# LDAP Provider Generic Setup (Authentik)

<header id="bkmrk-generic-setup"></header>### Create User/Group[​](https://goauthentik.io/docs/providers/ldap/generic_setup#create-usergroup "Direct link to Create User/Group")

1. Create a new user account to bind with under *Directory* -&gt; *Users* -&gt; *Create*, in this example called `ldapservice`.
    
    Note the DN of this user will be `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io`
2. Create a new group for LDAP searches. In this example `ldapsearch`. Add the `ldapservice` user to this new group.NFO

<p class="callout info">Note: The `default-authentication-flow` validates MFA by default, and currently everything but SMS-based devices are supported by LDAP. If you plan to use only dedicated service accounts to bind to LDAP, or don't use SMS-based authenticators, then you can use the default flow and skip the extra steps below and continue at [Create LDAP Provider](https://goauthentik.io/docs/providers/ldap/generic_setup#create-ldap-provider)</p>

### LDAP Flow[​](https://goauthentik.io/docs/providers/ldap/generic_setup#ldap-flow "Direct link to LDAP Flow")

#### Create Custom Stages[​](https://goauthentik.io/docs/providers/ldap/generic_setup#create-custom-stages "Direct link to Create Custom Stages")

1. Create a new identification stage. *Flows &amp; Stage* -&gt; *Stages* -&gt; *Create* ![](https://goauthentik.io/assets/images/general_setup1-28b081e6970d26d4c2bf089c6db0c572.png)
2. Name it something meaningful like `ldap-identification-stage`. Select User fields Username and Email (and UPN if it is relevant to your setup). ![](https://goauthentik.io/assets/images/general_setup2-aedc0968da698af2d004996d6bf32172.png)
3. Create a new password stage. *Flows &amp; Stage* -&gt; *Stages* -&gt; *Create* ![](https://goauthentik.io/assets/images/general_setup3-23a6d9635092816513b8bedcf5827ddb.png)
4. Name it something meaningful like `ldap-authentication-password`. Leave the defaults for Backends. ![](https://goauthentik.io/assets/images/general_setup4-9f6514bc905e1c7fa252313c83b443e6.png)
5. Create a new user login stage. *Flows &amp; Stage* -&gt; *Stages* -&gt; *Create* ![](https://goauthentik.io/assets/images/general_setup5-b9e688db2f3f23b57cdd23ab3ce74182.png)
6. Name it something meaningful like `ldap-authentication-login`. ![](https://goauthentik.io/assets/images/general_setup6-a39cb7f17b1e677695ad7ac20659fc36.png)

#### Create Custom Flow[​](https://goauthentik.io/docs/providers/ldap/generic_setup#create-custom-flow "Direct link to Create Custom Flow")

1. Create a new authentication flow under *Flows &amp; Stage* -&gt; *Flows* -&gt; *Create*, and name it something meaningful like `ldap-authentication-flow` ![](https://goauthentik.io/assets/images/general_setup7-5d28d5df6b1b2e69952919bfe30779b5.png)
2. Click the newly created flow and choose *Stage Bindings*. ![](https://goauthentik.io/assets/images/general_setup8-514c7914c49400ee061d0a0df8e2b9f5.png)
3. Click `Bind Stage` choose `ldap-identification-stage` and set the order to `10`. ![](https://goauthentik.io/assets/images/general_setup9-6a04b5c7c774b548fdd3dcdb887a155f.png)
4. Click `Bind Stage` choose `ldap-authentication-login` and set the order to `30`. ![](https://goauthentik.io/assets/images/general_setup11-efd91bc25673f7df384b6d60de33f085.png)
5. Edit the `ldap-identification-stage`. ![](https://goauthentik.io/assets/images/general_setup12-25cc9fcea6654935c3587b21922b77fd.png)
6. Change the Password stage to `ldap-authentication-password`. ![](https://goauthentik.io/assets/images/general_setup13-a5006f341fdab49f32894d50e769a9c7.png)

### Create LDAP Provider[​](https://goauthentik.io/docs/providers/ldap/generic_setup#create-ldap-provider "Direct link to Create LDAP Provider")

1. Create the LDAP Provider under *Applications* -&gt; *Providers* -&gt; *Create*. ![](https://goauthentik.io/assets/images/general_setup14-9c2a270903b5bf88b693884c22d32c96.png)
2. Name is something meaningful like `LDAP`, bind the custom flow created previously (or the default flow, depending on setup) and specify the search group created earlier. ![](https://goauthentik.io/assets/images/general_setup15-3935cd6f3c497e436edacb53bec095e1.png)

### Create LDAP Application[​](https://goauthentik.io/docs/providers/ldap/generic_setup#create-ldap-application "Direct link to Create LDAP Application")

1. Create the LDAP Application under *Applications* -&gt; *Applications* -&gt; *Create* and name it something meaningful like `LDAP`. Choose the provider created in the previous step. ![](https://goauthentik.io/assets/images/general_setup16-1c57654a5ad05b12d3a21fd58e0e8350.png)

### Create LDAP Outpost[​](https://goauthentik.io/docs/providers/ldap/generic_setup#create-ldap-outpost "Direct link to Create LDAP Outpost")

1. Create (or update) the LDAP Outpost under *Applications* -&gt; *Outposts* -&gt; *Create*. Set the Type to `LDAP` and choose the `LDAP` application created in the previous step. ![](https://goauthentik.io/assets/images/general_setup17-1a8524a769f4f4d24e59522be62ea6cb.png)  
    <p class="callout info">INFO  
    The LDAP Outpost selects different providers based on their Base DN. Adding multiple providers with the same Base DN will result in inconsistent access</p>

### ldapsearch Test[​](https://goauthentik.io/docs/providers/ldap/generic_setup#ldapsearch-test "Direct link to ldapsearch Test")

Test connectivity by using ldapsearch.

<p class="callout info">INFO  
ldapsearch can be installed on Linux system with these commands  
</p>

```
sudo apt-get install ldap-utils -y # Debian-based systems
sudo yum install openldap-clients -y # CentOS-based systems

```

```
ldapsearch \
  -x \
  -h <LDAP Outpost IP address> \
  -p 389 \ # Production should use SSL 636
  -D 'cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io' \
  -w '<ldapuserpassword>' \
  -b 'DC=ldap,DC=goauthentik,DC=io' \
  '(objectClass=user)'
```

<div class="theme-admonition theme-admonition-info admonition_xJq3 alert alert--info" id="bkmrk-"><div class="admonitionContent_BuS1"><div class="codeBlockContainer_Ckt0 theme-code-block"><div class="codeBlockContent_biex"><div class="buttonGroup__atx"><button aria-label="Copy code to clipboard" class="clean-btn" title="Copy" type="button"><svg class="copyButtonIcon_y97N" viewbox="0 0 24 24"></svg><svg class="copyButtonSuccessIcon_LjdS" viewbox="0 0 24 24"></svg></button>  
</div></div></div></div></div><div class="theme-admonition theme-admonition-info admonition_xJq3 alert alert--info" id="bkmrk-nfo"><div class="admonitionContent_BuS1"><div class="codeBlockContainer_Ckt0 theme-code-block"><div class="codeBlockContent_biex"><div class="theme-admonition theme-admonition-info admonition_xJq3 alert alert--info"><div class="admonitionHeading_Gvgb">  
</div><div class="admonitionHeading_Gvgb">INFO This query will log the first successful attempt in an event in the *Events* -&gt; *Logs* area, further successful logins from the same user are not logged as they are cached in the outpost.</div></div></div></div></div></div><div class="admonitionHeading_Gvgb" id="bkmrk--1"></div><div class="admonitionHeading_Gvgb" id="bkmrk--2"></div><div class="admonitionHeading_Gvgb" id="bkmrk--3"></div><div class="admonitionHeading_Gvgb" id="bkmrk-manual-outpost-deplo"><header>
# Manual Outpost deployment in docker-compose

</header></div>To deploy an outpost with docker-compose, use this snippet in your docker-compose file.

You can also run the outpost in a separate docker-compose project, you just have to ensure that the outpost container can reach your application container.

### Proxy outpost[​](https://goauthentik.io/docs/outposts/manual-deploy-docker-compose#proxy-outpost "Direct link to Proxy outpost")

```
version: "3.5"

services:
    authentik_proxy:
        image: ghcr.io/goauthentik/proxy
        # Optionally specify which networks the container should be
        # might be needed to reach the core authentik server
        # networks:
        #   - foo
        ports:
            - 9000:9000
            - 9443:9443
        environment:
            AUTHENTIK_HOST: https://your-authentik.tld
            AUTHENTIK_INSECURE: "false"
            AUTHENTIK_TOKEN: token-generated-by-authentik
            # Starting with 2021.9, you can optionally set this too
            # when authentik_host for internal communication doesn't match the public URL
            # AUTHENTIK_HOST_BROWSER: https://external-domain.tld

```

<div class="admonitionHeading_Gvgb" id="bkmrk--4"><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block"><div class="codeBlockContent_biex"><div class="buttonGroup__atx"><button aria-label="Copy code to clipboard" class="clean-btn" title="Copy" type="button"><svg class="copyButtonIcon_y97N" viewbox="0 0 24 24"></svg><svg class="copyButtonSuccessIcon_LjdS" viewbox="0 0 24 24"></svg></button>  
</div></div></div></div>### LDAP outpost[​](https://goauthentik.io/docs/outposts/manual-deploy-docker-compose#ldap-outpost "Direct link to LDAP outpost")

```
version: "3.5"

services:
    authentik_ldap:
        image: ghcr.io/goauthentik/ldap
        # Optionally specify which networks the container should be
        # might be needed to reach the core authentik server
        # networks:
        #   - foo
        ports:
            - 389:3389
            - 636:6636
        environment:
            AUTHENTIK_HOST: https://your-authentik.tld
            AUTHENTIK_INSECURE: "false"
            AUTHENTIK_TOKEN: token-generated-by-authentik
```