{
  "id": "ldap",
  "title": "Enable LDAP authentication",
  "url": "https://redis.io/docs/latest/operate/kubernetes/security/authentication/ldap/",
  "summary": "Enable LDAP authentication for Redis Enterprise for Kubernetes.",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-07-24T10:52:10-07:00",
  "page_type": "content",
  "content_hash": "d16b49eefc5f7d9e2829778444d8e9318ca6a9e2a0b69fe7d65545129748afc9",
  "sections": [
    {
      "id": "ldap-support-for-redis-enterprise-software",
      "title": "LDAP support for Redis Enterprise Software",
      "role": "overview",
      "text": "Redis Enterprise Software supports LDAP authentication and authorization through [role-based access controls](https://redis.io/docs/latest/operate/rs/security/access-control/) (RBAC). You can map LDAP groups to [Redis Enterprise roles](https://redis.io/docs/latest/operate/rs/security/access-control) to control access to your database and the Cluster Manager UI. For more details on how LDAP works with Redis Enterprise, see [LDAP authentication](https://redis.io/docs/latest/operate/rs/security/access-control/ldap/).\n\nRedis Enterprise for Kubernetes supports enabling and configuring LDAP authentication using the `RedisEnterpriseCluster` (REC) custom resource. Currently, the Redis Enterprise cluster (REC) only supports configuration related to the LDAP server, such as server addresses, connection details, credentials, and query configuration.\n\nTo [map LDAP groups to Redis Enterprise access control roles](https://redis.io/docs/latest/operate/rs/security/access-control/ldap/enable-role-based-ldap.md), you'll need to use the Redis Enterprise [API](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/ldap_mappings/) or [admin console](https://redis.io/docs/latest/operate/rs/security/access-control/ldap/enable-role-based-ldap.md)."
    },
    {
      "id": "enable-ldap",
      "title": "Enable LDAP",
      "role": "content",
      "text": "To enable LDAP for your REC, use the `.spec.ldap` field in the `RedisEnterpriseCluster` custom resource.\n\nThe following `RedisEnterpriseCluster` example resource enables a basic LDAP configuration:\n\n[code example]\n\nRefer to the `RedisEnterpriseCluster` [API reference](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/redis_enterprise_cluster_api.md#ldapspec) for full details on the available fields."
    },
    {
      "id": "bind-credentials",
      "title": "Bind credentials",
      "role": "content",
      "text": "For LDAP servers that require authentication for client queries, store the bind credentials in a secret and reference them in the `RedisEnterpriseCluster` custom resource.\n\n1. Create a secret to store the bind credentials.\n    \n    [code example]\n    The secret must:\n    - Reside within the same namespace as the `RedisEnterpriseCluster` custom resource.\n    - Include a `dn` key with the distinguished name for the user performing the query (such as `cn=admin,dc=example,dc=org`).\n    - Include a `password` key with the bind password.\n\n    Replace the `<placeholders>` in the command above with your own values.\n\n1. Reference the secret name in the `.spec.ldap.bindCredentialsSecretName` field of the `RedisEnterpriseCluster` custom resource.\n\n    [code example]"
    },
    {
      "id": "ldaps-or-starttls-protocols",
      "title": "LDAPS or STARTTLS protocols",
      "role": "content",
      "text": "In addition to plain LDAP protocol, Redis Enterprise Software also supports LDAPS and STARTTLS protocols for secure communication with the LDAP server.\n\nTo enable one of these protocols, edit the `spec.ldap.protocol` field in the `RedisEnterpriseCluster` custom resource:\n\n#### Enable `LDAPS`\n\n  [code example]\n\n  Default port: 636\n\n#### Enable `STARTTLS`\n\n  [code example]\n\n  Default port: 389"
    },
    {
      "id": "ca-certificate",
      "title": "CA certificate",
      "role": "content",
      "text": "To use a custom CA certificate for validating the LDAP server certificate, store the CA certificate in a secret and reference the secret in the `RedisEnterpriseCluster` custom resource.\n\n1. Create a secret to hold the CA certificate.\n\n    [code example]\n\n    The secret must:\n    - Reside within the same namespace as the `RedisEnterpriseCluster` custom resource.\n    - Include a `cert` key with a PEM-encoded CA certificate (such as `cacert.pem`).\n\n    Replace the `<placeholders>` in the command above with your own values.\n\n1. Reference the secret name in the `spec.ldap.caCertificateSecretName` field of the `RedisEnterpriseCluster` custom resource.\n\n    [code example]"
    },
    {
      "id": "client-certificates",
      "title": "Client certificates",
      "role": "content",
      "text": "To use an LDAP client certificate, store the certificate in a secret and reference the secret in the `RedisEnterpriseCluster` custom resource.\n\n1. Create a secret to hold the client certificate.\n\n    [code example]\n\n    The secret must:\n    - Reside within the same namespace as the `RedisEnterpriseCluster` custom resource.\n    - Include a `name` key explicitly set to `ldap_client`.\n    - Include a `certificate` key for the public key (such as `cert.pem`).\n    - Include a `key` key for the private key (such as `key.pem`).\n    \n\n    Replace the `<placeholders>` in the command above with your own values.\n\n1. Reference the secret name in the `.spec.certificates.ldapClientCertificateSecretName` field of the `RedisEnterpriseCluster` custom resource, substituting your own values for `<placeholders>`.\n\n    [code example]"
    },
    {
      "id": "known-limitations",
      "title": "Known limitations",
      "role": "content",
      "text": "Redis Enterprise Software can't resolve DNS names with a `.local` suffix.\n  If your LDAP server is in the same Kubernetes cluster and exposed via a Service object, *avoid* addresses such as `openldap.openldap.svc.cluster.local`. Instead, *use short-form addresses* such as `openldap.openldap.svc`."
    },
    {
      "id": "next-steps",
      "title": "Next steps",
      "role": "content",
      "text": "To [map LDAP groups to Redis Enterprise access control roles](https://redis.io/docs/latest/operate/rs/security/access-control/ldap/enable-role-based-ldap.md), you'll need to use the Redis Enterprise [API](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/ldap_mappings/) or [admin console](https://redis.io/docs/latest/operate/rs/security/access-control/ldap/enable-role-based-ldap.md).\n\nFor more details on how LDAP works with Redis Enterprise, see [LDAP authentication](https://redis.io/docs/latest/operate/rs/security/access-control/ldap/)."
    }
  ],
  "examples": [
    {
      "id": "enable-ldap-ex0",
      "language": "yaml",
      "code": "apiVersion: app.redislabs.com/v1\nkind: RedisEnterpriseCluster\nmetadata:\n  name: rec\nspec:\n  nodes: 3\n  ldap:\n    protocol: LDAP\n    servers:\n    - host: openldap.openldap.svc\n      port: 389\n    bindCredentialsSecretName: ldap-bind-credentials\n    cacheTTLSeconds: 600\n    enabledForControlPlane: true\n    enabledForDataPlane: true\n    authenticationQuery:\n      template: cn=%u,ou=default,dc=example,dc=org\n    authorizationQuery:\n      attribute: memberOf",
      "section_id": "enable-ldap"
    },
    {
      "id": "bind-credentials-ex0",
      "language": "sh",
      "code": "kubectl -n <rec-namespace> create secret generic <bind-secret-name> \\\n        --from-literal=dn='<disinguished-name>' \\\n        --from-literal=password=<password>",
      "section_id": "bind-credentials"
    },
    {
      "id": "bind-credentials-ex1",
      "language": "yaml",
      "code": "spec:\n      ldap:\n        bindCredentialsSecretName: <bind-secret-name>",
      "section_id": "bind-credentials"
    },
    {
      "id": "ldaps-or-starttls-protocols-ex0",
      "language": "yaml",
      "code": "spec:\n        ldap:\n          protocol: LDAPS",
      "section_id": "ldaps-or-starttls-protocols"
    },
    {
      "id": "ldaps-or-starttls-protocols-ex1",
      "language": "yaml",
      "code": "spec:\n        ldap:\n          protocol: STARTTLS",
      "section_id": "ldaps-or-starttls-protocols"
    },
    {
      "id": "ca-certificate-ex0",
      "language": "sh",
      "code": "kubectl -n <rec-namespace> create secret generic <ca-secret-name> \\\n        --from-file=cert=<ca-cert>.pem",
      "section_id": "ca-certificate"
    },
    {
      "id": "ca-certificate-ex1",
      "language": "yaml",
      "code": "spec:\n      ldap:\n        caCertificateSecretName: <ca-secret-name>",
      "section_id": "ca-certificate"
    },
    {
      "id": "client-certificates-ex0",
      "language": "sh",
      "code": "kubectl -n <rec-namespace> create secret generic <client-secret-name> \\\n      --from-literal=name=ldap_client \\\n      --from-file=certificate=<client-cert-file> \\\n      --from-file=key=<private-key-file>",
      "section_id": "client-certificates"
    },
    {
      "id": "client-certificates-ex1",
      "language": "yaml",
      "code": "spec:\n      certificates:\n        ldapClientCertificateSecretName: <client-secret-name>",
      "section_id": "client-certificates"
    }
  ]
}