> ## Documentation Index > Fetch the complete documentation index at: https://tyk.io/docs/llms.txt > Use this file to discover all available pages before exploring further. # SSO with LDAP > Learn how to configure Single Sign-On (SSO) for Tyk Dashboard or Tyk Developer Portal using LDAP or Active Directory. ## Introduction TIB supports Lightweight Directory Access Protocol (LDAP) and Active Directory using the `ADProvider` method, which uses a passthrough flow; user credentials are submitted directly to TIB, which validates them against your LDAP server. No browser redirect to an external IdP is involved. Because LDAP is a passthrough flow, you must provide a login page that submits credentials to TIB. Tyk Dashboard and Tyk Developer Portal do not include a built-in LDAP login page. Before configuring your TIB profile, read [Dashboard SSO](https://tyk.io/docs/tyk-identity-broker/dashboard-sso.md) or [Portal SSO](https://tyk.io/docs/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso.md) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case. ## TIB Profile The LDAP-specific configuration goes in the `ProviderConfig` block of the TIB profile. Set `ProviderName` to `ADProvider` and `Type` to `passthrough`. ```json expandable theme={null} { "ProviderName": "ADProvider", "Type": "passthrough", "ProviderConfig": { "LDAPServer": "{ldap-server-hostname}", "LDAPPort": "389", "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com", "LDAPBaseDN": "dc=example,dc=com", "LDAPFilter": "(objectClass=person)", "LDAPEmailAttribute": "mail", "LDAPFirstNameAttribute": "givenName", "LDAPLastNameAttribute": "sn", "LDAPAttributes": [], "FailureRedirect": "http://{failure-redirect-url}", "GetAuthFromBAHeader": true } } ``` The LDAP-specific `ProviderConfig` fields are: | Field | Description | | - | - | | `LDAPServer` | Hostname or IP address of your LDAP server. | | `LDAPPort` | Port of your LDAP server. Use `389` for standard LDAP or `636` for LDAPS. | | `LDAPUserDN` | Distinguished Name template used to bind as the authenticating user. The literal string `*USERNAME*` is replaced at runtime with the submitted username. | | `LDAPBaseDN` | Base DN from which LDAP searches are performed. | | `LDAPFilter` | LDAP search filter applied when looking up users. | | `LDAPEmailAttribute` | LDAP attribute containing the user's email address. Defaults to `mail`. | | `LDAPFirstNameAttribute` | LDAP attribute containing the user's first name. Defaults to `givenName`. | | `LDAPLastNameAttribute` | LDAP attribute containing the user's last name. Defaults to `sn`. | | `LDAPAttributes` | Additional LDAP attributes to retrieve. Can be an empty list. | | `LDAPUseSSL` | Set to `true` to connect using LDAPS. | | `LDAPAdminUser` | DN of an admin user for performing user-lookup searches, if required. | | `LDAPAdminPassword` | Password for the admin user. | | `LDAPSearchScope` | Depth of the LDAP search: `0` for base object only, `1` for single level below the base DN, `2` for the entire subtree. Defaults to `2`. | | `DefaultDomain` | Domain appended to the username when building the full user identifier. Used to construct the username but not for performing LDAP requests. | | `FailureRedirect` | URL to redirect the user to on authentication failure. | | `GetAuthFromBAHeader` | Set to `true` to read the username and password from the HTTP Basic Auth header. Recommended for form-based login pages. | | `SlugifyUserName` | Set to `true` to normalize the username to a URL-safe slug. | ## Login Page Since LDAP is a passthrough flow, users submit credentials directly to TIB via a form `POST`. Create a login page with a form that posts to the TIB authentication endpoint: ```html theme={null}
``` The form must use `POST` method and include `username` and `password` fields. TIB reads these field names exactly. For embedded TIB, `{tib-host}` is the same as your Dashboard host. For Portal, the embedded TIB is accessible under the `/tib` path prefix, so use `{portal-host}/tib` as the base. ## Worked Examples > [tab] Dashboard SSO > > In this example, Tyk Dashboard is running at `http://dashboard.example.com` on port `3000`; replace the example values with your own. > > **Tyk Dashboard configuration** > > ```json theme={null} > { > "sso_enable_user_lookup": true, > "sso_permission_defaults": { > "apis": "write", > "keys": "write", > "policies": "write" > }, > "sso_default_group_id": "{tyk-user-group-id}" > } > ``` > > With this configuration, registered users (with a Tyk Dashboard user account) get their own permissions; unregistered users fall back to the group specified in `sso_default_group_id`. See [Dashboard SSO](https://tyk.io/docs/tyk-identity-broker/dashboard-sso.md#unregistered-user-login) for full details. > > **TIB profile** > > The TIB profile is created via the [Tyk Identity Broker API](https://tyk.io/docs/tyk-identity-broker/tib-rest-api.md) or the [Tyk Dashboard UI](https://tyk.io/docs/tyk-identity-broker/dashboard-sso.md#create-a-tib-profile-using-dashboard-ui). > > ```json expandable theme={null} > { > "ID": "ldap-dashboard", > "Name": "LDAP Dashboard SSO", > "OrgID": "{tyk-org-id}", > "ActionType": "GenerateOrLoginUserProfile", > "Type": "passthrough", > "ProviderName": "ADProvider", > "ReturnURL": "http://dashboard.example.com:3000/tap", > "IdentityHandlerConfig": { > "DashboardCredential": "{tib-service-user-api-key}" > }, > "ProviderConfig": { > "LDAPServer": "ldap.example.com", > "LDAPPort": "389", > "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com", > "LDAPBaseDN": "dc=example,dc=com", > "LDAPFilter": "(objectClass=person)", > "LDAPEmailAttribute": "mail", > "LDAPFirstNameAttribute": "givenName", > "LDAPLastNameAttribute": "sn", > "LDAPAttributes": [], > "FailureRedirect": "http://dashboard.example.com:3000/?fail=true", > "GetAuthFromBAHeader": true > } > } > ``` > > * set `DashboardCredential` to the [TIB service account's](https://tyk.io/docs/tyk-identity-broker/dashboard-sso.md#tib-service-account) Dashboard credentials > * update `LDAPUserDN` to match your LDAP directory structure, keeping `*USERNAME*` as a literal placeholder > > **Login page form action** > > Your login page form should `POST` to: > > ``` > http://dashboard.example.com:3000/auth/ldap-dashboard/ADProvider > ``` > > **Redirect to login page** > > To redirect users to your custom login page instead of the default Dashboard login, set `sso_custom_login_url` in the Tyk Dashboard configuration: > > ```json theme={null} > { > "sso_custom_login_url": "http://{your-login-page-url}" > } > ``` > > See [Dashboard SSO](https://tyk.io/docs/tyk-identity-broker/dashboard-sso.md) for details on session behavior, permissions, and user group mapping. > [tab] Portal SSO > > In this example, Tyk Developer Portal is running at `http://portal.example.com` on port `3001`; replace the example values with your own. > > **Tyk Developer Portal configuration** > > Enable embedded TIB in the Portal configuration: > > ```json theme={null} > { > "TIB": { > "Enable": true > } > } > ``` > > **TIB profile** > > The TIB profile is created via the Tyk Developer Portal UI under **Settings > SSO Profiles**. > > ```json expandable theme={null} > { > "ID": "ldap-portal", > "Name": "LDAP Portal SSO", > "OrgID": "{tyk-org-id}", > "ActionType": "GenerateOrLoginDeveloperProfile", > "Type": "passthrough", > "ProviderName": "ADProvider", > "ReturnURL": "http://portal.example.com:3001/sso", > "IdentityHandlerConfig": { > "DashboardCredential": "{portal-api-secret}" > }, > "ProviderConfig": { > "LDAPServer": "ldap.example.com", > "LDAPPort": "389", > "LDAPUserDN": "cn=*USERNAME*,dc=example,dc=com", > "LDAPBaseDN": "dc=example,dc=com", > "LDAPFilter": "(objectClass=person)", > "LDAPEmailAttribute": "mail", > "LDAPFirstNameAttribute": "givenName", > "LDAPLastNameAttribute": "sn", > "LDAPAttributes": [], > "FailureRedirect": "http://portal.example.com:3001/?fail=true", > "GetAuthFromBAHeader": true > } > } > ``` > > * set `ActionType` and `OrgID` based on the audience: > * Admin Portal (API owners): `ActionType: "GenerateOrLoginUserProfile"`, `OrgID: "0"` > * Live Portal (API consumers): `ActionType: "GenerateOrLoginDeveloperProfile"`, `OrgID` is not required > * set `DashboardCredential` to the [`PortalAPISecret`](https://tyk.io/docs/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal_api_secret) used to authenticate with the Portal's management API > * update `LDAPUserDN` to match your LDAP directory structure, keeping `*USERNAME*` as a literal placeholder > > **Login page form action** > > Your login page form should `POST` to: > > ``` > http://portal.example.com:3001/tib/auth/ldap-portal/ADProvider > ``` > > For details on user group mapping and admin vs developer profiles, see [Portal SSO](https://tyk.io/docs/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso.md).