LDAP
Configure LDAP authentication so users sign in to FOSSA with their corporate directory credentials.
Enterprise feature
Contact your FOSSA account team to enable LDAP for your organization.
Overview
LDAP authentication lets your users sign in to FOSSA with their existing corporate directory credentials. FOSSA connects to your directory with a read-only service account, verifies each user at login, provisions their FOSSA account automatically on first sign-in, and can synchronize Teams from your directory groups.
To configure LDAP, you need details about how to reach your directory server and how your users and groups are structured. Before you start, open FOSSA's authentication settings in another tab: go to Settings → Organization → Authentication.
Configuring LDAP authentication
- 1
Open your authentication settings
Go to Settings → Organization → Authentication and choose LDAP.
- 2
Enter your server connection details
Provide your directory's host, port, and SSL setting. See Server settings below.
- 3
Add bind credentials
Provide the read-only account FOSSA uses to connect. See Bind credentials below.
- 4
Configure the user schema
Tell FOSSA where to find users and which attributes hold their email and name. See User schema settings below.
- 5
Synchronize teams from directory groups (optional)
Enable Synchronize teams and configure your group schema to mirror directory groups as FOSSA Teams. See Group and team sync settings below.
- 6
Test the connection
Click Test Connection. FOSSA simulates a user login and shows the information returned by your directory, so you can confirm your settings before saving.
- 7
Save your configuration
Once the test succeeds, save your changes to enable LDAP authentication for your organization.
Server settings
| Setting | Description |
|---|---|
| Hostname or IP Address | The host where your directory is reachable, for example ldap.example.com or ad.example.com. |
| Port | The port your directory server listens on, for example 389, or 636 for SSL. |
| Use SSL | Enable this to connect to your directory over SSL. |
Bind credentials
FOSSA uses these credentials to open a read-only connection to your directory, enough to verify that the authenticating user exists and, optionally, which groups they belong to.
| Setting | Description |
|---|---|
| Distinguished Name | The distinguished name of the account FOSSA uses to connect to your directory server. |
| Secret | The password for that account. |
User schema settings
| Setting | Description |
|---|---|
| User Base Distinguished Name | The root DN for user search queries, for example dc=example,dc=com or o=fossa-users,dc=example,dc=com. |
| User Search Filter | The filter used to find a user. Must include {{username}}, which FOSSA replaces with the login username, for example (uid={{username}}) or (&(objectCategory=Person)(uid={{username}})). |
| User Email attribute | The attribute that holds the user's email, for example mail. |
| Name attribute | The attribute that holds the user's display name, for example cn or displayName. |
| Username attribute | The attribute that holds the user's username. Self-hosted deployments only. |
Group and team sync settings
When Synchronize teams is enabled, FOSSA creates a Team for each group your directory returns and adds the user to it. If a user is later removed from a group in your directory, FOSSA removes them from the matching Team on their next login.
| Setting | Description |
|---|---|
| Synchronize teams | Enable to create FOSSA Teams from your directory groups and keep membership in sync at each login. |
| Group Base Distinguished Name | The root DN for group search queries, for example dc=example,dc=com or o=fossa-users,dc=example,dc=com. |
| Group Name attribute | The attribute that holds the group's name, for example cn. |
| Group DN attribute | The attribute from the user object used to find the user's group membership, for example dn. |
| Group Search Filter | The filter used to find a user's groups. May include {{username}} or {{dn}} (the user attribute named above), for example (&(objectclass=group)(uniqueMember={{username}})) or (&(objectclass=groupOfUniqueNames)(uniqueMember={{dn}})). |
How your users sign in
After you save your LDAP configuration, users sign in with their directory username and password at your organization's subdomain (your-org.fossa.app). FOSSA verifies each user against your directory and creates their FOSSA account automatically on first login.
Note
Synchronized Teams appear in FOSSA just like manually created ones. To control what their members can do, see role-based access control.