> For the complete documentation index, see [llms.txt](https://docs.aqua-cloud.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aqua-cloud.io/documentation/integrations/sso/ldap.md).

# LDAP

Enable LDAP SSO integration for secure, centralized user authentication. Learn setup steps and best practices for configuring LDAP with your platform.

Users in aqua can be authenticated via LDAP. Precondition: the user has been created in aqua before, that is, the given username exists in both systems, in aqua and in LDAP.&#x20;

If you have many users, you can also use the following script to initially or recurring retrieve users from LDAP and create them in aqua.&#x20;

{% file src="/files/krzynw6WRQWixGtgU9xK" %}

You can also create your own custom scripts via the aqua REST API to create the users.&#x20;

### **Installation** <a href="#installation" id="installation"></a>

First, stop the server. To do so, open the IIS-Manager on Microsoft Server.

<figure><img src="http://aquawiki.andagon.com/pictures/drex_ldap_custom.png" alt=""><figcaption></figcaption></figure>

Click on 'aquaAPIPool' and stop it with the button on the right side first.After that please stop 'aquaFileServerPool', 'aquaWebservicePool' and (if installed) 'aquaWebNGAppPool'.Your Server is stopped now.&#x20;

### **Configuration** <a href="#configuration" id="configuration"></a>

Open Web.config file of aqua Backend. It is usually located here: C:\Program Files\andagon GmbH\aqua For IIS\Web\Webservice&#x20;

| LDAP.ServerAddress         | LDAP Server Address (IP or hostname without any prefixes)                           |
| -------------------------- | ----------------------------------------------------------------------------------- |
| LDAP.ServerPort            | LDAP Server Port                                                                    |
| LDAP.UseSSL                | defines if communication should be SSL-encrypted (if supported by your LDAP-server) |
| LDAP.BaseDN                | defines a distinguished-name of branch where to look for aqua users (recursively)   |
| LDAP.UsernameFilter        | Filter for username in LDAP                                                         |
| LDAP.DiscoveryUserDN       | (optional) username to LDAP if authentication is required                           |
| LDAP.DiscoveryUserPassword | (optional) password to LDAP if authentication is required                           |

```xml
  ...
  <configSections>
    <section name="CompatibleClients" type="aqua.Server.Configuration.CompatibleClientSection, aquaUtils" />
  </configSections>
 
  <appSettings>
    ...
    <add key="LDAP.ServerAddress" value="192.168.56.101" />
    <add key="LDAP.ServerPort" value="389" />
    <add key="LDAP.UseSSL" value="false" />
    <add key="LDAP.BaseDN" value="ou=aqua,dc=andagon,dc=com " />
    <add key="LDAP.UsernameFilter" value="uid={0}" />
    <add key="LDAP.DiscoveryUserDN" value="" />
    <add key="LDAP.DiscoveryUserPassword" value="" />
  </appSettings>
  ...
 
```

Save and close Web.config&#x20;

### **Start aqua Server** <a href="#start_aqua_server" id="start_aqua_server"></a>

After configuration, you can start your aqua server. Go back to IIS-Manager and start  'aquaAPIPool, 'aquaFileServerPool', 'aquaWebservicePool'.\
\
\
**Configuring multiple LDAP servers**\
You can connect up to 50 different LDAP servers with aqua. Each will be checked one-by-one, when authenticating the users. The configuration can be extended by adding a proper index in the key names of the configuration. The indexes will define, in which order the servers are taken for authentication. You can give any index you like, from 1-50, for example:   &#x20;

{% code overflow="wrap" %}

```xml
<add key="LDAP.1.ServerAddress" value="aquatest-ldap" />    
<add key="LDAP.1.ServerPort" value="389" />    
<add key="LDAP.1.UseSSL" value="false" />   
<add key="LDAP.1.BaseDN" value="ou=aqua,dc=aquatest-ldap,dc=andagon,dc=com" />    
<add key="LDAP.1.UsernameFilter" value="uid={0}" />    
<add key="LDAP.1.DiscoveryUserDN" value="" />    
<add key="LDAP.1.DiscoveryUserPassword" value="" /> 
```

{% endcode %}

In order to configure multiple servers, just copy the configuration as often as needed and change the indexes and addresses. We keep backward compatibility with previous configuration. Old configurations will work without the necessity to change them.

### Active Directory Authentication Module&#x20;

The Active Directory authentication module can be activated by providing the `ActiveDirectory.Domain`  in aqua server parameter configuration.&#x20;

&#x20;Please see the [aqua server parameters](/documentation/installation-for-on-premise/server-parameters.md) for more details.&#x20;


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.aqua-cloud.io/documentation/integrations/sso/ldap.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
