces/OP/pages/166232098) | EN

> Macro (toc)

# Authentication on LDAP

To authenticate with an LDAP, simply configure the following properties in the ***application.yml*** of the control panel.

With this configuration, you will delegate the authentication in an LDAP.

![image](media://4d0074d7-38d2-48dc-98e0-d60a7b2b936b)

![image](media://3799e614-e0d8-498d-9245-eea67e61777b)

The user defined with username must have query permission on the LDAP.

# Authorization on LDAP

## Role mapping

Optionally, the properties  **ldap.platformRolesGroup** allow to manage the user's roles of the platform from the LDAP.

For this, each platform role must be associated with a group of users in the LDAP, and the DN of each group must be indicated in these properties for each of the roles.

Let's supose a LDAP with this structure of users groups with the platform roles Administrator, Analytics, Developer, Sys_Admin and User, under the DN: **OU=AppSofia2,OU=AppSmart,DC=aytologd**

![image](media://340cc928-4c50-4a01-b297-7e103808220a)

Platform Roles would be mapped with the following configuration:

![image](media://4c988839-70a1-4921-a254-0cf91423236b)

## Importing users

To import users from an LDAP to the platform configuration database, there are two alternatives:

- ** Successful login:** Every time a user is authenticated, should the user do not exist, then the user will be inserted into a database with the role of the group in the LDAP where that user is member<span style="color: #091e42">, or ROLE_DEVELOPER as default if the user is not member of any Role group or the roles are not configured.</span>
- ** Import through a Realm:** The second alternative is the creation of a [Realm](https://onesaitplatform.atlassian.net/wiki/spaces/DOCT/pages/2220847918), and then import users or entire groups, mapping LDAP roles with Realm roles. Similarly, if it does not exist, then the user will be inserted in the database with the role of the group to which the user belongs, or ROLE_DEVELOPER by default if the user does not belong to any group or has not been configured.

> ℹ️ **NOTE**
> ℹ️ 
> ℹ️ With this import, you are creating the concept of User in the Platform (to be able to assign concepts and others). In this scenario, the password is never stored on the platform, and the authentication is always delegated to the platform.

## Use of LDAP users in Realms

If authentication against an LDAP is used in the platform deployment, a checkbox will appear in the User Assignment tab. You will be able to search for and import LDAP users as well as existing groups.

By clicking this checkbox, you can search by DN users and groups.

If you want to import users from the LDAP, you must fill in the USER DN BASE field with the DN. This operation will perform a search for all users belonging to that DN.

![image](media://fa318f11-29d7-471d-8cda-de8af10d82f0)

![image](media://ae10be3a-61fc-456c-8fa1-b4f5c9de5065)


The same can be done with the groups.

![image](media://64e0afda-5791-451b-bde9-77901b9e871e)

![image](media://38be43ad-2601-4ee2-8043-8a00fa00061d)

When an LDAP group is mapped with a ROLE, all the users will be created on the platform associated with that role.