--- title: "Configure LDAP/AD Authentication" description: "Point Container Registry at an LDAP or Active Directory server: the values you need, the steps in the GUI, and the group settings that go with them." date: 2026-08-13 lastmod: 2026-08-19 canonical: "https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/configure-ldap/ad-authentication/" source: "https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/configure-ldap/ad-authentication/index.md" harbor_version: "2.15" agent_instructions: "This is the markdown representation of https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/configure-ldap/ad-authentication/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt." --- > Agent-friendly representation of . Site index: . # Configure LDAP/AD Authentication *Point Container Registry at an LDAP or Active Directory server: the values you need, the steps in the GUI, and the group settings that go with them.* Configure LDAP/AD Authentication ================================= Delegate user identity to an LDAP or Active Directory server. For what the mode does and what it cannot do, see [How LDAP/AD Authentication Works](/docs/2.15/administration-manual/authentication-management/user-authentication/how-ldap/ad-authentication-works/index.md). ## Enable LDAP/AD User Authentication ### Information You Need for Configuring LDAP/AD Authentication All entries in an LDAP directory are organized into a structure resembling roots of a tree or a reverted tree. There is a root node – the highest one in the structure – where a few brunches with more nodes originate; other nodes have own brunches, etc. Each entry – a node – has a unique identifying path, called *a distinguished name or DN*. Every time a user submits his credentials, a search is performed inside this structure to match the provided user credentials with an entry and authenticate the user. That's why you need to keep at hand the following information about your LDAP server to configure it in Container Registry. * **LDAP Search DN**. This node coincides with the user who has access to the LDAP server which is usually an admin. This parameter should be specified as `cn=admin, dc=your-subdomain.container-registry.com` where the attribute `cn` stands for "common name" and `dc` stands for "domain component". * **LDAP Search Password**. Consequently, here you need to enter the password of the user you specified in the previous parameter. * **LDAP Base DN**. Theoretically, you may use your LDAP server not only for managing Container Registry but also for other applications. In this case, the tree would have nodes/entries that are irrelevant to Container Registry users. Thus, you need to specify a node where the search for the relevant entries should start. This is your subdomain or custom domain in our service. This parameter needs to be specified as `dc=your-subdomain.container-registry.com`. * **LDAP Scope**. This parameter specifies the depth of the search in relation to the starting point: the previous parameter. You have a choice between the following values: * **Base**: to search the entire tree; the base DN will be ignored; * **Subtree**: to search the nodes below the starting point; * **OneLevel**: to search the nodes on the same level as the start node. * **LDAP Filter**. With this, you can narrow the search down to users or user groups. This will facilitate the search but, more importantly, restricts access to your Container Registry. You can use more than one attribute in the filter, as well as wildcards. A detailed tutorial on writing LDAP filters can be found [here](https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html). * **LDAP UID**. Every entry in the LDAP has multiple attributes. The LDAP UID parameter specifies which of the attributes must be used as a key to match the user credentials (of the user who tries to log in to the system) with the entries in the tree. Typically, either the `uid` or the `cn` attribute are used. ### Steps in the GUI * In the navigation pane on the left, select **Administration**; * Click on **Configuration**; * Select **Authentication** tab; * In **Auth Mode**, in the dropdown, select **LDAP/AD**; * Fill in the form; * Select if you want to use a server certificate or not by using a checkbox; * **TEST LDAP SERVER** to ensure that you've entered correct parameters; * If you see an affirmative message, hit **Save**. ![](../img/ldap_ad.png) ## LDAP User Groups Once you created LDAP groups on the server, you have to configure group settings in the Container Registry GUI as well. You also cannot leave these settings empty if there are groups on your LDAP server. The parameters are similar to those in the general server configuration. * **LDAP Group Base DN**. Like *LDAP Search DN*, it specifies a starting point in the tree structure of nodes/entries with user accounts and other records, with the only difference that this parameter may rather refer to a group or organizational unit name. For the latter, use the `ou` attribute. * **LDAP Group Filter**. Like *LDAP Filter*, it limits the search to certain nodes. First of all, you need to specify that you want to search only within groups and not all other nodes. If you use OpenLDAP, the filter is `objectclass=groupOfNames`. If you use Active Directory, apply the `objectclass=group` filter. In addition to that, you can use other LDAP attributes to make your search more precise. * **LDAP Group GUID**. This parameter specifies which attribute of a node is reserved for the name of the group. Typically, this would be `cn`. * **LDAP Group Admin DN**. In this field, you can enter the distinguished name of an LDAP/AD group the members of which will all be granted system admin access rights for your Container Registry instance. * **LDAP Group Membership**. This is also an attribute of a node but this attribute applies to the nodes holding user accounts. Thus, it specifies which attribute should the search look at to identify of which group the user is a member of. The default node attribute that identifies group membership is `memberof`. * **LDAP Scope**. Identical to the *LDAP Scope* mentioned before but applies to the group nodes. ![](../img/ldap_ad_groups.png)