Skip to main content

​
Introduction

TIB supports Lightweight Directory Access Protocol (LDAP) and Active Directory using the ADProvider method, which uses a passthrough flow; user credentials are submitted directly to TIB, which validates them against your LDAP server. No browser redirect to an external IdP is involved. Because LDAP is a passthrough flow, you must provide a login page that submits credentials to TIB. Tyk Dashboard and Tyk Developer Portal do not include a built-in LDAP login page. Before configuring your TIB profile, read Dashboard SSO or Portal SSO to understand the ActionType, ReturnURL, and IdentityHandlerConfig fields required for your use case.

​
TIB Profile

The LDAP-specific configuration goes in the ProviderConfig block of the TIB profile. Set ProviderName to ADProvider and Type to passthrough. 
{
  "ProviderName": "ADProvider",
  "Type": "passthrough",
  "ProviderConfig": {
    "LDAPServer": "{ldap-server-hostname}",
    "LDAPPort": "389",
    "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com",
    "LDAPBaseDN": "dc=example,dc=com",
    "LDAPFilter": "(objectClass=person)",
    "LDAPEmailAttribute": "mail",
    "LDAPFirstNameAttribute": "givenName",
    "LDAPLastNameAttribute": "sn",
    "LDAPAttributes": [],
    "FailureRedirect": "http://{failure-redirect-url}",
    "GetAuthFromBAHeader": true
  }
}
The LDAP-specific ProviderConfig fields are:
FieldDescription
LDAPServerHostname or IP address of your LDAP server.
LDAPPortPort of your LDAP server. Use 389 for standard LDAP or 636 for LDAPS.
LDAPUserDNDistinguished Name template used to bind as the authenticating user. The literal string *USERNAME* is replaced at runtime with the submitted username.
LDAPBaseDNBase DN from which LDAP searches are performed.
LDAPFilterLDAP search filter applied when looking up users.
LDAPEmailAttributeLDAP attribute containing the user’s email address. Defaults to mail.
LDAPFirstNameAttributeLDAP attribute containing the user’s first name. Defaults to givenName.
LDAPLastNameAttributeLDAP attribute containing the user’s last name. Defaults to sn.
LDAPAttributesAdditional LDAP attributes to retrieve. Can be an empty list.
LDAPUseSSLSet to true to connect using LDAPS.
LDAPAdminUserDN of an admin user for performing user-lookup searches, if required.
LDAPAdminPasswordPassword for the admin user.
LDAPSearchScopeDepth of the LDAP search: 0 for base object only, 1 for single level below the base DN, 2 for the entire subtree. Defaults to 2.
DefaultDomainDomain appended to the username when building the full user identifier. Used to construct the username but not for performing LDAP requests.
FailureRedirectURL to redirect the user to on authentication failure.
GetAuthFromBAHeaderSet to true to read the username and password from the HTTP Basic Auth header. Recommended for form-based login pages.
SlugifyUserNameSet to true to normalize the username to a URL-safe slug.

​
Login Page

Since LDAP is a passthrough flow, users submit credentials directly to TIB via a form POST. Create a login page with a form that posts to the TIB authentication endpoint: 
<form method="POST" action="http://{tib-host}/auth/{profile-id}/ADProvider">
  <input type="text" name="username" />
  <input type="password" name="password" />
  <button type="submit">Log in</button>
</form>
The form must use POST method and include username and password fields. TIB reads these field names exactly. For embedded TIB, {tib-host} is the same as your Dashboard or Portal host.

​
Worked Examples

In this example, Tyk Dashboard is running at http://dashboard.example.com on port 3000; replace the example values with your own.Tyk Dashboard configuration
{
  "sso_enable_user_lookup": true,
  "sso_permission_defaults": {
    "apis": "write",
    "keys": "write",
    "policies": "write"
  },
  "sso_default_group_id": "{tyk-user-group-id}"
}
With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in sso_default_group_id. See Dashboard SSO for full details.TIB profileThe TIB profile is created via the Tyk Identity Broker API or the Tyk Dashboard UI.
{
  "ID": "ldap-dashboard",
  "Name": "LDAP Dashboard SSO",
  "OrgID": "{tyk-org-id}",
  "ActionType": "GenerateOrLoginUserProfile",
  "Type": "passthrough",
  "ProviderName": "ADProvider",
  "ReturnURL": "http://dashboard.example.com:3000/tap",
  "IdentityHandlerConfig": {
    "DashboardCredential": "{tib-service-user-api-key}"
  },
  "ProviderConfig": {
    "LDAPServer": "ldap.example.com",
    "LDAPPort": "389",
    "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com",
    "LDAPBaseDN": "dc=example,dc=com",
    "LDAPFilter": "(objectClass=person)",
    "LDAPEmailAttribute": "mail",
    "LDAPFirstNameAttribute": "givenName",
    "LDAPLastNameAttribute": "sn",
    "LDAPAttributes": [],
    "FailureRedirect": "http://dashboard.example.com:3000/?fail=true",
    "GetAuthFromBAHeader": true
  }
}
  • set DashboardCredential to the TIB service account’s Dashboard credentials
  • update LDAPUserDN to match your LDAP directory structure, keeping *USERNAME* as a literal placeholder
Login page form actionYour login page form should POST to:
http://dashboard.example.com:3000/auth/ldap-dashboard/ADProvider
Redirect to login pageTo redirect users to your custom login page instead of the default Dashboard login, set sso_custom_login_url in the Tyk Dashboard configuration:
{
  "sso_custom_login_url": "http://{your-login-page-url}"
}
See Dashboard SSO for details on session behavior, permissions, and user group mapping.