> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# LDAP connection

> Learn how to configure an LDAP Connection for Infisical.

Infisical supports the use of [Simple Binding](https://ldap.com/the-ldap-bind-operation) to connect with your LDAP provider.

## Prerequisites

You'll need the following information to establish an LDAP connection:

* **LDAP URL** - The LDAP/LDAPS URL to connect to (e.g., ldap\://domain-or-ip:389 or ldaps\://domain-or-ip:636)
* **Binding DN/UPN** - The Distinguished Name (DN), or User Principal Name (UPN) if supported, of the principal to bind with (e.g., 'CN=John,CN=Users,DC=example,DC=com')
* **Binding Password** - The password to bind with for authentication
* **CA Certificate** - The SSL certificate (PEM format) to use for secure connection when using ldaps\:// with a self-signed certificate

Depending on how you intend to use your LDAP connection, there may be additional requirements:

> [tab] Secret Rotation
>
> > [!NOTE]
> >
> > For Password Rotation, the following requirements must additionally be met:
> >
> > * You must use an LDAPS connection
> > * The binding user must either have:
> >   * Permission to change other users passwords if rotating directory users' passwords
> >   * Permission to update their own password if rotating their personal password

> [tab] Certificate Syncs
>
> > [!NOTE]
> >
> > To back a [Linux Server](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/linux-server.md) or [Windows Server](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/windows-server.md) certificate sync, the following requirements must additionally be met:
> >
> > * You must use an LDAPS connection, because a hardened domain controller rejects a plaintext simple bind on port 389
> > * Windows Server syncs must have a Gateway assigned to this connection, and that Gateway must reach both the domain controller and the target servers
> > * Each target host must accept the binding account in `DOMAIN\user` form, which Infisical derives from the directory
>
> > [!NOTE]
> >
> > A sync authenticates to its **Target Host** with this connection's credential. Application Admins can set it, so give the binding account only the access it needs to deliver certificates.

## Setup LDAP connection in Infisical

> [tab] Infisical UI
>
> 1. Navigate to the **Integrations** tab in the desired project, then select **App Connections**.
>
>    ![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)
>
> 2. Select the **LDAP Connection** option.
>
>    ![Select LDAP Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ldap/select-ldap-connection.png)
>
> 3. Select the **Simple Bind** method option and provide the details obtained from the previous section and press **Connect to Provider**.
>
>    ![Create LDAP Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ldap/create-simple-bind-method.png)
>
> 4. Your **LDAP Connection** is now available for use.
>
>    ![Assume Role LDAP Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ldap/simple-bind-connection.png)

> [tab] API
>
> To create an LDAP Connection, make an API request to the [Create LDAP
> Connection](https://infisical.com/docs/api-reference/endpoints/app-connections/ldap/create.md) API endpoint.
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl    --request POST \
>     --url https://app.infisical.com/api/v1/app-connections/ldap \
>     --header 'Content-Type: application/json' \
>     --data '{
>         "name": "my-ldap-connection",
>         "method": "simple-bind",
>         "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
>         "credentials": {
>             "provider": "active-directory",
>             "url": "ldaps://domain-or-ip:636",
>             "dn": "CN=John,CN=Users,DC=example,DC=com",
>             "password": "<your-secure-password>",
>             "sslRejectUnauthorized": true,
>             "sslCertificate": "..."
>         }
>     }'
> ```
>
> ### Sample response
>
> ```bash Response theme={"dark"}
> {
>     "appConnection": {
>         "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "name": "my-ldap-connection",
>         "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
>         "version": 1,
>         "orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>         "createdAt": "2023-11-07T05:31:56Z",
>         "updatedAt": "2023-11-07T05:31:56Z",
>         "app": "ldap",
>         "method": "simple-bind",
>         "credentials": {
>             "provider": "active-directory",
>             "url": "ldaps://domain-or-ip:636",
>             "dn": "CN=John,CN=Users,DC=example,DC=com",
>             "sslRejectUnauthorized": true,
>             "sslCertificate": "..."
>         }
>     }
> }
> ```

## Automatic credential rotation

Infisical can automatically rotate the binding password of your LDAP connection on a recurring schedule. This is a **single-phase** rotation, meaning only one password exists at any given time. When a rotation occurs, the old password is replaced immediately.

> [!WARNING]
>
> Any external systems using the same binding credentials will lose access once a rotation completes. Make sure only Infisical relies on the rotated credentials.

When creating or editing your LDAP connection, toggle on the **Automatic Credential Rotation** switch and configure the rotation schedule.

![LDAP Automatic Credential Rotation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ldap/credential-rotation.png)

* **Rotation Interval** - How many days between each rotation.
* **Rotate At** - The local time of day at which the rotation will be triggered.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.