rocketkind
Security

LDAP

LDAP connects a workflow to a directory — Active Directory, OpenLDAP or any other LDAPv3 server — to search it and to create, change, move and remove its entries.

Authentication

  • Bind DN and password
  • Client certificate
  • Kerberos (GSSAPI)

Actions

  • Add entryCreate any directory entry from its attributes - an organizational unit, a group, a contact, or an entry of your directory's own schema.
  • Add group memberGrant a group's access to one account or nested group by adding it to the group's member attribute - how birthright and approved access requests are fulfilled.
  • Create userCreate a person's Active Directory account - the directory half of an onboarding (joiner) workflow.
  • Delete entryDestructivePermanently remove one entry - a leaver's account once any retention period has passed, or an empty group.
  • Disable userDestructiveStop a person signing in to Active Directory without deleting their account - the first step of offboarding (leaver), which keeps the account, its groups and its history for a rehire or a later ldap:deleteentry.
  • Enable userDestructiveLet a person sign in to Active Directory - the last step of onboarding, after ldap:setrandompassword, or a rehire.
  • Get entryRead one entry by its DN - to check a person's current department before a transfer, or read the members of a known group.
  • Modify entryDestructiveChange an entry's attributes - a mover's new title and department, a corrected phone number, a manager reassignment.
  • Remove group memberDestructiveRevoke a group's access from one account or nested group by removing it from the group's member attribute - how movers lose their old department's access and expired just-in-time grants are taken back.
  • Rename or move entryDestructiveRename an entry, move it to another organizational unit, or both - a person's name change, or moving a leaver into a disabled-accounts OU.
  • SearchFind entries in the directory - people, groups, computers or organizational units - by an LDAP filter under a base DN, and read the attributes you name.
  • Set passwordDestructiveSet an account's password to a value you choose - for a directory where a person must be told an initial password, or a service account whose password another system also holds.
  • Set random passwordDestructiveGive an account a strong random password that nobody - not the workflow, not its run history - ever sees.

Product names, logos and brands are the property of their respective owners and are used here for identification only. Their use does not imply endorsement by, or affiliation with, those owners.