LDAP Search

LDAP Search

Certified

Search LDAP entries and store results

Queries an LDAP server with a rendered filter and attributes, optionally paging to bypass server result limits. Accepts an optional size cap that truncates results when set and writes the LDIF output to internal storage.

yaml
type: io.kestra.plugin.ldap.Search

Retrieve LDAP entries. In this example, assuming exactly one entry matches each filter, the resulting LDIF file (referenced by the task output uri) will contain four entries in this order (we search twice on the same baseDn): (dn, description, mail) of {melusine, metatron, melusine, metatron}.

yaml
id: ldap_search
namespace: company.team

tasks:
  - id: search
    type: io.kestra.plugin.ldap.Search
    userDn: cn=admin,dc=orga,dc=en
    password: "{{ secret('LDAP_PASSWORD') }}"
    baseDn: ou=people,dc=orga,dc=en
    filter: (|(sn=melusine*)(sn=metatron*))
    attributes:
      - description
      - mail
    hostname: 0.0.0.0
    port: 15060
Properties

Hostname

Hostname for connection.

Password

User password for connection.

Port

A whole number describing the port for connection.

User

Username for connection.

SubTypestring
Default["*"]

Attributes to return

LDAP attributes to fetch; defaults to all user attributes. Special tokens: "+" (operational), "1.1" (none), "0.0" (all except operational, cannot be combined with others).

Defaultsimple
Possible Values
simplegssapi

Authentication method

Authentication method to use with the LDAP server.

Defaultou=system

Base DN

Search root DN; defaults to ou=system.

Default(objectclass=*)

Filter

Filter for the search in the LDAP. Must be a complete, syntactically valid LDAP filter expression (RFC 4515); it is parsed and validated before use. Avoid interpolating untrusted, unescaped values into this filter (e.g. via Pebble expressions), as doing so can allow LDAP filter injection (CWE-90).

Kerberos key distribution center

Needed for GSSAPI authentication method. If this is not provided, an attempt will be made to determine the appropriate value from the system configuration.

Page size

Enable LDAP paging (RFC2696) and fetch results by chunks of this size; null or <=0 disables paging.

Use this when you want to RETRIEVE ALL matching entries safely, even if there are more than the server limit (often ~1000). The task will perform multiple paged searches until all entries are collected.

  • Typical use case: full export / sync of an LDAP tree.
  • Consequence: no truncation, but potentially more requests and longer execution time.

Reference (ref) of the pluginDefaults to apply to this task.

Realm

Needed for GSSAPI authentication method. If this is not provided, an attempt will be made to determine the appropriate value from the system configuration.

SubTypestring
Default["AUTH_CONF","AUTH_INT","AUTH"]
Possible Values
AUTHAUTH_INTAUTH_CONF

saslAllowedQoP

Used for GSSAPI authentication method only. The list of allowed qualities of protection that may be used for communication after authentication has completed, ordered from most preferred to least preferred.

By default, the full list is allowed, sorted from the most secure to the least secure: - AUTH_CONF # This ensures that third-party observers will not be able to decipher communication between the client and server (i.e., that the communication will be encrypted). - AUTH_INT # This ensure that the communication cannot be altered in an undetectable manner. - AUTH # Only authentication is to be performed, with no integrity or confidentiality protection for subsequent communication.

Size limit

Maximum number of entries to return; truncates results when hit and accepts SIZE_LIMIT_EXCEEDED responses. Leave blank to use the server default.

SSL Configuration

Configure SSL/LDAPS connection parameters.

Definitions
insecureTrustAllCertificatesbooleanstring

Whether to disable checking of the remote SSL certificate.

Only applies if no trust store is configured. Note: This makes the SSL connection insecure and should only be used for testing. If you are using a self-signed certificate, set up a trust store instead.

Default{ "name": "SUB" }

Search scope

LDAP search scope; defaults to SUB (base entry plus all descendants). Options: BASE (base only), ONE (immediate children), SUB, SUBORDINATE_SUBTREE (descendants only).

Definitions
namestring
Formaturi

Result file URI

A file that contains zero or more matching queries as LDIF formatted strings.

The total number of LDAP entries found by the search.

The average time taken to complete the LDAP search.

More Plugins in this Category

Liquibase
Liquibase

Tasks that run Liquibase change management commands.

Data

2 tasks

PostgreSQL
PostgreSQL

Tasks that connect to PostgreSQL via JDBC to run queries and loads.

Data

6 tasks

25 blueprints