LDAP Authentication¶

LDAP/Active Directory authentication configuration reference.

Edition note: LDAP authentication is a commercial feature. The community edition supports only local user authentication.

Overview¶

Faraday supports LDAP (Lightweight Directory Access Protocol) authentication, allowing users to sign in with their existing Active Directory or LDAP directory credentials. When enabled, Faraday authenticates users against the configured LDAP server and can automatically assign roles based on group membership.

Key Characteristics¶

Important Constraints¶

Configuration via Web UI¶

1. Click the user icon (top-right corner of Faraday web interface).
2. Select Preferences.
3. Navigate to the LDAP section under Authentication.
4. Click the Activate LDAP slider.
5. Fill in the connection and role mapping fields.
6. Click Save (upper corner).
7. Restart the Faraday Server (see Restart below).

Configuration via CLI¶

Run the following command to configure LDAP interactively:

faraday-manage settings -a update ldap

The command prompts for each setting, showing the current value in brackets:

$ faraday-manage settings -a update ldap
Update settings for: ldap
enabled [False]:
use_local_roles [True]:
default_local_role [admin]:
admin_group []:
asset_owner_group []:
client_group []:
pentester_group []:
disconnect_timeout [2.0]:
server []:
port [389]:
use_ldaps [False]:
use_start_tls [False]:
domain []:
domain_dn []:
bind_format [CN]:
bind_dn []:
user_class [user]:
user_attribute [sAMAccountName]:
group_class [group]:
paginated_fetch [False]:
Do you confirm your changes on ldap?

Press Enter to keep the current value for any setting.

Settings Reference¶

Connection Settings¶

Directory Settings¶

Role Mapping Settings¶

Role Mapping¶

Faraday supports four roles, listed from most to least privileged:

Option A: Group-Based Role Assignment¶

Set use_local_roles to False and configure the group settings:

use_local_roles = false
admin_group = Faraday-Admins
pentester_group = Faraday-Pentesters
asset_owner_group = Faraday-AssetOwners
client_group = Faraday-Clients

Users are assigned the role matching their AD/LDAP group membership. Users not in any mapped group are denied access.

Option B: Local Role Assignment¶

Set use_local_roles to True (default):

use_local_roles = true
default_local_role = admin

All authenticated LDAP users receive the role specified in default_local_role. An administrator can later change individual user roles in the Faraday UI.

Authentication Flow¶

User Login Request
       │
       ▼
┌─────────────────┐
│  Faraday Login   │
│  (Web UI / API)  │
└────────┬────────┘
         │ username + password
         ▼
┌─────────────────┐
│  LDAP Bind       │──── bind_format=CN → CN=user,domain_dn
│  (authenticate)  │──── bind_format=DN → user@domain
└────────┬────────┘
         │ success
         ▼
┌─────────────────┐
│  Group Lookup    │──── Resolve group membership
│  (if group-based)│
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  User Provision  │──── Create/update user record
│  + Role Assign   │──── user_type = 'ldap'
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Session Created │──── JWT token or session cookie
└─────────────────┘

Example Configurations¶

Active Directory (On-Premises)¶

enabled = true
server = dc01.example.com
port = 389
use_ldaps = false
use_start_tls = true
domain = example.com
domain_dn = DC=example,DC=com
bind_format = CN
bind_dn =
user_class = user
user_attribute = sAMAccountName
group_class = group
use_local_roles = false
admin_group = Faraday-Admins
pentester_group = Faraday-Pentesters
asset_owner_group = Faraday-AssetOwners
client_group = Faraday-Clients
disconnect_timeout = 2.0
paginated_fetch = false

Active Directory with LDAPS¶

enabled = true
server = dc01.example.com
port = 636
use_ldaps = true
use_start_tls = false
domain = example.com
domain_dn = DC=example,DC=com
bind_format = CN
bind_dn =
user_class = user
user_attribute = sAMAccountName
group_class = group
use_local_roles = true
default_local_role = pentester
disconnect_timeout = 2.0
paginated_fetch = false

OpenLDAP¶

enabled = true
server = ldap.example.com
port = 389
use_ldaps = false
use_start_tls = true
domain = example.com
domain_dn = OU=People,DC=example,DC=com
bind_format = DN
bind_dn = cn=readonly,dc=example,dc=com
user_class = inetOrgPerson
user_attribute = uid
group_class = groupOfNames
use_local_roles = true
default_local_role = pentester
disconnect_timeout = 2.0
paginated_fetch = false

Restarting the Server¶

After modifying LDAP settings, restart the Faraday Server for changes to take effect:

# Systemd (bare-metal / VM)
systemctl restart faraday-server

# Docker
docker restart faraday-server

Troubleshooting¶

Cannot connect to LDAP server¶

Users cannot log in¶

Testing LDAP Connectivity¶

Use ldapsearch from the Faraday server to verify connectivity:

# Test LDAP connection (plaintext)
ldapsearch -H ldap://dc01.example.com:389 \
  -D "CN=svc-faraday,DC=example,DC=com" \
  -W -b "DC=example,DC=com" "(sAMAccountName=testuser)"

# Test LDAPS connection
ldapsearch -H ldaps://dc01.example.com:636 \
  -D "CN=svc-faraday,DC=example,DC=com" \
  -W -b "DC=example,DC=com" "(sAMAccountName=testuser)"

Recovering from LDAP Lockout¶

If you enable LDAP and can no longer log in with local accounts:

1. Stop the Faraday Server.
2. Disable LDAP via the CLI:

   faraday-manage settings -a update ldap
   # Set enabled = False
   

3. Restart the server.
4. Local users will be available again.

Security Recommendations¶

1. Use LDAPS or STARTTLS — Never send LDAP credentials in plaintext over untrusted networks. Prefer LDAPS (port 636) or STARTTLS.
2. Use a dedicated service account — Configure bind_dn with a least-privilege service account for directory lookups.
3. Use group-based access control — Set use_local_roles=false and map specific AD groups to Faraday roles to limit who can access the platform.
4. Set appropriate default_local_role — If using local roles, prefer client or pentester over admin to follow least-privilege principles.
5. Enable paginated fetch for large directories — Set paginated_fetch=true if your directory has thousands of users to avoid timeouts.

Related Documentation¶

• LDAP-OKTA — LDAP integration using Okta as the LDAP provider
• 2fa — Two-Factor Authentication setup
• SSO — SAML 2.0 Single Sign-On configuration
• Server configuration Server settings reference