Skip to content
Roster Roster Roster Docs

LDAP Connector

The LDAP connector reads users, groups, and group membership from LDAP-compatible directories, including Active Directory when LDAP or LDAPS is the selected integration path.

Provider Path

Section titled “Provider Path”
LDAP v3 over LDAP or LDAPS

Typical operations:

bind
search users
search groups
read group members

Production Requirements

Section titled “Production Requirements”
  • LDAP or LDAPS endpoint reachable from Roster. Use ldaps:// for encrypted LDAP transport.
  • bind identity with read access to user, group, and membership entries
  • user and group search bases
  • user, group, and membership filters
  • TLS trust configuration for LDAPS
  • credential stored as an encrypted Roster provider secret

Prefer LDAPS. In the Platform connector form, the TLS option stores and uses an ldaps:// URL; a plain ldap:// URL is only appropriate for isolated directory sources that do not support a valid LDAPS certificate.

Secret Kinds

Section titled “Secret Kinds”

Supported secret kinds:

bind_password
certificate
private_key

Set provider-secret encryption before storing credentials:

ROSTER_PROVIDER_SECRET_ENCRYPTION_KEY=<generated-provider-secret-encryption-key>

Normalized Data

Section titled “Normalized Data”

The connector normalizes LDAP records into Roster directory users and groups:

queryUsers(query)
getUser(externalId)
queryGroups(query)
getGroup(externalId)
getGroupMembers(externalId, query)

Use field mappings to align LDAP attributes with Roster directory fields, then map users or groups to participants.

Nested Groups

Section titled “Nested Groups”

Roster follows readable group-to-group member or uniqueMember relationships within the configured search bases and object classes, up to 10 subgroup levels by default below the attached root (level 0). The server setting ROSTER_DIRECTORY_GROUP_MAX_DEPTH configures that limit. Users are resolved through all valid paths; shared groups and cycles do not duplicate users. memberUid continues to identify direct users and does not imply group nesting.

Active Directory multi-valued member attributes are read using range retrieval when necessary. LDAP paged searches and attribute ranges are different mechanisms. Immutable entryUUID or objectGUID evidence is retained without changing your existing field mappings or configured external IDs. A missing or unreadable referenced entry makes that group’s snapshot incomplete, rather than an empty group that could remove valid memberships.

Existing group associations gain subgroup members through scheduled refresh; no manual reattachment is required. Secondary LDAP connectors remain enrichment sources. AD primary-group and foreign-forest expansion are outside this path. See group expansion limits.