LDAP Authentication

Purpose

The LDAP Authentication page in the Admin Console allows you to configure Appian to authenticate users against an external directory server, like Microsoft Active Directory, via LDAP rather than its native authentication. If your organization requires the use of self-signed certificates with LDAPS, Appian will automatically use your uploaded certificates when establishing an LDAPS connection.

Access

To access the LDAP Authentication page, go to the Admin Console. Then, in the left navigation menu, under Authentication, click LDAP Authentication.

Settings

• Enable LDAP: Should Appian use LDAP to authenticate users? When this is not selected, all other fields on this page are disabled.
• Servers: The URLs of the LDAP servers to authenticate against. URLs must start with "ldap://" or "ldaps://" and should include the base DN for any query to the LDAP server. Multiple servers will be tried one at a time in the order listed. The base DN must be the same for all servers.
• LDAP Server Connection Timeout: The amount of time, in seconds, that the system will wait when trying to connect to an LDAP server before moving on to the next server in the list. The default is 30 seconds. The timeout must be set to a value between 1 and 300 seconds, inclusive.
• Authentication Method: There are two methods of authenticating via LDAP: "Bind as user" and "Search for user then bind as user".
  • "Bind as user" means that Appian will take the username and password provided by a user when they sign into Appian and attempt to bind to the LDAP server with those credentials.
  • "Search for user then bind as user" means that Appian will connect to the LDAP server using a pre-configured set of credentials and search for the user by combining the username they provide with the value of the Search Filter field.
    • Note that if your configuration uses LDAP User Bind to authenticate with the LDAP server (instead of LDAP over SSL), all user entered passwords are sent to the LDAP server unencrypted.
• DN Pattern: A mapping from the username a user enters when signing in to a distinguished name in the LDAP server. Only available when the "Bind as user" option is selected.
• Administrator DN: The distinguished name of an administrative account in the LDAP server that Appian will use to bind to the LDAP server. Only available when the "Search for user then bind as user" option is selected.
• Password: The password for an administrative account in the LDAP server that Appian will use to bind to the LDAP server. Only available when the "Search for user then bind as user" option is selected.
• Search Filter: A mapping from the username a user enters when signing in to an LDAP search query. Only available when the "Search for user then bind as user" option is selected.
• Username Attribute: The name of the LDAP attribute that corresponds to an Appian username.
• E-mail Attribute: The name of the LDAP attribute that holds the user's e-mail address.
• First Name Attribute: The name of the LDAP attribute that holds the user's first name.
• Last Name Attribute: The name of the LDAP attribute that holds the user's last name.
• Create Users Upon Login: If a user exists in the LDAP server but does not exist in Appian, should the user be auto-created the first time they sign into Appian?
• Use lowercase usernames for Appian user lookup: Should Appian lowercase the username that comes back from the LDAP server when looking up the Appian account? Select this option only if all of your usernames only contain lowercase letters.
• Restrict LDAP Authentication to a Specific Group: Should all users authenticate via LDAP or only a subset of users?
• Appian LDAP Group: If only a subset of users should authenticate via LDAP, which group of users should authenticate via LDAP? If a user is a member of the Appian SAML group and the Appian LDAP group, they must authenticate with SAML, not LDAP.

In order to prevent you from locking yourself out of Appian, if your configuration requires that the user you are currently logged in as must authenticate via LDAP then you must successfully test your configuration using the "Test" button before saving it.

It is not possible to configure Appian such that a given user may authenticate with either LDAP or native Appian authentication. Each account may only authenticate against one or the other.

LDAP authentication settings cannot be imported or exported from the Admin Console.

Feedback