--- title: Ldap slug: connectors/ldap docTags: createdAt: 2026-06-09T16:29:38.277Z --- LDAP is a protocol used for accessing and managing directory information over an IP network. LDAP (Lightweight Directory Access Protocol) is a protocol used to access and manage directory information over an IP network. The LDAP Turbine Connector enables seamless integration with LDAP directories, allowing users to automate directory management tasks such as adding, deleting, modifying, and searching directory entries. By integrating LDAP with Swimlane Turbine, users can streamline user synchronization and directory management processes, enhancing security operations with automated workflows and reducing manual intervention. ## Prerequisites Before you can use the LDAP connector for Turbine, ensure the following prerequisites are met: - Authentication to the LDAP server is required. ## Authentication This connector uses [ldap3](https://ldap3.readthedocs.io/) for LDAP binds. Configure connection and authentication on the LDAP asset. ### Supported authentication types | Authentication | Asset fields | Behavior | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SIMPLE** (default) | **User** (Bind DN), **Password** | Standard LDAP bind. | | **ANONYMOUS** | No **User** or **Password** | Anonymous bind. | | **NTLM** | **User** (for example `DOMAIN\user`), **Password**; optional **session\_security** | NTLM bind (Active Directory). Defaults to **session\_security=ENCRYPT** for SASL sealing. | | **SASL\_EXTERNAL** | **tls\_client\_certificate\_b64**, **tls\_client\_private\_key\_b64**; optional **tls\_ca\_cert\_b64**, **verify\_ssl**, **sasl\_external\_identity** | SASL EXTERNAL over LDAPS with mutual TLS. Matches ldap3 `authentication=SASL`, `sasl_mechanism=EXTERNAL`. | | **GSSAPI** | Kerberos fields below; optional **session\_security** | SASL GSSAPI (Kerberos). Runs `kinit` with a keytab, builds `krb5.conf` (AES enctypes) at runtime, then binds via ldap3 + the Python `gssapi` package. Defaults to **session\_security=ENCRYPT** so AD password resets work without LDAPS. | Set **Authentication** to one of: `ANONYMOUS`, `SIMPLE`, `NTLM`, `SASL_EXTERNAL`, `GSSAPI`. ### Connection asset fields | Field | Required | Default | Description | | ---------------------------------- | ----------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **host** | Yes\* | — | LDAP server hostname or IP. Also used as the default KDC host for GSSAPI when **kerberos\_kdc\_host** is not set. | | **domain\_name** | Yes\* | — | Alternative to **host**; resolved to an IP when **host** is omitted. | | **port** | No | `389` | LDAP port. | | **user** | No | — | Bind DN for SIMPLE/NTLM. | | **password** | No | — | Password for SIMPLE or NTLM. | | **sasl\_external\_identity** | No | `""` | Optional authorization identity for SASL EXTERNAL. | | **tls\_ca\_cert\_b64** | No | — | Optional CA bundle for SASL EXTERNAL / LDAPS. | | **tls\_client\_certificate\_b64** | For SASL EXTERNAL | — | Client certificate (PEM), base64 or filesystem path. | | **tls\_client\_private\_key\_b64** | For SASL EXTERNAL | — | Client private key (PEM), base64 or filesystem path. | | **use\_ssl** | No | `false` | Use LDAPS when `true`. Auto-enabled for SASL EXTERNAL. | | **connect\_timeout** | No | `120` | Connection timeout in seconds. | | **auto\_bind** | No | `NO_TLS` | `NO_TLS`, `DEFAULT`, `NONE`, `TLS_BEFORE_BIND`, or `TLS_AFTER_BIND`. Use **NO\_TLS** for typical cleartext LDAP on port 389. | | **verify\_ssl** | No | `true` | When false, SASL EXTERNAL / LDAPS skips server certificate validation (testing only). | | **session\_security** | No | `ENCRYPT` for NTLM/GSSAPI | `ENCRYPT` or `NONE`. SASL confidentiality (AES via Kerberos/NTLM session keys). Required for Active Directory `unicodePwd` updates when LDAPS/startTLS are unavailable. Ignored for SIMPLE/ANONYMOUS/SASL\_EXTERNAL. | \* Provide **host** or **domain\_name**. ### GSSAPI / Kerberos asset fields Used when **Authentication** is `GSSAPI`: | Field | Required | Default | Description | | ------------------------------------- | -------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | **kerberos\_principal** | Yes | — | Client principal for `kinit` (for example `adminuser@EXAMPLE.COM`). | | **kerberos\_keytab\_path** | Yes | — | Base64-encoded keytab for **kerberos\_principal**. | | **kerberos\_realm** | No | From principal | Kerberos realm (for example `EXAMPLE.COM`). Parsed from **kerberos\_principal** when omitted. | | **kerberos\_domain** | No | Lowercase realm | DNS domain (for example `example.com`). Used to expand short service hostnames to FQDNs. | | **kerberos\_kdc\_host** | No | **host** | KDC hostname or IP when the KDC is on a different host than LDAP. | | **sasl\_kerberos\_service\_hostname** | No | **host** / KDC host | Hostname in the LDAP service principal (`ldap/hostname@REALM`). Short names are expanded with **kerberos\_domain** when set. | ### Example assets **SIMPLE bind** ```json { "host": "10.0.0.10", "port": 389, "user": "cn=admin,dc=example,dc=com", "password": "secret", "authentication": "SIMPLE", "auto_bind": "NO_TLS", "use_ssl": false } ``` ### SASL EXTERNAL asset fields Used when **Authentication** is `SASL_EXTERNAL`: | Field | Required | Description | | ---------------------------------- | -------- | ------------------------------------------------------------------- | | **host** | Yes | LDAP server hostname or IP | | **port** | No | Default `636` recommended for LDAPS | | **use\_ssl** | No | Set `true` for LDAPS (defaulted to `true` when using SASL EXTERNAL) | | **tls\_client\_certificate\_b64** | Yes\* | Base64-encoded client certificate (PEM) | | **tls\_client\_private\_key\_b64** | Yes\* | Base64-encoded client private key (PEM) | | **tls\_ca\_cert\_b64** | No | Base64-encoded CA bundle (PEM) | | **verify\_ssl** | No | Set `false` for self-signed / lab certificates | | **sasl\_external\_identity** | No | Optional EXTERNAL authorization identity; omit for cert-only auth | The connector writes decoded PEM files to temp paths, builds a ldap3 `Tls` object, opens LDAPS, then runs `SASL EXTERNAL` bind the same way as the standalone EXTERNAL test script. **SASL EXTERNAL example** ```json { "host": "10.0.0.10", "port": 636, "authentication": "SASL_EXTERNAL", "use_ssl": true, "auto_bind": "NO_TLS", "verify_ssl": false, "tls_ca_cert_b64": "", "tls_client_certificate_b64": "", "tls_client_private_key_b64": "" } ``` ### Generating base64 TLS material for SASL EXTERNAL The connector expects **PEM-encoded** certificate and key files, each encoded as a single base64 string with **no line breaks**. At runtime it decodes them to temporary files and uses them for mutual TLS (LDAPS on port `636`). You need three files: | PEM file | Asset field | Required | | ----------------------------- | ---------------------------------- | ------------------------------- | | CA certificate (trust anchor) | **tls\_ca\_cert\_b64** | No (recommended for production) | | Client certificate | **tls\_client\_certificate\_b64** | Yes | | Client private key | **tls\_client\_private\_key\_b64** | Yes | Each file should look like PEM text, for example: ```text -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- ``` ```text -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- ``` **Linux** — encode each file as one line (`-w0` disables wrapping): ```bash base64 -w0 /etc/ldap/client/ca.crt base64 -w0 /etc/ldap/client/client.crt base64 -w0 /etc/ldap/client/client.key ``` **macOS** — `base64` wraps by default; strip newlines: ```bash base64 -i /path/to/ca.crt | tr -d '\n' base64 -i /path/to/client.crt | tr -d '\n' base64 -i /path/to/client.key | tr -d '\n' ``` Paste each output into the matching asset field in Swimlane Turbine, or into `data/asset.json` for local testing: ```json { "tls_ca_cert_b64": "", "tls_client_certificate_b64": "", "tls_client_private_key_b64": "" } ``` **Verify** a value decodes back to valid PEM before saving the asset: ```bash echo "" | base64 -d | head -3 ## should show -----BEGIN CERTIFICATE----- or -----BEGIN PRIVATE KEY----- ``` **OpenSSL** — if you only have separate cert/key paths on the LDAP host: ```bash base64 -w0 /etc/ldap/cacert.pem ## Client cert + key issued for SASL EXTERNAL / mutual TLS base64 -w0 /etc/ldap/client/client.crt base64 -w0 /etc/ldap/client/client.key ``` For OpenLDAP **SASL EXTERNAL**, the client certificate is typically mapped to an LDAP identity via `olcAuthzRegexp` (for example `CN=john` → `uid=john,dc=example,dc=com`). Include a **CN** on the client cert that matches your server mapping. Set **verify\_ssl** to `false` only in lab environments with self-signed server certificates. **GSSAPI bind** (with AES session encryption for AD without LDAPS) ```json { "host": "10.0.0.10", "port": 389, "authentication": "GSSAPI", "auto_bind": "NO_TLS", "use_ssl": false, "session_security": "ENCRYPT", "kerberos_principal": "adminuser@EXAMPLE.COM", "kerberos_keytab_path": "", "sasl_kerberos_service_hostname": "ldap-server.example.com" } ``` `session_security=ENCRYPT` negotiates a Kerberos confidentiality layer (AES when the ticket uses AES enctypes). This satisfies Active Directory’s requirement for an encrypted channel when resetting passwords via `unicodePwd` without LDAPS or startTLS. Generate base64 for **kerberos\_keytab\_path** on the KDC/LDAP host: ```bash base64 -w0 /path/to/adminuser.keytab ``` For local `tsdk action run local` runs, set **host** to a server reachable from the connector container (for example a VM IP, or `host.docker.internal` when LDAP runs on the Docker host). ### References - [ldap3 operations](https://ldap3.readthedocs.io/en/latest/operations.html) - [ldap3 bind / SASL / Kerberos](https://ldap3.readthedocs.io/en/latest/bind.html#sasl) ## Capabilities This connector provides the following LDAP operations: **Search** - Query all Users - Query System - Custom Query - User is Member of Group - Pagination Support (using `page_size` and `page_number` parameters) - If neither `page_size` nor `page_number` is provided: Returns all objects matching the query - If only `page_size` is provided: Returns results with default `page_number` = 1 - If only `page_number` is provided: Returns results with default `page_size` = 1000 - If both `page_size` and `page_number` are provided: Works accordingly using the specified values **Add** - Add User - Add Computer - Add Contact - Add Shared Folder - Add Organizational Unit - Custom Create **Delete** - Delete User - Delete Computer - Delete Contact - Delete Shared Folder - Delete Organizational Unit **Modify** - Disable User - Enable User - Modify Password - Modify Password at Next Login - Update System - Update Container - Custom Update **CSV Export Support** All actions (Search, Add, Delete, and Modify) support CSV export functionality. By setting the `to_csv` parameter to `true`, the operation results will also be returned as a CSV file object, enabling easy data export and integration with other systems. ## Use cases ### Microsoft Active Directory See the examples below to implement your own Microsoft Active Directory functionalities. For more information please read the [Microsoft Active Directory Technical Specification](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a). *** ### Search Operations **Query all Users** Operation: Search Inputs: ```javascript "search_base": "dc=testdomain,dc=local", "search_filter": "(&(objectClass=user)(objectCategory=person)(|(CN=*)))" ``` Note: Without `page_size` or `page_number`, this returns all users matching the query. **Query System** Operation: Search Inputs: ```javascript "search_base": "CN=WindowsNT,OU=Executives,DC=testdomain,DC=local", "search_filter": "(&(objectClass=computer)(objectCategory=person)(|(CN=*)))" ``` **Custom Query** Operation: Search Inputs: ```javascript "search_base": "dc=testdomain,dc=local", "search_filter": "(&(objectClass=user)(objectCategory=person)(|(CN=*)))" "attributes": {} ``` **User is Member of Group** Operation: Search Inputs: ```javascript "search_base": "CN=Leeroy Jenkins,OU=friends,DC=testdomain,DC=local", "search_filter": "(&(objectClass=user)(objectCategory=person)(|(CN=*)))" ``` *** **Pagination Support** The Search action supports pagination using `page_size` and `page_number` parameters: **Search with Page Size Only** Operation: Search Inputs: ```javascript "search_base": "dc=testdomain,dc=local", "search_filter": "(&(objectClass=user)(objectCategory=person)(|(CN=*)))", "page_size": 50 ``` Note: Returns 50 results from page 1 (default). **Search with Page Number Only** Operation: Search Inputs: ```javascript "search_base": "dc=testdomain,dc=local", "search_filter": "(&(objectClass=user)(objectCategory=person)(|(CN=*)))", "page_number": 2 ``` Note: Returns up to 1000 results (default page\_size) from page 2. **Search with Both Page Size and Page Number** Operation: Search Inputs: ```javascript "search_base": "dc=testdomain,dc=local", "search_filter": "(&(objectClass=user)(objectCategory=person)(|(CN=*)))", "page_size": 10, "page_number": 3 ``` Note: Returns 10 results from page 3 as specified. *** **CSV Export Support** **Search with CSV Export** Operation: Search Inputs: ```javascript "search_base": "dc=testdomain,dc=local", "search_filter": "(&(objectClass=user)(objectCategory=person)(|(CN=*)))", "to_csv": true ``` **Search with Pagination and CSV Export** Operation: Search Inputs: ```javascript "search_base": "dc=testdomain,dc=local", "search_filter": "(&(objectClass=user)(objectCategory=person)(|(CN=*)))", "page_size": 50, "page_number": 2, "to_csv": true ``` *** ### Add Operations **Add User** Operation: Add Inputs: ```javascript "dn": "CN=Charles,OU=friends,DC=testdomain,DC=local", "object_class": ["person", "user"], "attributes": {} ``` **Add Computer** Operation: Add Inputs: ```javascript "dn": "CN=WindowsNT,OU=Executives,DC=testdomain,DC=local", "object_class": ["computer"] ``` **Add Contact** Operation: Add Inputs: ```javascript "dn": "CN=A Contact,OU=friends,DC=testdomain,DC=local", "object_class": ["contact"] ``` **Add Shared Folder** Operation: Add Inputs: ```javascript "dn": "CN=A Folder,OU=friends,DC=testdomain,DC=local", "object_class": ["volume"] ``` **Add Organizational Unit** Operation: Add Inputs: ```javascript "dn": "OU=Organizational Unit Name,OU=friends,DC=testdomain,DC=local", "object_class": ["OrganizationalUnit"] ``` **Custom Create** Operation: Add Inputs: ```javascript "dn": "CN=Nacho Libre,OU=friends,DC=testdomain,DC=local", "object_class": ["top", "person", "organizationalPerson", "user"], "attributes": {} ``` **Add User with CSV Export** Operation: Add Inputs: ```javascript "dn": "CN=Charles,OU=friends,DC=testdomain,DC=local", "object_class": ["person", "user"], "attributes": {}, "to_csv": true ``` *** ### Delete Operations **Delete User** Operation: Delete Inputs: ```javascript "dn": "CN=Charles,OU=friends,DC=testdomain,DC=local" ``` **Delete Computer** Operation: Delete Inputs: ```javascript "dn": "CN=WindowsNT,OU=Executives,DC=testdomain,DC=local" ``` **Delete Contact** Operation: Delete Inputs: ```javascript "dn": "CN=A Contact,OU=friends,DC=testdomain,DC=local" ``` **Delete Shared Folder** Operation: Delete Inputs: ```javascript "dn": "CN=A Folder,OU=friends,DC=testdomain,DC=local" ``` **Delete Organizational Unit** Operation: Delete Inputs: ```javascript "dn": "OU=Organization Unit Name,OU=friends,DC=testdomain,DC=local" ``` **Delete User with CSV Export** Operation: Delete Inputs: ```javascript "dn": "CN=Charles,OU=friends,DC=testdomain,DC=local", "to_csv": true ``` *** ### Modify Operations **Disable User** Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "userAccountControl", "operation": "MODIFY_REPLACE", "value": [ "514" ] } ] ``` **Enable User** Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "userAccountControl", "operation": "MODIFY_REPLACE", "value": [ "512" ] } ] ``` **Modify Password** Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "userPassword", "operation": "MODIFY_REPLACE", "value": [ "123qwe" ] } ] ``` **Modify Active Directory Password (**`unicodePwd`**)** Use GSSAPI or NTLM with `session_security=ENCRYPT` (default) when LDAPS is unavailable. The connector encodes `unicodePwd` as quoted UTF-16-LE for Active Directory. Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "unicodePwd", "operation": "MODIFY_REPLACE", "value": [ "NewP@ssw0rd!" ] } ] ``` **Modify Password at Next Login** Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "pwdLastSet", "operation": "MODIFY_REPLACE", "value": [ "0" ] } ] ``` **Update System** Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "operatingSystem", "operation": "MODIFY_REPLACE", "value": [ "Windows Server 2012" ] } ] ``` **Update Container** Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "email", "operation": "MODIFY_REPLACE", "value": [ "new_email@example.com" ] } ] ``` **Custom Update** Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "sn", "operation": "MODIFY_REPLACE", "value": [ "swimlane" ] } ] ``` **Modify User with CSV Export** Operation: Modify Inputs: ```javascript "dn": "CN=john doe,OU=friends,DC=testdomain,DC=local", "changes": [ { "attribute_name": "userAccountControl", "operation": "MODIFY_REPLACE", "value": [ "512" ] } ], "to_csv": true ``` - [Link to LDAP Operations Documentation](https://ldap3.readthedocs.io/en/latest/operations.html) - [Link to LDAP BIND and SASL Documentation](https://ldap3.readthedocs.io/en/latest/bind.html#sasl) - [Link to LDAP Modify Operation Documentation](https://ldap3.readthedocs.io/en/latest/modify.html) - In the case of using the LDAP **Modify** Connector action, please pass the input **changes** parameter as shown below: ```javascript "changes": [ {"attribute_name": "memberOf", "operation": "MODIFY_ADD", "value": ["CN=Group1,OU=Groups,DC=testdomain,DC=local"]}, {"attribute_name": "memberOf", "operation": "MODIFY_DELETE", "value": ["CN=Group2,OU=Groups,DC=testdomain,DC=local"]}, {"attribute_name": "userAccountControl", "operation": "MODIFY_REPLACE", "value": ["514"]} ``` ] # Configurations ## LDAP Authentication Authenticates LDAP server ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------ | | host | Address to the target host. | string | Optional | | domain\_name | Domain Name. | string | Optional | | port | Port Number | number | Optional | | user | Username | string | Optional | | password | Password | string | Optional | | use\_ssl | Use SSL | boolean | Optional | | connect\_timeout | The timeout in seconds for each connection attempt. | number | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | auto\_bind | Auto Bind | string | Optional | | authentication | SIMPLE, ANONYMOUS, NTLM, SASL EXTERNAL (mutual TLS client certificate), or GSSAPI (Kerberos). For NTLM/GSSAPI, session\_security defaults to ENCRYPT (AES SASL sealing) for Active Directory password resets without LDAPS. | | | | string | Optional | | | | sasl\_external\_identity | Optional authorization identity string for SASL EXTERNAL. Omit for certificate-only auth. | | | | string | Optional | | | | tls\_ca\_cert\_b64 | Optional base64-encoded CA bundle (PEM) for SASL EXTERNAL / LDAPS trust anchors. | | | | string | Optional | | | | tls\_client\_certificate\_b64 | Base64-encoded client certificate (PEM) for SASL EXTERNAL. Required unless tls\_client\_certificate\_path is set. | | | | string | Optional | | | | tls\_client\_private\_key\_b64 | Base64-encoded client private key (PEM) for SASL EXTERNAL. Required unless tls\_client\_private\_key\_path is set. | | | | string | Optional | | | | kerberos\_principal | Client principal for keytab-based kinit (for example [adminuser@EXAMPLE.COM](mailto\:adminuser@EXAMPLE.COM)). The realm after @ is used for Kerberos configuration when kerberos\_realm is not set. | | | | string | Optional | | | | kerberos\_keytab\_path | BASE 64 encoded keytab file. | string | Optional | | kerberos\_realm | Optional Kerberos realm (for example EXAMPLE.COM). Defaults to the realm in kerberos\_principal. | | | | string | Optional | | | | kerberos\_domain | Optional DNS domain for the LDAP service hostname (for example example.com). Defaults to kerberos\_realm lowercased and is used to expand short service hostnames to FQDNs. | | | | string | Optional | | | | kerberos\_kdc\_host | Optional KDC hostname or IP. Defaults to host when not set. | | | | string | Optional | | | | sasl\_kerberos\_service\_hostname | Hostname used in the ldap\@host service principal for GSSAPI bind. If omitted, host or kerberos\_kdc\_host is used. | | | | string | Optional | | | | session\_security | SASL session security layer for NTLM or GSSAPI. ENCRYPT negotiates confidentiality (AES via Kerberos/NTLM session keys) so Active Directory operations such as password resets (unicodePwd) work over cleartext LDAP without LDAPS or startTLS. Defaults to ENCRYPT for NTLM and GSSAPI. Set NONE to disable sealing. | | | | string | Optional | | | # Actions ## Add Add a new entry to the LDAP directory using the provided distinguished name (DN) and object class. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------------------------------------------- | | `dn` | string | Required | Parameter for Add | | `object_class` | array | Required | Parameter for Add | | `attributes` | object | Optional | Parameter for Add | | `attributes.cn` | string | Optional | Parameter for Add | | `attributes.sn` | string | Optional | Parameter for Add | | `attributes.givenName` | string | Optional | Name of the resource | | `attributes.uid` | string | Optional | Unique identifier | | `attributes.mail` | string | Optional | Parameter for Add | | `attributes.userPassword` | string | Optional | Parameter for Add | | `to_csv` | boolean | Optional | When true, also return the add operation result as a CSV file object. | ### Input Example `{"dn":"cn=Charles mfmi77,ou=people,dc=example,dc=com","object_class":["top","person","organizationalPerson","inetOrgPerson"],"attributes":{"cn":"Charles mfmi77","sn":"mfmi77","givenName":"Charles","uid":"charles_mfmi77","mail":"charles.mfmi77@example.com","userPassword":"Ch4ng3Me!"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"file":[{"file":"urn:swimlane:playbook-run-file:29f36333-9778-49ea-96c2-78bbce050c44","file_name":"ldap_search_20251216T042448Z.csv"}]}` ## Delete Remove an entry from the LDAP directory using the specified distinguished name (DN). ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------ | | `dn` | string | Required | Parameter for Delete | | `to_csv` | boolean | Optional | When true, also return the delete operation result as a CSV file object. | ### Input Example `{"dn":"CN=Nacho Libre,OU=friends,DC=testdomain,DC=local"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"file":[{"file":"urn:swimlane:playbook-run-file:29f36333-9778-49ea-96c2-78bbce050c44","file_name":"ldap_search_20251216T042448Z.csv"}]}` ## Modify Modify an existing LDAP directory entry using the distinguished name (DN) and specified changes. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `dn` | string | Required | Parameter for Modify | | `changes` | array | Required | Parameter for Modify | | `changes.attribute_name` | string | Required | The LDAP attribute that needs to be modified. Example `userAccountControl` for enabling or disabling a user account. | | `changes.operation` | string | Required | The type of modification to be performed on the attribute. Supported operations are MODIFY\_ADD, MODIFY\_DELETE, MODIFY\_REPLACE, MODIFY\_INCREMENT. | | `changes.value` | array | Required | The new value(s) for the specified attribute. The format depends on the attribute type. For example, setting `userAccountControl` to `514` disables an LDAP user. | | `to_csv` | boolean | Optional | When true, also return the modify operation result as a CSV file object. | ### Input Example `{"dn":"CN=john doe,OU=friends,DC=testdomain,DC=local"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"file":[{"file":"urn:swimlane:playbook-run-file:29f36333-9778-49ea-96c2-78bbce050c44","file_name":"ldap_search_20251216T042448Z.csv"}]}` ## Search Perform an LDAP search using a specified base and filter to retrieve directory entries while respecting access controls. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `search_base` | string | Required | Parameter for Search | | `search_filter` | string | Required | Parameter for Search | | `attributes` | array | Optional | '\*' will return all attributes, '1.1' will return no attributes (as per RFC 4511) and '+' will only return operational attributes (as per RFC 3673) | | `search_scope` | string | Optional | Parameter for Search | | `page_size` | number | Optional | Page Size | | `page_number` | number | Optional | Page Number | | `to_csv` | boolean | Optional | When true, also return the search results as a CSV file object. | ### Input Example `{"search_base":"dc=testdomain,dc=local","search_filter":"(&(objectClass=user)(objectCategory=person)(|(CN=john doe)))","page_size":10,"page_number":1}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"file":[{"file":"urn:swimlane:playbook-run-file:29f36333-9778-49ea-96c2-78bbce050c44","file_name":"ldap_search_20251216T042448Z.csv"}]}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |