# Update LDAP Config. Endpoint: PUT /management/ldap-config Version: 3.17.0 Security: ApiKeyAuth ## Security: - `ApiKeyAuth` (unknown) apiKey in header Authorization ## Request body: - `application/json` (unknown) The parameters to update the LDAP config. ## Request fields (application/json): - `enabled` (boolean) When set, these settings are enabled. True by default. Example: true - `auto_create_users` (boolean) When set, the system will automatically create new Accounts for those who have logged in using LDAP. This must be true if LDAP user is not already registered in system. True by default. Example: true - `hostname` (string) The hostname of the LDAP server. Example: ldap.server.com - `port` (integer) The port of the LDAP server. Default port is 389 for non-SSL and 636 for SSL. Example: 389 - `domains` (array) DCT will try to authenticate using each Domain given in this list. - `domains.msad_domain_name` (string) This is used to get full DN for authentication and search. Provide this value only if server is microsoft AD. Example: msad.domain.com - `domains.username_pattern` (string) The username_patterns can be used to avoid providing full-dn during login. This will also be used for search of groups,email, first name and last name. Example: uid={0},ou=Users - `domains.search_base` (string) Search base used to search for ldap user groups. Leave this field empty if a full username_pattern is provided and server is non microsoft AD. Example: DC=test,DC=delphix,DC=com - `domains.group_attr` (string) Group mapped attribute on ldap side used for user group search. Example: gidNumber - `domains.email_attr` (string) Email mapped attribute on ldap side used for mapping on DCT side account. Example: mail - `domains.first_name_attr` (string) First name attribute mapped on ldap side used for mapping on DCT side account. Example: cn - `domains.last_name_attr` (string) Last name attribute mapped on ldap side used for mapping on DCT side account. Example: sn - `domains.object_class_attr` (string) The name of the objectClass on ldap side under which the user is mapped.This is used to search for the user details. Example: person - `domains.search_attr` (string) Search attribute mapped on ldap side using which search on ldap side will be made. Example: uid - `enable_ssl` (boolean) True if LDAP should be used over SSL. Example: false - `truststore_filename` (string) File name of a truststore which can be used to validate the TLS certificate of the LDAP server. The truststore must be available at /etc/config/certs/ - `truststore_password` (string) Password for reading trustStore file provided in 'truststore_filename' property - `insecure_ssl` (boolean) Allow connections to the LDAP server over LDAPS without validating the TLS certificate. Even though the connection to the server might be performed over LDAPS, setting this property eliminates the protection against a man-in-the-middle attach for connections to this server. Instead, consider creating a truststore with a Certificate Authority to validate the server's certificate, and set the truststore_filename property. - `unsafe_ssl_hostname_check` (boolean) Ignore validation of the name associated to the TLS certificate when connecting to the LDAP server over LDAPS. Setting this value must only be done if the TLS certificate of the server does not match the hostname, and the TLS configuration of the server cannot be fixed. Setting this property reduces the protection against a man-in-the-middle attack for connections to this server. This is ignored if insecure_ssl is set. ## Response 200: - `200` (unknown) OK ## Response 200 fields (application/json): - `enabled` (boolean) When set, these settings are enabled. True by default. Example: true - `auto_create_users` (boolean) When set, the system will automatically create new Accounts for those who have logged in using LDAP. This must be true if LDAP user is not already registered in system. True by default. Example: true - `hostname` (string) The hostname of the LDAP server. Example: ldap.server.com - `port` (integer) The port of the LDAP server. Default port is 389 for non-SSL and 636 for SSL. Example: 389 - `domains` (array) DCT will try to authenticate using each Domain given in this list. - `domains.msad_domain_name` (string) This is used to get full DN for authentication and search. Provide this value only if server is microsoft AD. Example: msad.domain.com - `domains.username_pattern` (string) The username_patterns can be used to avoid providing full-dn during login. This will also be used for search of groups,email, first name and last name. Example: uid={0},ou=Users - `domains.search_base` (string) Search base used to search for ldap user groups. Leave this field empty if a full username_pattern is provided and server is non microsoft AD. Example: DC=test,DC=delphix,DC=com - `domains.group_attr` (string) Group mapped attribute on ldap side used for user group search. Example: gidNumber - `domains.email_attr` (string) Email mapped attribute on ldap side used for mapping on DCT side account. Example: mail - `domains.first_name_attr` (string) First name attribute mapped on ldap side used for mapping on DCT side account. Example: cn - `domains.last_name_attr` (string) Last name attribute mapped on ldap side used for mapping on DCT side account. Example: sn - `domains.object_class_attr` (string) The name of the objectClass on ldap side under which the user is mapped.This is used to search for the user details. Example: person - `domains.search_attr` (string) Search attribute mapped on ldap side using which search on ldap side will be made. Example: uid - `enable_ssl` (boolean) True if LDAP should be used over SSL. Example: false - `truststore_filename` (string) File name of a truststore which can be used to validate the TLS certificate of the LDAP server. The truststore must be available at /etc/config/certs/ - `truststore_password` (string) Password for reading trustStore file provided in 'truststore_filename' property - `insecure_ssl` (boolean) Allow connections to the LDAP server over LDAPS without validating the TLS certificate. Even though the connection to the server might be performed over LDAPS, setting this property eliminates the protection against a man-in-the-middle attach for connections to this server. Instead, consider creating a truststore with a Certificate Authority to validate the server's certificate, and set the truststore_filename property. - `unsafe_ssl_hostname_check` (boolean) Ignore validation of the name associated to the TLS certificate when connecting to the LDAP server over LDAPS. Setting this value must only be done if the TLS certificate of the server does not match the hostname, and the TLS configuration of the server cannot be fixed. Setting this property reduces the protection against a man-in-the-middle attack for connections to this server. This is ignored if insecure_ssl is set.