LDAP Integration

LDAP Connector Overview

StackFlow's LDAP integration enables organizations to authenticate users against an on-premises Active Directory or OpenLDAP server. The LDAP connector runs as part of the StackFlowAPI Lambda and connects to the directory service via the VPC NAT gateway, allowing secure access to on-premises systems through AWS Direct Connect or VPN.

LDAP authentication in StackFlow is additive — it does not replace Cognito. Instead, user credentials are validated against LDAP, and upon success, a Cognito user account is created or updated with the LDAP attributes. The Cognito token is then issued as the session token for subsequent API calls.

Connection Configuration

Configure the LDAP connection in Admin → Authentication → LDAP Integration. All connection credentials are stored in AWS Secrets Manager and never written to the StackFlow database in plaintext.

User Sync Settings

StackFlow can perform scheduled LDAP user synchronization to keep user accounts, group memberships, and profile attributes current. Sync runs every 30 minutes by default and can be triggered manually from the admin console.

{
  "ldap_sync": {
    "enabled": true,
    "schedule_minutes": 30,
    "sync_groups": true,
    "deactivate_removed_users": true,
    "attribute_map": {
      "email": "mail",
      "given_name": "givenName",
      "family_name": "sn",
      "department": "department",
      "phone": "telephoneNumber"
    }
  }
}

Group Mapping

Active Directory groups are mapped to StackFlow roles in the same way as Azure AD groups. Define mapping rules in Admin → Authentication → LDAP → Group Mapping. Groups not explicitly mapped receive the default role configured in System Properties (typically viewer).

Troubleshooting LDAP

Use the LDAP test tool at Admin → Authentication → LDAP → Test Connection to diagnose connectivity issues. The test tool performs a bind with the service account and then a sample user search to validate the full authentication path.

# Test LDAP connectivity from within the VPC (requires EC2 bastion)
ldapsearch -H ldaps://dc01.corp.example.com:636   -D "CN=stackflow-svc,OU=Service Accounts,DC=corp,DC=example,DC=com"   -w PASSWORD   -b "DC=corp,DC=example,DC=com"   "(&(objectClass=person)(sAMAccountName=testuser))"   mail givenName sn memberOf