<%- include('top') %>

Integrations

Everything a 3rd-party app or host needs to bind this directory, filled in for <%= ssoUrl %>.

LDAPS hostname: keep LDAP binds off the public internet

LDAPS requires a hostname, not a bare IP address, because the TLS client verifies the server name against the certificate. The URL below <% if (ldapsHostExplicit) { %>is set to <%= ldapHost %> from conf.ldap.ldapsHost.<% } else { %>currently matches the public OAuth issuer host — convenient, but that implies clients reach it through your router on port 636. Do not port-forward 636 to the internet for LDAP simple binds; instead pick an internal-only hostname and set conf.ldap.ldapsHost.<% } %>

  • Same Docker/network host (recommended for the proxy or apps on this machine): use ldaps://sso-manager:636 (the internal service name). Set conf.ldap.ldapsHost = 'sso-manager'.
  • LAN host: create an internal DNS record like ldap.internal.example.com → the local IP, get or generate a cert whose SAN matches that name, and set conf.ldap.ldapsHost. A wildcard for *.internal.example.com works well.
  • Public hostname: only acceptable behind a VPN or firewall lockdown — never exposed to the open internet.

Trusting the cert: The bundled slapd uses a self-signed cert unless you mount your own at /etc/openldap/certs. Clients must either trust that cert, or set TLS_REQCERT never / rejectUnauthorized: false for LAN-only use. See LDAP docs for the full runbook, including how to set ldapsHost in conf/secrets.js or via app_ldap__ldapsHost=....

Connection details

For a single app's own "LDAP authentication" settings — see Connecting a 3rd-party app or container for a field-by-field walkthrough (Gitea, generic Docker LDAP_* env vars, …).

LDAPS URL
<% if (ldapsHostExplicit) { %> Custom conf.ldap.ldapsHost — override in your secrets file if this name doesn't resolve from the client. <% } %>
Base DN
User search base
Group search base
User filter
Username attribute
Example bind DN
A read-only bind account — create one from Users > Service Accounts (don't reuse a real person's login or the admin DN).
Set up a Linux host (ldap-client)

For full host login, SSH keys, and sudo via LDAP (not just one app) — clone theta42/ldap-client and run this on the host. Fill in a service account's password (create one from Users > Service Accounts) and, if you want this host's access/sudo groups auto-registered, an API token from your Profile.

<%- include('bottom') %>