--- title: LDAP Decision node description: Configure the LDAP Decision node to verify a username and password against an LDAP user data store and check for expired or locked accounts. component: platform version: 7.5 page_id: platform:auth-node-ref:ldap-decision canonical_url: https://docs.pingidentity.com/platform/7.5/auth-node-ref/ldap-decision.html llms_txt: https://docs.pingidentity.com/platform/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md keywords: ["Nodes & Trees", "Journeys", "Authentication", "LDAP"] page_aliases: ["auth-node-ldap-decision.adoc"] section_ids: availability: Availability inputs: Inputs prerequisites: Prerequisites configuration: Configuration outcomes: Outcomes --- # LDAP Decision node The LDAP Decision node verifies that the provided username and password exist in the specified LDAP user data store. The node also checks whether the associated user account has expired or is locked out. ## Availability | Product | Available? | | ------------------------------------- | ---------- | | PingOne Advanced Identity Cloud | Yes | | PingAM (self-managed) | Yes | | Ping Identity Platform (self-managed) | Yes | ## Inputs This node requires the `username` and `password` properties in the incoming node state. Implement the following nodes earlier in the journey: * Standalone PingAM deployment * [Username Collector node](am-only/username-collector.html) * [Password Collector node](am-only/password-collector.html) * Ping Identity Platform deployment: * [Platform Username node](platform-username.html) * [Platform Password node](platform-password.html) Alternatively, use the [Zero Page Login Collector node](zero-page-login-collector.html). ## Prerequisites None ## Configuration | Property | Usage | | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Primary LDAP Server *(required)* | Specify one or more primary directory servers. Specify each directory server in the following format: `host:port`.For example, `directory_services.example.com:389`. | | Secondary LDAP Server | Specify one or more secondary directory servers. Specify each directory server in the following format: `host:port`.The journey uses the secondary servers when none of the primary servers are available.For example, `directory_services_backup.example.com:389`. | | DN to Start User Search *(required)* | Specify the DN from which to start the user search. More specific DNs, such as `ou=sales,dc=example,dc=com`, result in better search performance.If multiple entries with the same attribute values exist in the directory server, make sure this property is specific enough to return only one entry. | | Bind User DN, Bind User Password | The credentials used to connect to the LDAP user data store. | | Attribute Used to Retrieve User Profile *(required)* | The attribute used to retrieve a user profile from the directory server.The user search will have already happened, as specified by the Attributes Used to Search for a User to be Authenticated and User Search Filter properties. | | Attributes Used to Search for a User to be Authenticated *(required)* | The attributes the node uses to match the credentials provided by the user to an entry in the directory server.For example, a value of `uid` forms the search filter `uid=user`. If you specify multiple values, such as `uid` and `cn`, the node forms a complex search filter `(\|(uid=user)(cn=user))`.Multiple attribute values let the user authenticate with any one of the values. For example, if you set both `uid` and `mail`, then Barbara Jensen can authenticate with either `bjensen` or `bjensen@example.com`. If you're using account lockout and you set multiple attribute values here, you must add those attributes to the Alias Search Attribute Name property in the User profile. | | User Search Filter | A filter to append to user searches.For example, if your search attribute is `mail` and you set User Search Filter to `(objectClass=inetOrgPerson)`, the node uses `(&(mail=address)(objectClass=inetOrgPerson))` as the resulting search filter. In this example, *address* is the mail address provided by the user. | | Search Scope | The extent of the search for users in the directory server:- `OBJECT`: The search extends only to the entry specified by the DN to Start User Search. - `ONELEVEL`: The search extends to the entries that are direct children of the DN to Start User Search. - `SUBTREE`: The search extends to the DN to Start User Search and every entry under it.Default: `SUBTREE` | | LDAP Connection Mode | Specifies whether to use SSL or StartTLS to connect to the directory server. The node must be able to trust the certificates used.Possible values: `LDAP`, `LDAPS`, and `StartTLS`Default: `LDAP` | | mTLS Enabled | Enables mTLS (mutual TLS) between AM and the directory server.This setting applies to *all* configured LDAP servers; that is, AM uses mTLS to authenticate to all LDAP servers configured for this node.When mTLS is enabled, AM ignores the values for Bind User DN and Bind User Password.If you enable this property, you must:- Set the LDAP Connection Mode to `LDAPS` - Provide an mTLS Secret Label Identifier]Default: Disabled | | | Identifier used to create a secret label for mapping to the mTLS certificate in the secret store. AM uses this identifier to create a specific secret label for this node. The secret label takes the form `am.authentication.nodes.ldap.decision.mtls.identifier.cert` , where `identifier` is the value of mTLS Secret Label Identifier. The identifier can only contain alphanumeric characters (`a-z`, `A-Z`, `0-9`) and periods (`.`). It can't start or end with a period. All LDAP servers configured for this node share the same secret label.For more security, you should rotate certificates periodically. When you rotate a certificate, update the corresponding mapping in the realm secret store configuration to reflect this label. When you rotate a certificate, AM closes any existing connections using the old certificate. A new connection is selected from the connection pool and no server restart is required. | | Return User DN to DataStore | When enabled, the node returns the DN rather than the User ID. From the DN value, AM uses the RDN to search for the user profile. For example, if a returned DN value is `uid=demo,ou=people,dc=openam,dc=example,dc=org`, AM uses `uid=demo` to search the directory server.Default: Enabled | | User Creation Attributes | This list lets you map (external) attribute names from the LDAP directory server to (internal) attribute names used by AM. | | Minimum Password Length | The minimum acceptable password length.Default: `8` | | LDAP Behera Password Policy Support | When enabled, support interoperability with servers that implement the Internet-Draft, [Password Policy for LDAP Directories](https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-09).Default: Enabled | | Trust All Server Certificates | When enabled, the server blindly trusts server certificates, including self-signed test certificates.Default: Disabled | | LDAP Connection Heartbeat Interval | Specifies how often AM should send a heartbeat request to the directory server to ensure that the connection doesn't remain idle.Some network administrators configure firewalls and load balancers to drop connections that are idle for too long. Set the units for the interval in the `LDAP Connection Heartbeat Time Unit` property. Setting this property to 0 does not disable the heartbeat (keepalive) or load balancer availability checks. Disabling these features can only be configured at the global level.Default: `10` | | LDAP Connection Heartbeat Time Unit | The time unit for the `LDAP Connection Heartbeat Interval`.Default: `seconds` | | LDAP Operations Timeout | The timeout, in seconds, that AM should wait for a response from the directory server.Default: `0` (means no timeout) | | Use mixed case for password change messages | Specifies whether the server returns password change messages in mixed (sentence) case or transforms them to uppercase.By default, the server transforms password reset and password change messages to uppercase. Enable this setting to return messages in sentence case.Default: Disabled | | LDAP Affinity Level | Level of affinity used to balance requests across LDAP servers.Affinity-based load balancing means that each request for the same user entry goes to the same DS server. The DS server used for a specific operation is determined by the DN of the identity involved.List the directory server instances that form part of the affinity deployment in the Primary LDAP Server and Secondary LDAP Server properties.Options are:- `NONE` – no affinity - `BIND` – affinity for BIND requests only - `ALL` – affinity for all requestsDefault: `NONE` | ## Outcomes * `True` The provided credentials match those found in the LDAP user data store. * `False` The provided credentials don't match those found in the LDAP user data store. * `Locked` The profile associated with the provided credentials is locked. * `Cancelled` The user must change their password. When the journey prompts the user to change their password, the user cancels the password change. * `Expired` The profile is found, but the password has expired. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The LDAP Decision node *requires* specific user attributes in the LDAP user data store. These required attributes are present by default in PingDS. If you are using an alternative identity store, you might need to [modify your LDAP schema](https://docs.pingidentity.com/pingam/7.5/installation/prepare-identity-repository.html#prepare-idrepo-schema) to use this node. |