LDAP Employee Offboarding with Kestra

id: ldap-employee-offboarding-deprovision
namespace: company.team
description: |
  Deprovision an employee's LDAP directory entry as part of an offboarding workflow.
  Snapshots the account's current group membership for the audit trail, moves the
  entry out of the active people tree into an ex-employees OU, and removes it from
  any groups listed in revoke_group_dns, all built from Ion records converted to
  LDIF so the same flow works whether one group or twenty need to be revoked.

inputs:
  - id: username
    type: STRING
    description: uid of the employee being offboarded (matches the LDAP uid attribute).
  - id: base_dn
    type: STRING
    defaults: dc=example,dc=com
    description: Root distinguished name of the directory, for example dc=example,dc=com.
  - id: revoke_group_dns
    type: ARRAY
    itemType: STRING
    defaults: []
    description: Full DNs of the groups to remove the account from, as supplied by
      HR or the ITSM ticket.

tasks:
  - id: audit_current_membership
    type: io.kestra.plugin.ldap.Search
    description: Snapshot the account's current group membership before anything
      changes, for the offboarding audit trail.
    baseDn: "ou=people,{{ inputs.base_dn }}"
    filter: "(uid={{ inputs.username }})"
    attributes:
      - memberOf
    sizeLimit: 1

  - id: build_deprovision_records
    type: io.kestra.plugin.core.storage.Write
    description: Render an Ion moddn record that relocates the account to
      ou=expeople, plus one Ion modify record per group that removes the account
      from that group's member attribute.
    extension: .ion
    content: |
      {dn:"uid={{ inputs.username }},ou=people,{{ inputs.base_dn }}",changeType:"moddn",newDn:{newrdn:"uid={{ inputs.username }}",deleteoldrdn:true,newsuperior:"ou=expeople,{{ inputs.base_dn }}"}}
      {% for group_dn in inputs.revoke_group_dns %}
      {dn:"{{ group_dn }}",changeType:"modify",modifications:[{operation:"DELETE",attribute:"member",values:["uid={{ inputs.username }},ou=people,{{ inputs.base_dn }}"]}]}
      {% endfor %}

  - id: convert_to_ldif
    type: io.kestra.plugin.ldap.IonToLdif
    description: Convert the moddn and modify Ion records into the LDIF format the
      Modify task expects.
    inputs:
      - "{{ outputs.build_deprovision_records.uri }}"

  - id: apply_deprovisioning
    type: io.kestra.plugin.ldap.Modify
    description: Apply the moddn and modify operations. Each record is processed
      independently, so a group that no longer exists is logged and skipped
      without blocking the account move.
    inputs:
      - "{{ outputs.convert_to_ldif.urisList[0] }}"

  - id: notify
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Confirm the account was relocated and report how many groups it was
      removed from.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "LDAP offboarding complete for uid={{ inputs.username }}. Moved to ou=expeople,{{ inputs.base_dn }} and removed from {{ inputs.revoke_group_dns | length }} group(s). Pre-change membership snapshot: {{ outputs.audit_current_membership.uri }}."
      }

pluginDefaults:
  - type: io.kestra.plugin.ldap.Search
    values:
      hostname: "{{ secret('LDAP_HOSTNAME') }}"
      port: 389
      userDn: "{{ secret('LDAP_ADMIN_DN') }}"
      password: "{{ secret('LDAP_ADMIN_PASSWORD') }}"
  - type: io.kestra.plugin.ldap.Modify
    values:
      hostname: "{{ secret('LDAP_HOSTNAME') }}"
      port: 389
      userDn: "{{ secret('LDAP_ADMIN_DN') }}"
      password: "{{ secret('LDAP_ADMIN_PASSWORD') }}"

triggers:
  - id: offboarding_request
    type: io.kestra.plugin.core.trigger.Webhook
    description: Triggered by the HRIS or ITSM offboarding workflow when an
      employee's status changes to terminated.
    key: "{{ secret('LDAP_OFFBOARDING_WEBHOOK_KEY') }}"

errors:
  - id: alert_on_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert IT security if deprovisioning fails. Offboarding is security
      sensitive and a failed run needs immediate manual follow-up rather than a
      silent retry next week.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "LDAP offboarding failed for uid={{ inputs.username }} (execution {{ execution.id }}). Verify the account's directory state manually."
      }

Offboarding tickets routinely list the systems to lock down: email, SSO, VPN, and the on-premises directory. LDAP is often the one that gets handled manually, days after the fact, because it means editing LDIF by hand or running a one-off ldapmodify command. This blueprint turns that manual step into a repeatable flow: it records the account's current group membership for the audit trail, moves the entry out of the active people tree into an ex-employees OU, and strips it from every group listed on the ticket, all built from Ion records that the LDAP plugin converts to LDIF before applying.

How it works

A io.kestra.plugin.core.trigger.Webhook trigger (offboarding_request) fires the flow when the HRIS or ITSM system marks an employee as terminated, guarded by a secret webhook key.
audit_current_membership (io.kestra.plugin.ldap.Search) looks up the account by uid under ou=people and fetches its memberOf attribute, writing an LDIF snapshot to internal storage before any change is made.
build_deprovision_records (io.kestra.plugin.core.storage.Write) renders one Ion moddn record that relocates the account's DN to ou=expeople, plus one Ion modify record per entry in revoke_group_dns that deletes the account's DN from that group's member attribute.
convert_to_ldif (io.kestra.plugin.ldap.IonToLdif) translates those Ion records into the LDIF format the LDAP plugin's write operations expect.
apply_deprovisioning (io.kestra.plugin.ldap.Modify) submits the moddn and modify operations against the directory. Each record is applied independently, so a group DN that no longer exists is logged and skipped rather than aborting the whole run.
notify (io.kestra.plugin.slack.notifications.SlackIncomingWebhook) confirms the relocation and the number of groups revoked; the errors block alerts a separate channel if any step fails.

What you get

A pre-change audit snapshot of the account's group membership, captured before any modification.
The account relocated out of the active directory tree instead of just flagged, so group-based ACLs stop applying immediately.
Bulk group revocation driven by a simple list input, whether that is one group or twenty.
Fault-tolerant application: a missing or already-removed group does not block the rest of the deprovisioning.
A distinct Slack alert on failure, since a half-completed offboarding is a security gap.

Who it's for

IT and identity teams running an on-premises OpenLDAP, ApacheDS, or similar directory alongside cloud SSO.
Security teams who need an auditable, repeatable offboarding step instead of ad hoc ldapmodify commands.
Platform teams wiring an HRIS or ITSM offboarding workflow to every downstream system, LDAP included.

Prerequisites

An LDAP directory reachable from Kestra, with an admin bind account that can search, move, and modify entries.
An ou=expeople (or similarly named) organizational unit to relocate deprovisioned accounts into.
An HRIS or ITSM system able to call a webhook with the offboarded employee's username and the group DNs to revoke.
A Slack incoming webhook for notifications.

Secrets

LDAP_HOSTNAME: hostname of the LDAP server.
LDAP_ADMIN_DN / LDAP_ADMIN_PASSWORD: bind credentials for an account with permission to move and modify entries.
LDAP_OFFBOARDING_WEBHOOK_KEY: webhook key that guards the trigger.
SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

Add the secrets above to your Kestra namespace.
Create the ou=expeople organizational unit under your base DN if it does not already exist.
POST to the webhook (or run manually) with username, base_dn, and revoke_group_dns.
Check the Slack confirmation and the ou=expeople entry in the directory.

How to extend

Validate or restrict username to a safe character set (for example, alphanumeric plus dot and dash) before it reaches the LDAP filter, since it originates from an external webhook payload and unescaped values in a search filter can enable LDAP filter injection.
Add an io.kestra.plugin.ldap.Search step against ou=expeople after apply_deprovisioning to confirm the move succeeded before reporting success.
Swap the moddn record for a modify record that sets a disabled-account attribute if your schema tracks status instead of relocating entries.
Reverse the flow for onboarding: build an add Ion record from HR-provided attributes and feed it through io.kestra.plugin.ldap.IonToLdif and io.kestra.plugin.ldap.Add to provision the entry and its group memberships in one pass.
Add a scheduled io.kestra.plugin.ldap.Search trigger elsewhere in the catalog to audit for stale accounts that were never offboarded through this path.

LDAP Employee Offboarding and Account Deprovisioning

How it works

What you get

Who it's for

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

LDAP Employee Offboarding and Account Deprovisioning

How it works

What you get

Who it's for

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Monitor an HTTP endpoint and send a Slack alert when it is unhealthy

Automate Incident Response, Create Jira Tickets, Alert Slack, and Log to Database

Govern cloud infrastructure with Kestra Assets: automated S3 bucket provisioning by team

IDM User Provisioning Request via Webhook with Retries

Jenkins Build-to-Deploy Approval Gate with Teams Notification

IIS Site Provisioning with SSL Binding and Health Check

More Core Blueprints

Route AI Requests to the Optimal Model Based on Query Classification

Infrastructure Automation workflow example: Getting started with Kestra

Hello World Example: Getting started with Kestra

Run a Python script in a Kubernetes pod

Reduce LLM API Costs with a Redis Semantic Cache for Repeated Questions

Fetch logs from all pods in a Kubernetes namespace

New to Kestra?