Skip to main content
The LDAP Authentication connector integrates the Maverics Orchestrator with LDAP-based directory services — enabling user authentication via LDAP bind operations. For attribute-only lookups without authentication, see LDAP Attribute Provider. For Microsoft Active Directory environments, see the dedicated Active Directory connector.
Console terminology: In the Maverics Console, this section is called Identity Fabric. The YAML configuration uses the connectors key to define identity provider integrations.

​
Overview

The LDAP Authentication connector supports both LDAP and LDAPS (LDAP over TLS) protocols for secure directory integration. It authenticates end users via LDAP bind operations against the directory. For attribute-only lookups without authentication, see the LDAP Attribute Provider.

​
Use Cases

  • Legacy app SSO with on-premises directories — Extend single sign-on to applications that authenticate against LDAP directories, without rewriting the application or migrating users out of the directory
  • IdP consolidation for LDAP-dependent apps — Route authentication through the Orchestrator so LDAP-bound applications can participate in a unified authentication layer, reducing the need for standalone LDAP integrations per app
  • Hybrid identity bridge — Combine LDAP bind authentication with cloud IdP sessions so users in on-premises directories can access both legacy and modern applications through a single login experience
  • Combined authentication and attribute retrieval — Authenticate users and retrieve directory attributes (group memberships, email, department) in a single connector for header injection or policy evaluation

​
Setup

To create an LDAP Authentication connector in the Maverics Console:Settings
  1. Navigate to Identity Fabric in the Console sidebar.
  2. Click Create and select LDAP Authentication.
  3. Enter a Name for the connector.
  4. Enter the URL of the LDAP server (e.g., ldaps://ldap.example.com:636).
  5. Enter the Service Account Username (bind DN used to connect to the server).
  6. Enter the Service Account Password.
  7. Enter the Base DN for LDAP searches (e.g., dc=example,dc=com).
  8. Enter the Username Search Key — the attribute used to filter on during query and bind operations (e.g., uid for OpenLDAP, sAMAccountName for AD).
  9. Optionally select an Authentication Search Scope from the dropdown to control the search depth (e.g., wholeSubtree).
  10. Click Save.
Template and AssetsTo configure a custom login page with localization:
  1. In the connector settings, scroll to the Template and Assets section.
  2. Upload a Template File — an HTML file using Go Template syntax that renders the login form (e.g., ldap-login.html).
  3. Under Methods, configure the language parsing method:
    • Parsing Method Type — How the Orchestrator determines the user’s language. Options include http.request.header (from the Accept-Language header) or http.request.query (from a URL query parameter).
    • Parsing Method Name — The specific header or query parameter name to read the language from (e.g., Accept-Language for headers, or ui_local for a query parameter).
  4. Under Localization, add one or more language entries:
    • Language — A BCP 47 language tag (e.g., en, fr, es).
    • Upload the corresponding JSON localization file for each language.
  5. Click Save.

​
Custom Login Page

When customLogin.templateFile is configured, the Orchestrator serves a custom HTML page for LDAP authentication instead of the default login form. The template file uses Go Template syntax with the following variables:
VariableTypeDescription
.LoginURLstringThe URL the form must POST credentials to
.RedirectURLstringThe originally requested URL — include as a hidden form field so the user is redirected after login
.ErrorstringAn error message if the previous login attempt failed (empty on first load)
.LanguagestringThe resolved BCP 47 language tag for the current request
.LocalizationobjectThe parsed localization data from the JSON file matching the current language
The login form must submit a POST request to {{ .LoginURL }} with the following form fields:
  • username — the user’s login name
  • password — the user’s password
  • redirectURL — the value of {{ .RedirectURL }}
Example template:
ldap-login.html
<!DOCTYPE html>
<html lang="{{ .Language }}">
<head>
    <meta charset="UTF-8">
    <title>{{ .Localization.title }}</title>
</head>
<body>
    <h1>{{ .Localization.title }}</h1>

    {{ if .Error }}
    <div class="error">{{ .Localization.error }}</div>
    {{ end }}

    <form method="POST" action="{{ .LoginURL }}">
        <input type="hidden" name="redirectURL" value="{{ .RedirectURL }}">
        <label>{{ .Localization.username }}</label>
        <input type="text" name="username" required>
        <label>{{ .Localization.password }}</label>
        <input type="password" name="password" required>
        <button type="submit">{{ .Localization.submit }}</button>
    </form>
</body>
</html>

​
Localization

The custom login page supports standards-based language localization using BCP 47 language tags. The Orchestrator determines the user’s preferred language and loads the corresponding localization file, making its contents available as .Localization in the Go Template.

​
Language Detection

The customLogin.parseLanguageFrom block controls how the Orchestrator determines the user’s preferred language:
  • http.request.header — Parses the language from an HTTP request header. Set name to Accept-Language to use the browser’s default language preference.
  • http.request.query — Parses the language from a URL query parameter. Set name to the query parameter name (e.g., ui_local for URLs like ?ui_local=fr).
If the detected language does not match any configured localization, the Orchestrator falls back to the first localization entry.

​
Localization File Format

Each localization file is a JSON object with key-value pairs. The keys are referenced in the Go Template as fields on .Localization:
en.json
{
  "title": "Login",
  "username": "Username",
  "password": "Password",
  "submit": "Sign In",
  "error": "Invalid username or password. Please try again."
}
fr.json
{
  "title": "Connexion",
  "username": "Nom d'utilisateur",
  "password": "Mot de passe",
  "submit": "Se connecter",
  "error": "Nom d'utilisateur ou mot de passe invalide. Veuillez réessayer."
}
Reference localization values in the template using {{ .Localization.<key> }} (e.g., {{ .Localization.title }}).

​
Troubleshooting

  • Test LDAP connectivity from the Orchestrator host — Use ldapsearch or a similar tool to verify the Orchestrator can reach the LDAP server on the configured port. Network firewalls or DNS issues are common causes of connection failures.
  • Verify the service account has read permissions on the baseDN — The bind DN specified in serviceAccountUsername must have sufficient permissions to search the baseDN subtree and read the attributes listed in userAttributes.
  • For LDAPS, ensure the TLS profile includes the correct CA certificate — If the LDAP server uses a private CA, the TLS profile referenced by the tls field must include the CA certificate via caFile. Self-signed certificates require insecureSkipVerify: true (not recommended for production).
  • Check attribute names in mapping — LDAP attribute names are case-insensitive in the protocol but must match the directory schema. Common sources of confusion: mail vs email, cn vs commonName, sAMAccountName vs uid.
  • Custom login page not rendering — Verify that the customLogin.templateFile path is correct and the file is readable by the Orchestrator process. Check Orchestrator logs for template parsing errors.
  • Localization not switching languages — Confirm that the parseLanguageFrom.type and parseLanguageFrom.name values match how your application sends language preferences. Verify the BCP 47 tags in the localization map match the tags sent by the client.

LDAP Attribute Provider

LDAP attribute lookups without authentication

Active Directory

LDAP-based connector optimized for Active Directory environments

Identity Fabric

Overview of all identity providers

Continuity

IdP failover connector