LDAP

Traccar server can authenticate users via an external LDAP (Lightweight Directory Access Protocol) server. The authentication process happens in two steps:

• Traccar connects to the LDAP server with service credentials and looks up the provided login/email with the configured filter
• If a user is found and there is only one match, Traccar tries to authenticate on the LDAP server with the full Distinguished Name and the provided password

If both steps are successful, the user is considered authenticated.

There is still an internal Traccar user representation, which is created on first user login. The server administrator can configure adminGroup/adminFilter to automatically give the user admin rights when they are registered.

Configuration

• ldap.enable - Main switch.
• ldap.url - Full connection URL to the LDAP server. If it is omitted, the next two parameters will be used to connect to the server.
• ldap.server - LDAP server name.
• ldap.port - LDAP server port. Default is 389.
• ldap.base - Search base. Used to limit search scope with some OU.
• ldap.idAttribute - LDAP user attribute used to uniquely identify a user in the catalog. Default is uid. For Active Directory sAMAccountName usually should be used.
• ldap.nameAttribute - LDAP user attribute used to fill the name field in the Traccar representation. Default is cn.
• ldap.mailAttribute - LDAP user attribute used to fill the email field in the Traccar representation. Default is mail.
• ldap.searchFilter - LDAP filter to search for users in the catalog. Must contain a :login substring which will be replaced with the provided login/email during lookup. If the parameter is omitted, the search will happen by simple equality of idAttribute to the provided login/email.
• ldap.adminFilter - LDAP filter to determine if a user is a Traccar admin. Must contain a :login substring which will be replaced with the provided login/email during lookup. If the parameter is omitted but ldap.adminGroup is defined, members of this group will be Traccar admins. If both are missing, users will not be automatically promoted to Traccar admins.
• ldap.user - Service user name used to look up other users in the catalog. Usually the full Distinguished Name should be defined here.
• ldap.password - Password for service user.
• ldap.force - Disables internal authentication; only LDAP users can log in.

Examples

Search filter to log in to Active Directory by either login or email

<entry key='ldap.searchFilter'>(|(sAMAccountName=:login)(mail=:login))</entry>

According to the next filter, the user must be a member of the Traccar users group or its nested groups (!) and not disabled. It is valid for Active Directory.

<entry key='ldap.searchFilter'>(&amp;(sAMAccountName=:login)(memberOf:1.2.840.113556.1.4.1941:=CN=Traccar users,OU=Traccar,OU=Security,DC=domain,DC=local)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))</entry>