Skip to content

Commit 6d6879e

Browse files
vrushankportkeyvrushankportkey
authored
Merge pull request #349 from Portkey-AI/ldap
Add docs for LDAP
2 parents 9ca2028 + 607129b commit 6d6879e

File tree

2 files changed

+321
-2
lines changed

2 files changed

+321
-2
lines changed

‎product/enterprise-offering/org-management/ldap.mdx

Lines changed: 320 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,320 @@
1+
---
2+
title: LDAP Bridge
3+
description: Enterprise LDAP connectivity through modern identity bridges
4+
---
5+
6+
Portkey provides LDAP integration support for enterprises through industry-standard identity provider bridges. This approach enables organizations to maintain their existing LDAP infrastructure while benefiting from modern cloud-native authentication protocols.
7+
8+
## Overview
9+
10+
Rather than implementing native LDAP support, Portkey leverages proven bridge solutions from leading identity providers. This strategy offers:
11+
12+
* **Enhanced Security**: Modern token-based authentication with MFA support
13+
* **Improved Scalability**: Cloud-native architecture without on-premises limitations
14+
* **Reduced Complexity**: Leverage specialized identity provider expertise
15+
* **Future-Ready**: Seamless path to modern protocols
16+
17+
## How LDAP Bridging Works
18+
19+
LDAP bridge solutions translate between your existing LDAP directory and Portkey's modern authentication protocols (SAML, OIDC, SCIM).
20+
21+
### Architecture Overview
22+
23+
```mermaid
24+
flowchart LR
25+
A[LDAP Directory] --> B[Identity Provider Bridge]
26+
B --> C[SCIM / SAML / OIDC]
27+
C --> D[Portkey]
28+
```
29+
30+
The bridge maintains synchronization between your LDAP directory and the identity provider, enabling:
31+
32+
* **User Authentication**: LDAP credentials validated through SAML/OIDC
33+
* **User Provisioning**: Directory changes synchronized via SCIM
34+
* **Group Management**: LDAP groups mapped to Portkey workspaces
35+
* **Attribute Mapping**: Custom LDAP attributes preserved
36+
37+
## Supported Identity Providers
38+
39+
<CardGroup cols={1}>
40+
<Card title="Azure AD Connect" icon="cloud" href="#azure-ad-setup" cta="Setup Guide" arrow="true">
41+
<b>Microsoft’s solution for organizations using Active Directory.</b>
42+
<br /><br />
43+
- Synchronizes on-premises AD to Azure AD<br />
44+
- Supports password hash sync or pass-through authentication<br />
45+
- Enables SAML, OIDC, and SCIM for cloud applications<br />
46+
- Free tier available, Premium features $6-9/user/month
47+
<br /><br />
48+
<b>Best For:</b> Organizations already using Microsoft 365 or Azure services
49+
</Card>
50+
<CardGroup cols={2}>
51+
<Card title="Okta LDAP Agent" icon="key" href="#okta-setup" cta="Setup Guide" arrow="true">
52+
<b>On-premises agent connects to your LDAP directory.</b>
53+
<br /><br />
54+
- No credential replication to cloud<br />
55+
- Real-time authentication against LDAP<br />
56+
<br /><br />
57+
<b>Best For:</b> Organizations with on-premises AD
58+
</Card>
59+
60+
<Card title="Okta LDAP Interface" icon="unlock" href="#okta-setup" cta="Setup Guide" arrow="true">
61+
<b>Cloud-based LDAP endpoint.</b>
62+
<br /><br />
63+
- No on-premises infrastructure required<br />
64+
- Simplified management<br />
65+
<br /><br />
66+
<b>Best For:</b> Organizations with on-premises AD
67+
</Card>
68+
</CardGroup>
69+
</CardGroup>
70+
71+
72+
**Alternative Solutions**
73+
74+
- **OneLogin Virtual LDAP**: Cloud-based LDAP service
75+
- **Auth0 AD/LDAP Connector**: Developer-friendly integration
76+
- **Keycloak**: Open-source option with enterprise features
77+
- **JumpCloud**: Directory-as-a-Service with LDAP support
78+
79+
## Azure AD Setup
80+
81+
<Note>
82+
Requires Azure AD Connect installed on-premises with connectivity to your domain controllers.
83+
</Note>
84+
85+
<Steps>
86+
<Step title="Install Azure AD Connect">
87+
```powershell
88+
# Download from Microsoft
89+
# Run installer with admin privileges
90+
```
91+
</Step>
92+
93+
<Step title="Configure Synchronization">
94+
<AccordionGroup>
95+
<Accordion title="Authentication Method">
96+
- Password Hash Sync (recommended)
97+
- Pass-through Authentication
98+
- Federation (advanced)
99+
</Accordion>
100+
<Accordion title="OU Selection">
101+
- Select OUs to synchronize
102+
</Accordion>
103+
<Accordion title="Attribute Filtering">
104+
- Configure attribute filtering
105+
</Accordion>
106+
</AccordionGroup>
107+
</Step>
108+
109+
<Step title="Enable Portkey SSO">
110+
- Navigate to Azure Portal > Enterprise Applications
111+
- Add new application > Non-gallery application
112+
113+
<AccordionGroup>
114+
<Accordion title="SAML Configuration">
115+
- Entity ID: get from Portkey Control Plane.
116+
- Reply URL: get from Portkey Control Plane.
117+
- Sign-on URL: `https://app.portkey.ai`
118+
</Accordion>
119+
</AccordionGroup>
120+
</Step>
121+
122+
<Step title="Configure SCIM Provisioning">
123+
<AccordionGroup>
124+
<Accordion title="Provisioning Setup">
125+
- In application settings, go to Provisioning
126+
- Set mode to Automatic
127+
- Configure with Portkey SCIM endpoint and token
128+
</Accordion>
129+
<Accordion title="Attribute Mapping">
130+
- Map attributes according to [SCIM setup guide](/product/enterprise-offering/org-management/scim/azure-ad)
131+
</Accordion>
132+
</AccordionGroup>
133+
</Step>
134+
135+
136+
</Steps>
137+
138+
<CardGroup cols={3}>
139+
<Card title="SSO Documentation" icon="lock" href="./sso" arrow="true" />
140+
<Card title="SCIM Documentation" icon="shield" href="./scim" arrow="true" />
141+
</CardGroup>
142+
143+
## Okta Setup
144+
145+
### Using Okta LDAP Agent
146+
147+
<Steps>
148+
<Step title="Download and Install Agent">
149+
- Access Okta Admin Console
150+
- Navigate to Directory > Directory Integrations
151+
- Add LDAP Directory > Download Agent
152+
- Install on server with LDAP connectivity
153+
</Step>
154+
155+
<Step title="Configure LDAP Connection">
156+
```yaml
157+
LDAP Host: ldap.company.com
158+
LDAP Port: 389 (or 636 for LDAPS)
159+
Bind DN: cn=okta-service,ou=services,dc=company,dc=com
160+
Base DN: dc=company,dc=com
161+
```
162+
</Step>
163+
164+
<Step title="Set Up Portkey Integration">
165+
- Create SAML application following [SSO guide](./sso#okta)
166+
- Enable SCIM provisioning per [SCIM guide](./okta)
167+
- Configure attribute mappings
168+
</Step>
169+
</Steps>
170+
171+
### Using Okta LDAP Interface
172+
173+
<Steps>
174+
<Step title="Enable LDAP Interface">
175+
- Okta Admin > Directory > LDAP Interface
176+
- Generate LDAP credentials
177+
- Note the LDAP endpoint URL
178+
</Step>
179+
180+
<Step title="Configure Applications">
181+
- Point LDAP applications to Okta endpoint
182+
- Use generated credentials for binding
183+
- Test authentication flow
184+
</Step>
185+
</Steps>
186+
187+
## Attribute Mapping
188+
189+
Ensure critical LDAP attributes map correctly:
190+
191+
| LDAP Attribute | SCIM Attribute | Portkey Field |
192+
|---------------|----------------|---------------|
193+
| uid/sAMAccountName | userName | username |
194+
| mail | emails[primary] | email |
195+
| givenName | name.givenName | firstName |
196+
| sn | name.familyName | lastName |
197+
| memberOf | groups | workspaces |
198+
| title | title | jobTitle |
199+
200+
<Info>
201+
Custom LDAP attributes can be mapped through extended schema support in most identity providers.
202+
</Info>
203+
204+
## Troubleshooting
205+
206+
<AccordionGroup>
207+
<Accordion title="Authentication Failures">
208+
<b>Symptom:</b> Users cannot log in despite correct credentials
209+
210+
211+
<b>Causes:</b>
212+
- Certificate validation errors
213+
- Time synchronization issues
214+
- Incorrect attribute Mapping
215+
216+
217+
<b>Solution:</b>
218+
- Verify SSL certificates are trusted
219+
- Ensure NTP synchronization
220+
- Check authentication logs in identity provider
221+
</Accordion>
222+
223+
<Accordion title="Provisioning Errors">
224+
<b>Symptom:</b> Users not appearing in Portkey or incorrect attributes
225+
226+
<b>Causes:</b>
227+
- SCIM endpoint connectivity issues
228+
- Attribute mapping conflicts
229+
- Insufficient permissions
230+
231+
232+
<b>Solution:</b>
233+
- Test SCIM endpoint with bearer token
234+
- Review attribute mapping configuration
235+
- Verify service account permissions
236+
</Accordion>
237+
238+
<Accordion title="Performance Issues">
239+
<b>Symptom:</b> Slow authentication or provisioning
240+
241+
242+
<b>Causes:</b>
243+
- Unindexed LDAP queries
244+
- Network latency
245+
- Large group memberships
246+
247+
248+
<b>Solution:</b>
249+
- Add indexes for commonly queried attributes
250+
- Deploy bridge closer to LDAP servers
251+
- Implement group filtering
252+
</Accordion>
253+
</AccordionGroup>
254+
255+
### Best Practices
256+
257+
<CardGroup cols={2}>
258+
<Card title="High Availability" icon="server">
259+
Deploy multiple bridge instances<br />
260+
Configure load balancing<br />
261+
Implement health monitoring
262+
</Card>
263+
<Card title="Security Hardening" icon="shield-check">
264+
Use LDAPS (LDAP over SSL) always<br />
265+
Implement service account restrictions<br />
266+
Enable audit logging
267+
</Card>
268+
<Card title="Performance Optimization" icon="bolt">
269+
Cache frequently accessed data<br />
270+
Implement connection pooling<br />
271+
Monitor query performance
272+
</Card>
273+
</CardGroup>
274+
275+
## Frequently Asked Questions
276+
277+
<AccordionGroup>
278+
279+
<Accordion title="Why doesn't Portkey support native LDAP?">
280+
Modern cloud architectures benefit from stateless, token-based protocols. LDAP's stateful binary protocol creates security and scalability challenges in cloud environments. Industry leaders like Slack, Salesforce, and others follow the same approach.
281+
</Accordion>
282+
283+
<Accordion title="Will this increase our costs?">
284+
While identity provider licenses add cost, most organizations see overall savings through:
285+
<ul>
286+
<li>Reduced infrastructure maintenance</li>
287+
<li>Improved security posture</li>
288+
<li>Decreased administrative overhead</li>
289+
<li>Better user experience</li>
290+
</ul>
291+
</Accordion>
292+
293+
<Accordion title="How long does migration take?">
294+
Typical enterprise migrations complete in 3-6 months:
295+
<ul>
296+
<li>Small organizations (&lt;1,000 users): 4-8 weeks</li>
297+
<li>Medium organizations (1,000-10,000): 2-4 months</li>
298+
<li>Large enterprises (10,000+): 4-6 months</li>
299+
</ul>
300+
</Accordion>
301+
302+
<Accordion title="Can we maintain LDAP for other applications?">
303+
Yes, bridge solutions maintain your existing LDAP infrastructure. Other applications continue working unchanged while Portkey uses modern protocols.
304+
</Accordion>
305+
306+
</AccordionGroup>
307+
308+
## Support
309+
310+
For assistance with LDAP integration:
311+
312+
* Review our [SSO documentation](../sso) for authentication setup
313+
* Configure [SCIM provisioning](../scim) for user management
314+
* Contact [[email protected]](mailto:[email protected]) for integration help
315+
316+
---
317+
318+
<Note>
319+
Enterprise customers can request a guided migration workshop. Our solution architects will help design and implement your LDAP bridge strategy.
320+
</Note>

‎product/enterprise-offering/org-management/sso.mdx

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -128,5 +128,4 @@ Either of the following information is required:
128128
- Enter `SAML Entity ID` from Portkey Control Plane as the `App ID URI`.
129129
- Select `Save`.
130130
- Once everything is set up, please note the following details
131-
- Copy the `Federation metadata document URL` and paste it in Portkey Control Plane in `Admin Settings > Authentication Settings > SAML > Provider Metadata URL`
132-
131+
- Copy the `Federation metadata document URL` and paste it in Portkey Control Plane in `Admin Settings > Authentication Settings > SAML > Provider Metadata URL`

0 commit comments

Comments
 (0)