{
  "id": "ldap",
  "title": "LDAP object",
  "url": "https://redis.io/docs/latest/operate/rs/8.0/references/rest-api/objects/ldap/",
  "summary": "An object that contains the cluster's LDAP configuration",
  "content": "\nAn API object that represents the cluster's [LDAP](https://redis.io/docs/latest/operate/rs/security/access-control/ldap) configuration.\n\n| Name | Type/Value | Description |\n|------|------------|-------------|\n| bind_dn | string | DN used when binding with the LDAP server to run queries |\n| bind_pass | string | Password used when binding with the LDAP server to run queries |\n| ca_cert | string | PEM-encoded CA certificate(s) used to validate TLS connections to the LDAP server |\n| cache_ttl | integer (default: 300) | Maximum TTL (in seconds) of cached entries |\n| cba | boolean (default: false) | Whether to allow LDAP as an identity source for certificate-based authentication |\n| cba_identity_oid | string | The certificate subject OID to use when `cba_identity_source` is set to `subject_oid` |\n| cba_identity_source | \"subject_cn\"\u003cbr /\u003e\"subject_oid\" | The certificate subject identity source to use for LDAP lookup |\n| control_plane | boolean (default: false) | Use LDAP for user authentication/authorization in the control plane |\n| data_plane | boolean (default: false) | Use LDAP for user authentication/authorization in the data plane |\n| directory_timeout_s | integer (range: 5-60) (default: 5) | The connection timeout to the LDAP server when authenticating a user, in seconds |\n| dn_group_attr | string | The name of an attribute of the LDAP user entity that contains a list of the groups that user belongs to. `dn_group_attr` is mutually exclusive with `dn_group_query`. |\n| dn_group_query | complex object | An LDAP search query used to find a user’s groups, which determine the user’s level of access to the cluster and database as defined by Redis ACLs when [mapped to roles](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/ldap_mappings). `dn_group_query` is mutually exclusive with `dn_group_attr`.\u003cbr\u003e\u003cbr\u003eContains the following fields:\u003cbr\u003e**base**: Defines the starting point DN (unique identifier Distinguished Name) in the directory information tree for the search. Example value: `\"DC=example,DC=com\"`\u003cbr\u003e**filter**: An [RFC-4515](https://www.rfc-editor.org/info/rfc4515) string representation of the search filter to apply. Defines the conditions required for an entry to appear in the search results. Example value: `\"member=%D\"` where `%D` is replaced with the user's DN.\u003cbr\u003e**scope**: Defines the scope of the LDAP search according to the following values:\u003cbr\u003e**\"base\"**: Search the base entry.\u003cbr\u003e**\"one\"**: Search the base entry's immediate children.\u003cbr\u003e**\"subtree\"**: Search the base entry and all its descendants. |\n| starttls | boolean (default: false) | Use StartTLS negotiation for the LDAP connection |\n| uris | array of strings | URIs of LDAP servers that only contain the schema, host, and port |\n| user_dn_query | complex object | An LDAP search query used to find and authenticate LDAP users. `user_dn_query` is mutually exclusive with `user_dn_template`.\u003cbr\u003e\u003cbr\u003eContains the following fields:\u003cbr\u003e**base**: Defines the starting point DN (unique identifier Distinguished Name) in the directory information tree for the search. Example value: `\"DC=example,DC=com\"`\u003cbr\u003e**filter**: An [RFC-4515](https://www.rfc-editor.org/info/rfc4515) string representation of the search filter to apply. Defines the conditions required for an entry to appear in the search results. Example value: `\"(\u0026(objectClass=Person)(cn=%u))\"` where `%u` is replaced with the username.\u003cbr\u003e**scope**: Defines the scope of the LDAP search according to the following values:\u003cbr\u003e**\"base\"**: Search the base entry.\u003cbr\u003e**\"one\"**: Search the base entry's immediate children.\u003cbr\u003e**\"subtree\"**: Search the base entry and all its descendants. |\n| user_dn_template | string | A string template that maps between the username, provided to the cluster for authentication, and the LDAP DN. The substring \"%u\" will be replaced with the username. `user_dn_template` is mutually exclusive with `user_dn_query`. |\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-07-23T16:30:51-05:00"
}