> For the complete documentation index, see [llms.txt](https://docs.rierino.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rierino.com/devops/api-event-and-process-flows/configuring-saga-steps/event-step/gateway-actions/authenticate/ldap-based.md). # LDAP Based Authenticates users against an LDAP directory and issues Rierino JWTs ## LDAP Based Actions ### Login Authenticates the user with a bind against the directory and returns the token set. Only `password` is accepted as `grant_type`, which is also the default when the field is absent. Both `username` and `password` are mandatory. A blank password is an *unauthenticated* bind under RFC 4513 and most directories answer success to it, so it is rejected before reaching the server. The username is passed as a filter argument and escaped per RFC 4515, so values such as `*` or `)(uid=admin` cannot rewrite the search. Request fields are `grant_type`, `username` and `password`; the response carries `access_token`, `expires_in`, `refresh_token`, `refresh_expires_in`, and `id_token` when the system has `idToken` enabled. {% tabs %} {% tab title="Table" %} | Field | Definition | Example | Default | | ------------- | ---------------------------------------- | ------- | ------- | | Input Element | Json path for the input in event payload | auth | - | | {% endtab %} | | | | | {% endtab %} | | | | {% tab title="JSON Schema" %} ```json { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "LDAP Based Login action eventMeta fields", "type": "object", "properties": { "eventMeta": { "type": "object", "properties": { "inputElement": { "type": "string", "definition": "Json path for the input in event payload", "example": "auth", "default": null } } } } } ``` {% endtab %} {% endtabs %} ### Validate Validates the `access_token` and, when provided, the `id_token`. Each token must carry the matching `token_use` claim. {% tabs %} {% tab title="Table" %} | Field | Definition | Example | Default | | ------------- | ---------------------------------------- | ------- | ------- | | Input Element | Json path for the input in event payload | auth | - | | {% endtab %} | | | | | {% endtab %} | | | | {% tab title="JSON Schema" %} ```json { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "LDAP Based Validate action eventMeta fields", "type": "object", "properties": { "eventMeta": { "type": "object", "properties": { "inputElement": { "type": "string", "definition": "Json path for the input in event payload", "example": "auth", "default": null } } } } } ``` {% endtab %} {% endtabs %} ### Refresh Exchanges a `refresh_token` for a new token set. The subject is taken from the `sub` claim, falling back to `username`. When the system has `adminBindDn` configured, the directory is read again so revoked group memberships and deleted accounts take effect on refresh, and a user who no longer exists is rejected. Without a service account the attribute snapshot carried in the refresh token is reused instead, so role changes only take effect once the refresh token expires. {% tabs %} {% tab title="Table" %} | Field | Definition | Example | Default | | ------------- | ---------------------------------------- | ------- | ------- | | Input Element | Json path for the input in event payload | auth | - | | {% endtab %} | | | | | {% endtab %} | | | | {% tab title="JSON Schema" %} ```json { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "LDAP Based Refresh action eventMeta fields", "type": "object", "properties": { "eventMeta": { "type": "object", "properties": { "inputElement": { "type": "string", "definition": "Json path for the input in event payload", "example": "auth", "default": null } } } } } ``` {% endtab %} {% endtabs %} ### List Returns directory users page by page, using the service account. Requires `adminBindDn` and `adminBindPassword` on the system, and fails otherwise. Entries are searched with `(=*)` over the whole subtree below `ldapBaseDn`. The requested `limit` is capped at the configured `listLimit`, which is also used when no limit is given. When the id attribute is missing from an entry, its full name in namespace is used as the username. ### Get Returns a single user matched on `userIdAttribute`, together with the `roles` collected from group membership. Requires the service account, and an unknown id is reported as not found. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.rierino.com/devops/api-event-and-process-flows/configuring-saga-steps/event-step/gateway-actions/authenticate/ldap-based.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.