> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# JumpCloud LDAP

> Learn how to configure JumpCloud LDAP for authenticating into Infisical.

> [!NOTE]
>
> SSO authentication requires [Email Domain Verification](https://infisical.com/docs/documentation/platform/email-domain.md).
> You must verify your organization's email domain before users can log in via SSO.

> [!NOTE]
>
> LDAP is a paid feature. If you're using Infisical Cloud, then it's available
> under the **Enterprise Tier**. If you're self-hosting Infisical, then you
> should contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise license to use
> it.

Prerequisites:

* You must have an email address to use LDAP, regardless of whether or not you use that email address to sign in.

**1. Prepare LDAP in JumpCloud**

In JumpCloud, head to USER MANAGEMENT > Users and create a new user via the **Manual user entry** option. This user
will be used as a privileged service account to facilitate Infisical's ability to bind/search the LDAP directory.

When creating the user, input their **First Name**, **Last Name**, **Username** (required), **Company Email** (required), and **Description**.
Also, create a password for the user.

Next, under User Security Settings and Permissions > Permission Settings, check the box next to **Enable as LDAP Bind DN**.

![LDAP JumpCloud](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/ldap/jumpcloud/ldap-jumpcloud-enable-bind-dn.png)

**2. Prepare the LDAP configuration in Infisical**

In Infisical, head to **SSO & Provisioning** and select the **SSO** tab. Select **Add Provider**, choose **LDAP** in the **Add Identity Provider** modal, then select **Continue** to open the **Manage LDAP Configuration** form.

Input your JumpCloud LDAP server settings.

![LDAP configuration](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/ldap/ldap-config.png)

Here's some guidance for each field:

* URL: The LDAP server to connect to (`ldaps://ldap.jumpcloud.com:636`).
* Bind DN: The distinguished name of object to bind when performing the user search (`uid=<ldap-user-username>,ou=Users,o=<your-org-id>,dc=jumpcloud,dc=com`).
* Bind Pass: The password to use along with `Bind DN` when performing the user search.
* User Search Base / User DN: Base DN under which to perform user search (`ou=Users,o=<your-org-id>,dc=jumpcloud,dc=com`).
* Unique User Attribute: The attribute to use as the unique identifier of LDAP users such as `sAMAccountName`, `cn`, `uid`, `objectGUID` ... If left blank, defaults to `uidNumber`
* User Search Filter (optional): Template used to construct the LDAP user search filter (`(uid={{username}})`).
* Group Search Base / Group DN (optional): LDAP search base to use for group membership search (`ou=Users,o=<your-org-id>,dc=jumpcloud,dc=com`).
* Group Filter (optional): Template used when constructing the group membership query (`(&(objectClass=groupOfNames)(member=uid={{.Username}},ou=Users,o=<your-org-id>,dc=jumpcloud,dc=com))`)
* CA Certificate: The CA certificate to use when verifying the LDAP server certificate (instructions to obtain the certificate for JumpCloud [here](https://jumpcloud.com/support/connect-to-ldap-with-tls-ssl)).

> [!TIP]
>
> When filling out the **Bind DN** and **Bind Pass** fields, refer to the username and password of the user created in Step 1.
>
> Also, for the **Bind DN** and **Search Base / User DN** fields, you'll want to use the organization ID that appears
> in your LDAP instance **ORG DN**.

**3. Test the LDAP connection**

Once you've filled out the LDAP configuration, you can test that part of the configuration is correct by pressing the **Test Connection** button.

Infisical will attempt to bind to the LDAP server using the provided **URL**, **Bind DN**, and **Bind Pass**. If the operation is successful, then Infisical will display a success message; if not, then Infisical will display an error message and provide a fuller error in the server logs.

![LDAP test connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/ldap/ldap-test-connection.png)

**4. Define mappings from LDAP groups to groups in Infisical**

In order to sync LDAP groups to Infisical, head to the **LDAP Group Mappings** section to define mappings from LDAP groups to groups in Infisical.

![LDAP group mappings section](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/ldap/ldap-group-mappings-section.png)

Group mappings ensure that users who log into Infisical via LDAP are added to or removed from the Infisical group(s) that corresponds to the LDAP group(s) they're a member of.

![LDAP group mappings table](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/ldap/ldap-group-mappings-table.png)

Each group mapping consists of two parts:

* LDAP Group CN: The common name of the LDAP group to map.
* Infisical Group: The Infisical group to map the LDAP group to.

For example, suppose you want to automatically add a user who is part of the LDAP group with CN `Engineers` to the Infisical group `Engineers` when the user sets up their account with Infisical.

In this case, you would specify a mapping from the LDAP group with CN `Engineers` to the Infisical group `Engineers`.
Now when the user logs into Infisical via LDAP, Infisical will check the LDAP groups that the user is a part of whilst referencing the group mappings you created earlier. Since the user is a member of the LDAP group with CN `Engineers`, they will be added to the Infisical group `Engineers`.
In the future, if the user is no longer part of the LDAP group with CN `Engineers`, they will be removed from the Infisical group `Engineers` upon their next login.

> [!NOTE]
>
> Prior to defining any group mappings, ensure that you've created the Infisical groups that you want to map the LDAP groups to.
> You can read more about creating (user) groups in Infisical [here](https://infisical.com/docs/documentation/platform/groups.md).

**5. Enable LDAP in Infisical**

Enabling LDAP allows members in your organization to log into Infisical via LDAP.

![LDAP toggle](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/ldap/ldap-toggle.png)

Resources:

* [JumpCloud Cloud LDAP Guide](https://jumpcloud.com/support/use-cloud-ldap)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.