--- title: "How LDAP/AD Authentication Works" description: "Why Container Registry delegates user identity to an LDAP or Active Directory server, what that mode cannot do, and how LDAP groups map onto it." date: 2026-08-13 lastmod: 2026-08-19 canonical: "https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/how-ldap/ad-authentication-works/" source: "https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/how-ldap/ad-authentication-works/index.md" harbor_version: "2.15" agent_instructions: "This is the markdown representation of https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/how-ldap/ad-authentication-works/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt." --- > Agent-friendly representation of . Site index: . # How LDAP/AD Authentication Works *Why Container Registry delegates user identity to an LDAP or Active Directory server, what that mode cannot do, and how LDAP groups map onto it.* How LDAP/AD Authentication Works ================================= Every company needs a directory where all user login data is kept. There are two popular technologies for configuring and managing such directories – Windows Active Directory (AD) and Lightweight Directory Access Protocol – that are Harbor-compatible. It means that you can use an LDAP/AD server to add new users to the Container Registry instance and manage existing accounts on the server. Indeed, you need to set up and configure such a server before you can activate this kind of user authentication in Container Registry. How you do it, depends on your provider. You can look for instructions on the official website of the [OpenLDAP project](https://www.openldap.org/doc/admin25/quickstart.html) or in the [Windows server official documentation](https://docs.microsoft.com/en-us/windows-server/identity/identity-and-access). ## Limitations of LDAP/AD Authentication If you select this authentication mode, then, as a system admin, you will only be able to see a list of users in your Container Registry admin console but you won't be able to perform any actions with them in the GUI, neither create and delete users nor change and reset their passwords. That all must be done on the LDAP or AD server. For the users, the *self-registration* option is not available in this mode (and you cannot enable it as an admin). ## Advantages of LDAP/AD Authentication * If you already have an LDAP/AD server, you can onboard Container Registry users quicker. * You can use the same LDAP/AD server to add and manage users of more than one Container Registry instance. * You can create user groups and assign multiple users to projects in one leap. ## LDAP User Groups Optionally, you can create user groups to be able to assign users to projects in bulks in the Container Registry GUI. Since an LDAP directory is a tree-like structure, it's naturally hierarchical. Groups are a way to put entities – in our case, users – together independently of that hierarchy. One user can be a member of more than one group. On the LDAP/AD server, you need to use the `memberof` attribute of the entries. If you are new to this technology, look into [this tutorial](https://www.thegeekstuff.com/2015/02/openldap-add-users-groups/) that explains how to create groups on the LDAP server and add users into them. To configure them, see [Configure LDAP/AD Authentication](/docs/2.15/administration-manual/authentication-management/user-authentication/configure-ldap/ad-authentication/index.md).