LDAP

LDAP Authentication integration provides the ability to authenticate your users directly against an LDAP service such as OpenLDAP or Active Directory.

LDAP Users are not imported into Form.io as Resources and exist only externally in LDAP. They still get assigned Form.io roles and can have ownership over forms and submissions.

Setup

To start using LDAP for your authentication, you will need the following parameters from your LDAP provider.

Setting	Description
Server URL	LDAP server URL, eg. ldaps://ldap.example.org:663
Bind DN	Admin connection DN, e.g. uid=myapp,ou=users,dc=example,dc=org.
Bind Password	Password for bindDN.
Search Base	The base DN from which to search for users by username. E.g. ou=users,dc=example,dc=org
Search Filter	LDAP search filter with which to find a user by username, e.g. (uid={{username}}). Use the literal {{username}} to have the given username interpolated in for the LDAP search.

Test Configurations

If you wish to simply test the LDAP functionality, you can use the following parameters:

• Server URL: ldap://ldap.forumsys.com:389

• Bind DN: cn=read-only-admin,dc=example,dc=com

• Bind Password: password

• Search Base: dc=example,dc=com

• Search Filter: (uid={{username}})

With these configurations, you should then be able to use the following login credentials.

• Username: einstein

• Password: password

Project Configuration

Once you have these configurations, you can setup LDAP within your Project Settings like so.

By default Form.io uses email addresses to login in users so using the email attribute in the search filter is recommended unless you change the User Login form to match the search filter. For example (mail={{username}})

LDAP user accounts are created and managed outside of the Form.io environment. Users attempting to view their account information from the Portal UI will receive an Error since Form.io does not manage this information. Create and manage LDAP accounts from the LDAP service provider or contact your system administrator.

Click Save Project Settings once you have these values set.

LDAP Login Form

Next, we will create a new form that will be used to Login to LDAP. We can do this by clicking on New Form, and then building it as follows.

Click Create Form button to create the new form.

LDAP Login Form Access

You will now need to ensure that Anonymous users are able to "submit" this form, which will execute the actions assigned to the form. You can do this by clicking on the Access settings and adding the Anonymous role to the Create Own permission.

LDAP Login Action

Next, we will navigate to the Actions section of our form and first Remove the Save Submission Action.

After we have done, that we will add the LDAP Login action as follows.

Within the LDAP Login Action, you will then configure the following parameters.

If you choose the Passthrough option, any failures except for a failure to Bind the user account, will be ignored and the login information will be passed to the next form action. This allows using both LDAP and the Form.io Login action on the same form.

Assign Roles

Next map any LDAP properties to user roles. Select the property, the matching value and the role to assign it true. Leave LDAP Property and Value blank to assign the role to all LDAP accounts.

For example:

• LDAP Property: group

• Value: Admins

• Role: Admin

Would assign the Admin role to any members of the Admins group.

The user’s DN is also mapped to the list of properties so if the DN is dn=myname,ou=admins,dc=example,dc=org you can do:

• LDAP Property: ou

• Value: admins

• Role: Admin

After you have the Login action set, you can save this action to add this to the form.

Testing LDAP Login

If you provided the Test Credentials at the top of the page, then you should be able to perform the following API request within Postman to perform and test out an LDAP login.

Here you will see that the Authenticated role has been assigned to the user object.