Skip to content
Connect2id

LdapAuth

  • Authenticate users against LDAP or Active Directory through a JSON-RPC web API.
  • Retrieve selected user attributes for your application or service.
  • Monitor the service with built-in metrics.

JSON-based API for LDAP and Active Directory authentication

LdapAuth provides a JSON-RPC 2.0 web API for authenticating users against an LDAP directory or Microsoft Active Directory. It can be integrated with web applications or used with the Connect2id server for single sign-on (SSO) and identity provider (IdP) services.

  • Authenticate users — Verify credentials against an LDAP v3-compatible directory, such as Active Directory or OpenLDAP.
  • Retrieve user attributes — Return selected attributes, such as names, contact details, and group memberships or permissions.

This example request checks the credentials of alice@wonderland.net. If authentication succeeds, LdapAuth returns the preconfigured attributes from Alice’s directory entry:

{
  "method": "user.authGet",
  "params": {
    "username": "alice@wonderland.net",
    "password": "secret"
  },
  "id": "0001",
  "jsonrpc": "2.0"
}

The response includes the user’s LDAP distinguished name (DN) and selected attributes:

{
  "result": {
    "DN": "uid=alice,ou=people,dc=wonderland,dc=net",
    "attributes": {
      "userID": "alice",
      "name": "Alice Adams",
      "email": "alice@wonderland.net",
      "roles": [
        "admin-network",
        "admin-www",
        "admin-cms"
      ],
      "phone": [
        "+1 685 622 6202",
        "+1 010 154 3228",
        "+1 225 216 5900"
      ]
    }
  },
  "id": "0001",
  "jsonrpc": "2.0"
}

Security

LdapAuth offers several configurable security measures for its web API:

  • Restrict access by client IP address or host name.
  • Require HTTPS connections.
  • Require a client X.509 certificate issued by a trusted certificate authority (CA).
  • Require the client certificate principal to match a specified DN.
  • Require an API key.
  • Enable or disable individual JSON-RPC methods.
  • Hide internal exceptions from API responses.

Connections to the backend LDAP directory can also be secured:

  • Use StartTLS or LDAPS.
  • Configure custom TLS key and trust stores.
  • Optionally permit self-signed certificates.

Setup, configuration and use

LdapAuth is distributed as a Java web application archive (WAR) for deployment in a web server such as Apache Tomcat.

Contact us if you have questions or would like help evaluating LdapAuth.

Download

Download an evaluation copy of LdapAuth. No registration is required.

Download LdapAuth

LdapAuth comes as a Java WAR file. See the quick start guide for installation instructions.

The production licence includes maintenance, updates and support for the first year. You can extend the subscription thereafter. Discounts are available for multiple instances or for integrating LdapAuth into your own product or service. We also offer integration assistance, training and custom add-on development. Contact sales to discuss your requirements and request a quote.