Dex LDAP User Bind Timeout Sentinel

Automates continuous health and directory connectivity surveillance of Dex identity provider LDAP connectors across enterprise authentication planes. Interrogates Prometheus login telemetry to detect LDAP bind timeouts, connection pool saturation, and Active Directory domain controller authentication stalls before employee SSO logins fail.

How it works

1. Automated Scheduled Polling: The schedule trigger initiates a surveillance cycle every 15 minutes to inspect Dex identity provider metrics.
2. Metric Extraction: An isolated Python task scrapes Prometheus metrics from the Dex service interface, extracting successful and failed login counters tagged with the LDAP connector ID.
3. Failure Ratio Calculation: Calculates the exact percentage of user authentication attempts that encountered LDAP bind failures over the lookback window.
4. Security Boundary Gate: Compares observed bind failures against configured enterprise tolerance margins (default 10 failures).
5. Incident Notification: Emits formatted Slack alerts to IAM security channels with exact connector identifiers, failure counts, and error percentages.
6. Manifest Publication: Outputs a structured machine-readable JSON object recording authentication telemetry for security compliance logs.

Architecture diagram

flowchart TD
    A[periodic_ldap_audit Schedule Trigger] --> B[scan_dex_ldap_metrics Python Script]
    B --> C[evaluate_bind_threshold Flowable If]
    C -- Bind Failures Exceeded --> D[notify_slack_iam_team Slack Webhook]
    C -- LDAP Authentication Nominal --> E[log_nominal_ldap_state Core Log]
    D --> F[emit_audit_manifest Debug Return]
    E --> F

Architecture components

• Trigger (periodic_ldap_audit): Automated cron trigger executing regular surveillance sweeps across identity provider instances.
• Inspection Task (scan_dex_ldap_metrics): Dockerized Python runtime querying Dex Prometheus metrics with connection timeout safeguards.
• Evaluation Gate (evaluate_bind_threshold): Conditional branching logic separating single user password typos from systematic LDAP service blackouts.
• Notification Action (notify_slack_iam_team): Formatted Slack webhook message delivering actionable telemetry and remediation runbooks.
• Manifest Return (emit_audit_manifest): Standardized JSON output recording exact run parameters for compliance and audit reporting.

Key capabilities

• Active Directory Controller Outage Detection: Identifies when upstream Domain Controllers restart, lose network connectivity, or reject LDAPS TLS handshakes.
• Service Account Lockout Early Warning: Detects when the privileged bind DN service account configured in Dex becomes locked out in Active Directory.
• Zero-Touch Execution: Operates agentlessly by polling standard Dex Prometheus metrics endpoints over internal Kubernetes service networks.
• Credential Stuffing Wave Identification: Flags abnormal surges in failed authentication attempts directed at enterprise workforce directory accounts.

What you get

• Pre-built sentinel protecting workforce and developer single sign-on portals from unmonitored LDAP directory authentication blackouts
• Isolated Docker execution environment with explicit network timeout safeguards preventing stalled workflow runs
• Real-time Slack notifications detailing exact connector names, failed bind counts, and failure percentages
• Standardized audit trail supporting SOC2 access management and identity governance compliance

Who it's for

• Identity and Access Management (IAM) Engineers managing enterprise Dex, OpenLDAP, or Active Directory SSO integrations
• Security Operations Engineers investigating directory authentication anomalies and service account lockouts
• Kubernetes Platform Engineers managing Dex as an OIDC authentication gateway for cluster API servers

Why orchestrate this with Kestra

• Centralizes identity health monitoring without maintaining custom alerting scripts or external daemon checkers
• Encrypts sensitive notification webhooks and cluster access tokens using enterprise namespace secrets
• Provides historical execution archives to satisfy compliance auditors requiring proof of continuous authentication monitoring
• Enables automated multi-system remediation such as opening Jira incident tickets or failing over to secondary domain controllers

Use cases

• Privileged Bind Account Password Expiry: Detect when the read-only bind credentials in dex-config.yaml expire, breaking logins for the entire enterprise.
• Domain Controller LDAPS Certificate Renewal: Identify when updated domain controller SSL certificates lack proper trust chains in the Dex container.
• LDAP Connection Pool Exhaustion: Pinpoint peak-hour login waves where synchronous LDAP searches saturate connection pool limits.

Inputs

Name	Type	Default	Description
dex_metrics_url	STRING	http://dex.auth.svc.cluster.local:5558/metrics	Base HTTP URL exposing Prometheus metrics for the Dex identity provider service.
ldap_connector_id	STRING	corp-active-directory	Identifier of the configured Dex LDAP connector under active surveillance.
max_failed_binds_threshold	INT	10	Maximum allowable failed LDAP bind attempts within the audit window before triggering alerts.
lookback_minutes	INT	15	Time duration in minutes across which Dex LDAP connector authentication metrics are evaluated.
alert_on_timeouts	BOOL	true	Toggle whether Slack alerts are dispatched upon detecting elevated LDAP bind failures.

Expected outputs

• {{ outputs.scan_dex_ldap_metrics.vars.failed_binds_count }}: Total number of failed LDAP bind and login attempts during the polling window.
• {{ outputs.scan_dex_ldap_metrics.vars.successful_logins_count }}: Cumulative count of successful user authentications processed by the connector.
• {{ outputs.scan_dex_ldap_metrics.vars.bind_failure_percent }}: Percentage of total login attempts that resulted in authentication failures.
• {{ outputs.scan_dex_ldap_metrics.vars.is_alerting }}: Boolean flag indicating whether observed failed binds breached tolerance limits.
• {{ outputs.scan_dex_ldap_metrics.vars.audit_timestamp }}: ISO-8601 UTC timestamp recording exact time of sentinel verification.

Prerequisites

• Dex identity provider deployed with an active LDAP connector and Prometheus metrics enabled on port 5558.
• Network connectivity allowing Kestra worker pods to reach the Dex metrics endpoint over internal cluster networks.
• Incoming Slack Webhook configured with publishing permissions into the designated IAM operations channel.

Secrets

• SLACK_WEBHOOK_URL: Secret webhook URL for dispatching incident notifications to team Slack rooms.

Quick start

1. Register the SLACK_WEBHOOK_URL secret within the target Kestra namespace.
2. Import this blueprint into Kestra under the company.security namespace.
3. Update dex_metrics_url with your internal Dex service DNS name.
4. Execute a manual run to verify metric collection and webhook formatting.
5. Enable the periodic_ldap_audit trigger to establish automated continuous surveillance.

Common pitfalls and troubleshooting

• Connector Label Filtering: Ensure the ldap_connector_id input exactly matches the id string declared in Dex's connectors YAML block.
• Telemetry Listener Configuration: Dex requires explicit declaration of telemetry.http: 0.0.0.0:5558 in config.yaml to expose metrics.
• LDAP StartTLS vs Direct LDAPS: Ensure the port in host aligns with TLS expectations (port 389 for StartTLS, port 636 for direct LDAPS).
• User Search Filter Limits: Complex search filters in high-directory-volume environments can exceed LDAP server search time limits; test queries via ldapsearch.

How to extend

• Automated Domain Controller Failover: Trigger a sub-flow to update Dex's ConfigMap to route queries to a backup domain controller IP.
• Service Account Unlock Verification: Chain an Active Directory audit task to verify bind account status when persistent bind errors occur.
• PagerDuty Escalation: Escalate to on-call security engineers via PagerDuty if LDAP bind failure rates exceed 30% during business hours.

Links

• Kestra Python Script Plugin Documentation
• Kestra Slack Plugin Documentation
• Dex Identity Provider LDAP Connector Reference
• Dex Telemetry and Monitoring Official Guide
• Troubleshooting Active Directory LDAP Authentication