feature: ldap connection and password rotation

2026-10-11 01:29:26 +00:00 · 2025-04-18 17:55:03 -07:00
parent f1b1d6f480
commit 9032bbe514
92 changed files with 1980 additions and 90 deletions
@@ -0,0 +1,4 @@
+---
+title: "Available"
+openapi: "GET /api/v1/app-connections/ldap/available"
+---
@@ -0,0 +1,9 @@
+---
+title: "Create"
+openapi: "POST /api/v1/app-connections/ldap"
+---
+
+<Note>
+    Check out the configuration docs for [LDAP Connections](/integrations/app-connections/ldap) to learn how to obtain
+    the required credentials.
+</Note>
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/app-connections/ldap/{connectionId}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get by ID"
+openapi: "GET /api/v1/app-connections/ldap/{connectionId}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get by Name"
+openapi: "GET /api/v1/app-connections/ldap/connection-name/{connectionName}"
+---
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v1/app-connections/ldap"
+---
@@ -0,0 +1,9 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/app-connections/ldap/{connectionId}"
+---
+
+<Note>
+    Check out the configuration docs for [LDAP Connections](/integrations/app-connections/ldap) to learn how to obtain
+    the required credentials.
+</Note>
@@ -0,0 +1,9 @@
+---
+title: "Create"
+openapi: "POST /api/v2/secret-rotations/ldap-password"
+---
+
+<Note>
+    Check out the configuration docs for [LDAP Password Rotations](/documentation/platform/secret-rotation/ldap-password) to learn how to obtain the
+    required parameters.
+</Note>
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v2/secret-rotations/ldap-password/{rotationId}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get by ID"
+openapi: "GET /api/v2/secret-rotations/ldap-password/{rotationId}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get by Name"
+openapi: "GET /api/v2/secret-rotations/ldap-password/rotation-name/{rotationName}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get Credentials by ID"
+openapi: "GET /api/v2/secret-rotations/ldap-password/{rotationId}/generated-credentials"
+---
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v2/secret-rotations/ldap-password"
+---
@@ -0,0 +1,4 @@
+---
+title: "Rotate Secrets"
+openapi: "POST /api/v2/secret-rotations/ldap-password/{rotationId}/rotate-secrets"
+---
@@ -0,0 +1,9 @@
+---
+title: "Update"
+openapi: "PATCH /api/v2/secret-rotations/ldap-password/{rotationId}"
+---
+
+<Note>
+    Check out the configuration docs for [LDAP Rotations](/documentation/platform/secret-rotation/ldap-password) to learn how to obtain the
+    required parameters.
+</Note>
@@ -1,5 +1,5 @@
 ---
-title: "Auth0 Client Secret"
+title: "Auth0 Client Secret Rotation"
 description: "Learn how to automatically rotate Auth0 Client Secrets."
 ---

@@ -0,0 +1,173 @@
+---
+title: "LDAP Password Rotation"
+description: "Learn how to automatically rotate LDAP passwords."
+---
+
+<Note>
+    Due to how LDAP passwords are rotated, retired credentials will not be able to
+    authenticate with the LDAP provider during their [inactive period](./overview#how-rotation-works).
+
+    This is a limitation of the LDAP provider and cannot be
+    rectified by Infisical.
+</Note>
+
+## Prerequisites
+
+- Create an [LDAP Connection](/integrations/app-connections/ldap) with the **Secret Rotation** requirements
+
+## Create an LDAP Password Rotation in Infisical
+
+<Tabs>
+    <Tab title="Infisical UI">
+        1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
+        ![Secret Manager Dashboard](/images/secret-rotations-v2/generic/add-secret-rotation.png)
+
+        2. Select the **LDAP Password** option.
+        ![Select LDAP Password](/images/secret-rotations-v2/ldap-password/select-ldap-password-option.png)
+
+        3. Select the **LDAP Connection** to use and configure the rotation behavior. Then click **Next**.
+        ![Rotation Configuration](/images/secret-rotations-v2/ldap-password/ldap-password-configuration.png)
+
+            - **LDAP Connection** - the connection that will perform the rotation of the configured DN's password.
+            <Note>
+                LDAP Password Rotations require an LDAP Connection that uses ldaps:// protocol.
+            </Note>
+            - **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
+            - **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
+            - **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
+            <Note>
+                Due to LDAP Password Rotations rotating a single credential set, auto-rotation may result in service interruptions. If you need to ensure service continuity, we recommend disabling this option.
+            </Note>
+
+
+        4. Specify the Distinguished Name (DN) of the principal whose password you want to rotate and configure the password requirements. Then click **Next**.
+        ![Rotation Parameters](/images/secret-rotations-v2/ldap-password/ldap-password-parameters.png)
+
+        5. Specify the secret names that the client credentials should be mapped to. Then click **Next**.
+        ![Rotation Secrets Mapping](/images/secret-rotations-v2/ldap-password/ldap-password-secrets-mapping.png)
+
+            - **DN** - the name of the secret that the principal's Distinguished Name (DN) will be mapped to.
+            - **Password** - the name of the secret that the rotated password will be mapped to.
+
+        6. Give your rotation a name and description (optional). Then click **Next**.
+        ![Rotation Details](/images/secret-rotations-v2/ldap-password/ldap-password-details.png)
+
+            - **Name** - the name of the secret rotation configuration. Must be slug-friendly.
+            - **Description** (optional) - a description of this rotation configuration.
+
+        7. Review your configuration, then click **Create Secret Rotation**.
+        ![Rotation Review](/images/secret-rotations-v2/ldap-password/ldap-password-confirm.png)
+
+        8. Your **LDAP Password** credentials are now available for use via the mapped secrets.
+        ![Rotation Created](/images/secret-rotations-v2/ldap-password/ldap-password-created.png)
+    </Tab>
+    <Tab title="API">
+        To create an LDAP Password Rotation, make an API request to the [Create LDAP
+        Password Rotation](/api-reference/endpoints/secret-rotations/ldap-password/create) API endpoint.
+
+        ### Sample request
+
+        ```bash Request
+        curl --request POST \
+        --url https://us.infisical.com/api/v2/secret-rotations/ldap-password \
+        --header 'Content-Type: application/json' \
+        --data '{
+            "name": "my-ldap-rotation",
+            "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+            "description": "my ldap password rotation",
+            "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+            "environment": "dev",
+            "secretPath": "/",
+            "isAutoRotationEnabled": false,
+            "rotationInterval": 30,
+            "rotateAtUtc": {
+                "hours": 0,
+                "minutes": 0
+            },
+            "parameters": {
+                "dn": "CN=John,CN=Users,DC=example,DC=com",
+                "passwordRequirements": {
+                    "length": 48,
+                    "required": {
+                        "digits": 2,
+                        "lowercase": 2,
+                        "uppercase": 2,
+                        "symbols": 2
+                    },
+                    "allowedSymbols": "-_.~!*"
+                }
+            },
+            "secretsMapping": {
+                "dn": "LDAP_DN",
+                "password": "LDAP_PASSWORD"
+            }
+        }'
+        ```
+
+        <Note>
+            Due to LDAP Password Rotations rotating a single credential set, auto-rotation may result in service interruptions. If you need to ensure service continuity, we recommend disabling this option.
+        </Note>
+
+        ### Sample response
+
+        ```bash Response
+        {
+            "secretRotation": {
+                "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "name": "my-auth0-rotation",
+                "description": "my client secret rotation",
+                "secretsMapping": {
+                    "dn": "LDAP_DN",
+                    "password": "LDAP_PASSWORD"
+                },
+                "isAutoRotationEnabled": false,
+                "activeIndex": 0,
+                "folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "createdAt": "2023-11-07T05:31:56Z",
+                "updatedAt": "2023-11-07T05:31:56Z",
+                "rotationInterval": 30,
+                "rotationStatus": "success",
+                "lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
+                "lastRotatedAt": "2023-11-07T05:31:56Z",
+                "lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "nextRotationAt": "2023-11-07T05:31:56Z",
+                "connection": {
+                    "app": "auth0",
+                    "name": "my-auth0-connection",
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
+                },
+                "environment": {
+                    "slug": "dev",
+                    "name": "Development",
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
+                },
+                "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "folder": {
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                    "path": "/"
+                },
+                "rotateAtUtc": {
+                    "hours": 0,
+                    "minutes": 0
+                },
+                "lastRotationMessage": null,
+                "type": "ldap-password",
+                "parameters": {
+                    "dn": "CN=John,CN=Users,DC=example,DC=com",
+                    "passwordRequirements": {
+                        "length": 48,
+                        "required": {
+                            "digits": 2,
+                            "lowercase": 2,
+                            "uppercase": 2,
+                            "symbols": 2
+                        },
+                        "allowedSymbols": "-_.~!*"
+                    }
+                }
+            }
+        }
+        ```
+    </Tab>
+</Tabs>
@@ -1,5 +1,5 @@
 ---
-title: "Microsoft SQL Server Credentials"
+title: "Microsoft SQL Server Credentials Rotation"
 description: "Learn how to automatically rotate Microsoft SQL Server credentials."
 ---

@@ -1,5 +1,5 @@
 ---
-title: "PostgreSQL Credentials"
+title: "PostgreSQL Credentials Rotation"
 description: "Learn how to automatically rotate PostgreSQL credentials."
 ---

@@ -0,0 +1,96 @@
+---
+title: "LDAP Connection"
+description: "Learn how to configure an LDAP Connection for Infisical."
+---
+
+Infisical supports the use of [Simple Binding](https://ldap.com/the-ldap-bind-operation) to connect with your LDAP provider.
+
+## Prerequisites
+
+You will need the following information to establish an LDAP connection:
+
+- **LDAP URL** - The LDAP/LDAPS URL to connect to (e.g., ldap://domain-or-ip:389 or ldaps://domain-or-ip:636)
+- **Binding DN** - The Distinguished Name (DN) of the principal to bind with (e.g., 'CN=John,CN=Users,DC=example,DC=com')
+- **Binding Password** - The password to bind with for authentication
+- **CA Certificate** - The SSL certificate (PEM format) to use for secure connection when using ldaps:// with a self-signed certificate
+
+Depending on how you intend to use your LDAP connection, there may be additional requirements:
+
+<Tabs>
+    <Tab title="Secret Rotation">
+        <Note>
+            For Password Rotation, the following requirements must additionally be met:
+            - You must use an LDAPS connection
+            - The binding user must either have:
+                - Permission to change other users passwords if rotating directory users' passwords
+                - Permission to update their own password if rotating their personal password
+        </Note>
+    </Tab>
+</Tabs>
+
+
+## Setup LDAP Connection in Infisical
+
+<Tabs>
+    <Tab title="Infisical UI">
+        1. Navigate to the App Connections tab on the Organization Settings page.
+        ![App Connections Tab](/images/app-connections/general/add-connection.png)
+
+        2. Select the **LDAP Connection** option.
+        ![Select LDAP Connection](/images/app-connections/ldap/select-ldap-connection.png)
+
+        3. Select the **Simple Bind** method option and provide the details obtained from the previous section and press **Connect to Provider**.
+        ![Create LDAP Connection](/images/app-connections/ldap/create-simple-bind-method.png)
+
+        4. Your **LDAP Connection** is now available for use.
+        ![Assume Role LDAP Connection](/images/app-connections/ldap/simple-bind-connection.png)
+    </Tab>
+    <Tab title="API">
+        To create an LDAP Connection, make an API request to the [Create LDAP
+        Connection](/api-reference/endpoints/app-connections/ldap/create) API endpoint.
+
+        ### Sample request
+
+        ```bash Request
+        curl    --request POST \
+            --url https://app.infisical.com/api/v1/app-connections/ldap \
+            --header 'Content-Type: application/json' \
+            --data '{
+                "name": "my-ldap-connection",
+                "method": "simple-bind",
+                "credentials": {
+                    "provider": "active-directory",
+                    "url": "ldaps://domain-or-ip:636",
+                    "dn": "CN=John,CN=Users,DC=example,DC=com",
+                    "password": "my-strong-password",
+                    "sslRejectUnauthorized": true,
+                    "sslCertificate": "..."
+                }
+            }'
+        ```
+
+        ### Sample response
+
+        ```bash Response
+        {
+            "appConnection": {
+                "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "name": "my-ldap-connection",
+                "version": 1,
+                "orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "createdAt": "2023-11-07T05:31:56Z",
+                "updatedAt": "2023-11-07T05:31:56Z",
+                "app": "ldap",
+                "method": "simple-bind",
+                "credentials": {
+                    "provider": "active-directory",
+                    "url": "ldaps://domain-or-ip:636",
+                    "dn": "CN=John,CN=Users,DC=example,DC=com",
+                    "sslRejectUnauthorized": true,
+                    "sslCertificate": "..."
+                }
+            }
+        }
+        ```
+    </Tab>
+</Tabs>
@@ -179,8 +179,9 @@
          "pages": [
            "documentation/platform/secret-rotation/overview",
            "documentation/platform/secret-rotation/auth0-client-secret",
-            "documentation/platform/secret-rotation/postgres-credentials",
-            "documentation/platform/secret-rotation/mssql-credentials"
+            "documentation/platform/secret-rotation/ldap-password",
+            "documentation/platform/secret-rotation/mssql-credentials",
+            "documentation/platform/secret-rotation/postgres-credentials"
          ]
        },
        {
@@ -424,6 +425,7 @@
            "integrations/app-connections/gcp",
            "integrations/app-connections/github",
            "integrations/app-connections/humanitec",
+            "integrations/app-connections/ldap",
            "integrations/app-connections/mssql",
            "integrations/app-connections/postgres",
            "integrations/app-connections/terraform-cloud",
@@ -861,6 +863,19 @@
                "api-reference/endpoints/secret-rotations/auth0-client-secret/update"
              ]
            },
+            {
+              "group": "LDAP Password",
+              "pages": [
+                "api-reference/endpoints/secret-rotations/ldap-password/create",
+                "api-reference/endpoints/secret-rotations/ldap-password/delete",
+                "api-reference/endpoints/secret-rotations/ldap-password/get-by-id",
+                "api-reference/endpoints/secret-rotations/ldap-password/get-by-name",
+                "api-reference/endpoints/secret-rotations/ldap-password/get-generated-credentials-by-id",
+                "api-reference/endpoints/secret-rotations/ldap-password/list",
+                "api-reference/endpoints/secret-rotations/ldap-password/rotate-secrets",
+                "api-reference/endpoints/secret-rotations/ldap-password/update"
+              ]
+            },
            {
              "group": "Microsoft SQL Server Credentials",
              "pages": [
@@ -1013,6 +1028,18 @@
                "api-reference/endpoints/app-connections/humanitec/delete"
              ]
            },
+            {
+              "group": "LDAP",
+              "pages": [
+                "api-reference/endpoints/app-connections/ldap/list",
+                "api-reference/endpoints/app-connections/ldap/available",
+                "api-reference/endpoints/app-connections/ldap/get-by-id",
+                "api-reference/endpoints/app-connections/ldap/get-by-name",
+                "api-reference/endpoints/app-connections/ldap/create",
+                "api-reference/endpoints/app-connections/ldap/update",
+                "api-reference/endpoints/app-connections/ldap/delete"
+              ]
+            },
            {
              "group": "Microsoft SQL Server",
              "pages": [