feature: ldap connection and password rotation

2026-10-14 20:51:50 +00:00 · 2025-04-18 17:55:03 -07:00
parent f1b1d6f480
commit 9032bbe514
92 changed files with 1980 additions and 90 deletions
@@ -1,8 +1,6 @@
-import { CredentialDisplay } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/shared/CredentialDisplay";
-import { NoticeBannerV2 } from "@app/components/v2/NoticeBannerV2/NoticeBannerV2";
 import { TAuth0ClientSecretRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/auth0-client-secret-rotation";

-import { ViewRotationGeneratedCredentialsDisplay } from "./shared";
+import { CredentialDisplay, ViewRotationGeneratedCredentialsDisplay } from "./shared";

 type Props = {
  generatedCredentialsResponse: TAuth0ClientSecretRotationGeneratedCredentialsResponse;
@@ -17,40 +15,23 @@ export const ViewAuth0ClientSecretRotationGeneratedCredentials = ({
  const inactiveCredentials = generatedCredentials[inactiveIndex];

  return (
-    <>
-      <ViewRotationGeneratedCredentialsDisplay
-        activeCredentials={
-          <>
-            <CredentialDisplay label="Client ID">{activeCredentials?.clientId}</CredentialDisplay>
-            <CredentialDisplay isSensitive label="Client Secret">
-              {activeCredentials?.clientSecret}
-            </CredentialDisplay>
-          </>
-        }
-        inactiveCredentials={
-          <>
-            <CredentialDisplay label="Client ID">{inactiveCredentials?.clientId}</CredentialDisplay>
-            <CredentialDisplay isSensitive label="Client Secret">
-              {inactiveCredentials?.clientSecret}
-            </CredentialDisplay>
-          </>
-        }
-      />
-      <NoticeBannerV2 title="Auth0 Retired Credentials Behavior">
-        <p className="text-sm text-mineshaft-300">
-          Due to how Auth0 client secrets are rotated, retired credentials will not be able to
-          authenticate with Auth0 during their{" "}
-          <a
-            target="_blank"
-            href="https://infisical.com/docs/documentation/platform/secret-rotation/overview#how-rotation-works"
-            rel="noopener noreferrer"
-            className="underline decoration-primary underline-offset-2 hover:text-mineshaft-200"
-          >
-            inactive period
-          </a>
-          . This is a limitation of the Auth0 platform and cannot be rectified by Infisical.
-        </p>
-      </NoticeBannerV2>
-    </>
+    <ViewRotationGeneratedCredentialsDisplay
+      activeCredentials={
+        <>
+          <CredentialDisplay label="Client ID">{activeCredentials?.clientId}</CredentialDisplay>
+          <CredentialDisplay isSensitive label="Client Secret">
+            {activeCredentials?.clientSecret}
+          </CredentialDisplay>
+        </>
+      }
+      inactiveCredentials={
+        <>
+          <CredentialDisplay label="Client ID">{inactiveCredentials?.clientId}</CredentialDisplay>
+          <CredentialDisplay isSensitive label="Client Secret">
+            {inactiveCredentials?.clientSecret}
+          </CredentialDisplay>
+        </>
+      }
+    />
  );
 };
@@ -0,0 +1,41 @@
+import { TLdapPasswordRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/ldap-password-rotation";
+
+import { CredentialDisplay, ViewRotationGeneratedCredentialsDisplay } from "./shared";
+
+type Props = {
+  generatedCredentialsResponse: TLdapPasswordRotationGeneratedCredentialsResponse;
+};
+
+export const ViewLdapPasswordRotationGeneratedCredentials = ({
+  generatedCredentialsResponse: { generatedCredentials, activeIndex }
+}: Props) => {
+  const inactiveIndex = activeIndex === 0 ? 1 : 0;
+
+  const activeCredentials = generatedCredentials[activeIndex];
+  const inactiveCredentials = generatedCredentials[inactiveIndex];
+
+  return (
+    <ViewRotationGeneratedCredentialsDisplay
+      activeCredentials={
+        <>
+          <CredentialDisplay label="Distinguished Name (DN)">
+            {activeCredentials?.dn}
+          </CredentialDisplay>
+          <CredentialDisplay isSensitive label="Password">
+            {activeCredentials?.password}
+          </CredentialDisplay>
+        </>
+      }
+      inactiveCredentials={
+        <>
+          <CredentialDisplay label="Distinguished Name (DN)">
+            {inactiveCredentials?.dn}
+          </CredentialDisplay>
+          <CredentialDisplay isSensitive label="Password">
+            {inactiveCredentials?.password}
+          </CredentialDisplay>
+        </>
+      }
+    />
+  );
+};
@@ -4,8 +4,15 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";

 import { ViewAuth0ClientSecretRotationGeneratedCredentials } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewAuth0ClientSecretRotationGeneratedCredentials";
+import { ViewLdapPasswordRotationGeneratedCredentials } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewLdapPasswordRotationGeneratedCredentials";
 import { Modal, ModalContent, Spinner } from "@app/components/v2";
-import { SECRET_ROTATION_MAP } from "@app/helpers/secretRotationsV2";
+import { NoticeBannerV2 } from "@app/components/v2/NoticeBannerV2/NoticeBannerV2";
+import { APP_CONNECTION_MAP } from "@app/helpers/appConnections";
+import {
+  IS_ROTATION_DUAL_CREDENTIALS,
+  SECRET_ROTATION_CONNECTION_MAP,
+  SECRET_ROTATION_MAP
+} from "@app/helpers/secretRotationsV2";
 import {
  SecretRotation,
  TSecretRotationV2,
@@ -67,13 +74,39 @@ const Content = ({ secretRotation }: ContentProps) => {
        />
      );
      break;
+    case SecretRotation.LdapPassword:
+      Component = (
+        <ViewLdapPasswordRotationGeneratedCredentials
+          generatedCredentialsResponse={generatedCredentialsResponse}
+        />
+      );
+      break;
    default:
      throw new Error("Unhandled View Generated Credential Rotation Type");
  }

+  const appName = APP_CONNECTION_MAP[SECRET_ROTATION_CONNECTION_MAP[type]].name;
+
  return (
    <div className="flex flex-col gap-y-4">
      {Component}
+      {!IS_ROTATION_DUAL_CREDENTIALS[type] && (
+        <NoticeBannerV2 title={`${appName} Retired Credentials Behavior`}>
+          <p className="text-sm text-mineshaft-300">
+            Due to {SECRET_ROTATION_MAP[type].name} Rotations utilizing a single credential set,
+            retired credentials will not be able to authenticate with {appName} during their{" "}
+            <a
+              target="_blank"
+              href="https://infisical.com/docs/documentation/platform/secret-rotation/overview#how-rotation-works"
+              rel="noopener noreferrer"
+              className="underline decoration-primary underline-offset-2 hover:text-mineshaft-200"
+            >
+              inactive period
+            </a>
+            . This is a limitation of {appName} and cannot be rectified by Infisical.
+          </p>
+        </NoticeBannerV2>
+      )}
      {nextRotationAt && (
        <div className="flex items-center gap-x-1.5 text-sm text-mineshaft-200">
          <FontAwesomeIcon icon={faRotate} className="text-mineshaft-400" />
@@ -0,0 +1,201 @@
+import { Controller, useFormContext } from "react-hook-form";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { DEFAULT_PASSWORD_REQUIREMENTS } from "@app/components/secret-rotations-v2/forms/schemas/shared";
+import { FormControl, Input, Tooltip } from "@app/components/v2";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+export const LdapPasswordRotationParametersFields = () => {
+  const { control } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.LdapPassword;
+    }
+  >();
+
+  return (
+    <>
+      <Controller
+        name="parameters.dn"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Distinguished Name (DN)"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content={
+                  <>
+                    Ensure that your connection has the{" "}
+                    <span className="font-semibold">read_clients</span> permission and the
+                    application exists in the connection&#39;s audience.
+                  </>
+                }
+              >
+                <div>
+                  <span>Don&#39;t see the application you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            {/* <FilterableSelect
+            menuPlacement="top"
+            isLoading={isClientsPending && Boolean(connectionId)}
+            isDisabled={!connectionId}
+            value={clients?.find((client) => client.id === value) ?? null}
+            onChange={(option) => {
+              onChange((option as SingleValue<TAuth0Client>)?.id ?? null);
+            }}
+            options={clients}
+            placeholder="Select an application..."
+            getOptionLabel={(option) => option.name}
+            getOptionValue={(option) => option.id}
+          /> */}
+            <Input
+              value={value}
+              onChange={onChange}
+              placeholder="CN=John,OU=Users,DC=example,DC=com"
+            />
+          </FormControl>
+        )}
+      />
+      <div className="flex flex-col gap-3">
+        <div className="w-full border-b border-mineshaft-600">
+          <span className="text-sm text-mineshaft-300">Password Requirements</span>
+        </div>
+        <div className="grid grid-cols-2 gap-3 rounded border border-mineshaft-600 bg-mineshaft-700 px-3 py-2">
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.length"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.length}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Passsword Length"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="The length of the password to generate"
+              >
+                <Input
+                  type="number"
+                  min={1}
+                  max={250}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.required.digits"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.required.digits}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Digit Count"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Minimum number of digits"
+              >
+                <Input
+                  type="number"
+                  min={0}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.required.lowercase"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.required.lowercase}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Lowercase Character Count"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Minimum number of lowercase characters"
+              >
+                <Input
+                  type="number"
+                  min={0}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.required.uppercase"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.required.uppercase}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Uppercase Character Count"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Minimum number of uppercase characters"
+              >
+                <Input
+                  type="number"
+                  min={0}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.required.symbols"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.required.symbols}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Symbol Count"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Minimum number of symbols"
+              >
+                <Input
+                  type="number"
+                  min={0}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.allowedSymbols"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.allowedSymbols}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Allowed Symbols"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Symbols to use in generated password"
+              >
+                <Input
+                  placeholder="-_.~!*"
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+        </div>
+      </div>
+    </>
+  );
+};
@@ -4,12 +4,14 @@ import { SecretRotation } from "@app/hooks/api/secretRotationsV2";

 import { TSecretRotationV2Form } from "../schemas";
 import { Auth0ClientSecretRotationParametersFields } from "./Auth0ClientSecretRotationParametersFields";
+import { LdapPasswordRotationParametersFields } from "./LdapPasswordRotationParametersFields";
 import { SqlCredentialsRotationParametersFields } from "./shared";

 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationParametersFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationParametersFields,
-  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationParametersFields
+  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationParametersFields,
+  [SecretRotation.LdapPassword]: LdapPasswordRotationParametersFields
 };

 export const SecretRotationV2ParametersFields = () => {
@@ -0,0 +1,29 @@
+import { useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { GenericFieldLabel } from "@app/components/v2";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+import { SecretRotationReviewSection } from "./shared";
+
+export const LdapPasswordRotationReviewFields = () => {
+  const { watch } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.LdapPassword;
+    }
+  >();
+
+  const [parameters, { dn, password }] = watch(["parameters", "secretsMapping"]);
+
+  return (
+    <>
+      <SecretRotationReviewSection label="Parameters">
+        <GenericFieldLabel label="Distinguished Name (DN)">{parameters.dn}</GenericFieldLabel>
+      </SecretRotationReviewSection>
+      <SecretRotationReviewSection label="Secrets Mapping">
+        <GenericFieldLabel label="Distinguished Name (DN)">{dn}</GenericFieldLabel>
+        <GenericFieldLabel label="Password">{password}</GenericFieldLabel>
+      </SecretRotationReviewSection>
+    </>
+  );
+};
@@ -7,12 +7,14 @@ import { getRotateAtLocal } from "@app/helpers/secretRotationsV2";
 import { SecretRotation } from "@app/hooks/api/secretRotationsV2";

 import { Auth0ClientSecretRotationReviewFields } from "./Auth0ClientSecretRotationReviewFields";
+import { LdapPasswordRotationReviewFields } from "./LdapPasswordRotationReviewFields";
 import { SqlCredentialsRotationReviewFields } from "./shared";

 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationReviewFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationReviewFields,
-  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationReviewFields
+  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationReviewFields,
+  [SecretRotation.LdapPassword]: LdapPasswordRotationReviewFields
 };

 export const SecretRotationV2ReviewFields = () => {
@@ -0,0 +1,58 @@
+import { Controller, useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { FormControl, Input } from "@app/components/v2";
+import { SecretRotation, useSecretRotationV2Option } from "@app/hooks/api/secretRotationsV2";
+
+import { SecretsMappingTable } from "./shared";
+
+export const LdapPasswordRotationSecretsMappingFields = () => {
+  const { control } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.LdapPassword;
+    }
+  >();
+
+  const { rotationOption } = useSecretRotationV2Option(SecretRotation.LdapPassword);
+
+  const items = [
+    {
+      name: "DN",
+      input: (
+        <Controller
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Input
+                value={value}
+                onChange={onChange}
+                placeholder={rotationOption?.template.secretsMapping.dn}
+              />
+            </FormControl>
+          )}
+          control={control}
+          name="secretsMapping.dn"
+        />
+      )
+    },
+    {
+      name: "Password",
+      input: (
+        <Controller
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Input
+                value={value}
+                onChange={onChange}
+                placeholder={rotationOption?.template.secretsMapping.password}
+              />
+            </FormControl>
+          )}
+          control={control}
+          name="secretsMapping.password"
+        />
+      )
+    }
+  ];
+
+  return <SecretsMappingTable items={items} />;
+};
@@ -4,12 +4,14 @@ import { SecretRotation } from "@app/hooks/api/secretRotationsV2";

 import { TSecretRotationV2Form } from "../schemas";
 import { Auth0ClientSecretRotationSecretsMappingFields } from "./Auth0ClientSecretRotationSecretsMappingFields";
+import { LdapPasswordRotationSecretsMappingFields } from "./LdapPasswordRotationSecretsMappingFields";
 import { SqlCredentialsRotationSecretsMappingFields } from "./shared";

 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationSecretsMappingFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationSecretsMappingFields,
-  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationSecretsMappingFields
+  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationSecretsMappingFields,
+  [SecretRotation.LdapPassword]: LdapPasswordRotationSecretsMappingFields
 };

 export const SecretRotationV2SecretsMappingFields = () => {
@@ -1,13 +1,15 @@
 import { z } from "zod";

 import { Auth0ClientSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/auth0-client-secret-rotation-schema";
+import { LdapPasswordRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/ldap-password-rotation-schema";
 import { MsSqlCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/mssql-credentials-rotation-schema";
 import { PostgresCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/postgres-credentials-rotation-schema";

 const SecretRotationUnionSchema = z.discriminatedUnion("type", [
  PostgresCredentialsRotationSchema,
  MsSqlCredentialsRotationSchema,
-  Auth0ClientSecretRotationSchema
+  Auth0ClientSecretRotationSchema,
+  LdapPasswordRotationSchema
 ]);

 export const SecretRotationV2FormSchema = SecretRotationUnionSchema;
@@ -0,0 +1,19 @@
+import { z } from "zod";
+
+import { BaseSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/base-secret-rotation-v2-schema";
+import { PasswordRequirementsSchema } from "@app/components/secret-rotations-v2/forms/schemas/shared";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+export const LdapPasswordRotationSchema = z
+  .object({
+    type: z.literal(SecretRotation.LdapPassword),
+    parameters: z.object({
+      dn: z.string().trim().min(1, "Distinguished Name (DN) required"),
+      passwordRequirements: PasswordRequirementsSchema.optional()
+    }),
+    secretsMapping: z.object({
+      dn: z.string().trim().min(1, "Distinguished Name (DN) required"),
+      password: z.string().trim().min(1, "Password required")
+    })
+  })
+  .merge(BaseSecretRotationSchema);
@@ -1 +1,2 @@
+export * from "./password-requirements-schema";
 export * from "./sql-credentials-rotation-schema";
@@ -0,0 +1,37 @@
+import { z } from "zod";
+
+export const PasswordRequirementsSchema = z
+  .object({
+    length: z
+      .number()
+      .min(1, "Password length must be a positive number")
+      .max(250, "Password length must be less than 250"),
+    required: z.object({
+      digits: z.number().min(0, "Digit count must be non-negative"),
+      lowercase: z.number().min(0, "Lowercase count must be non-negative"),
+      uppercase: z.number().min(0, "Uppercase count must be non-negative"),
+      symbols: z.number().min(0, "Symbol count must be non-negative")
+    }),
+    allowedSymbols: z
+      .string()
+      .optional()
+      .transform((value) => value ?? "-_.~!*")
+  })
+  .refine(
+    (data) => {
+      const total = Object.values(data.required).reduce((sum, count) => sum + count, 0);
+      return total <= data.length;
+    },
+    { message: "Sum of required characters cannot exceed the total length", path: ["length"] }
+  );
+
+export const DEFAULT_PASSWORD_REQUIREMENTS = {
+  length: 48,
+  required: {
+    lowercase: 1,
+    uppercase: 1,
+    digits: 1,
+    symbols: 0
+  },
+  allowedSymbols: "-_.~!*"
+};
@@ -1,5 +1,12 @@
 import { faGithub } from "@fortawesome/free-brands-svg-icons";
-import { faKey, faLock, faPassport, faServer, faUser } from "@fortawesome/free-solid-svg-icons";
+import {
+  faKey,
+  faLink,
+  faLock,
+  faPassport,
+  faServer,
+  faUser
+} from "@fortawesome/free-solid-svg-icons";

 import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import {
@@ -12,6 +19,7 @@ import {
  GcpConnectionMethod,
  GitHubConnectionMethod,
  HumanitecConnectionMethod,
+  LdapConnectionMethod,
  MsSqlConnectionMethod,
  PostgresConnectionMethod,
  TAppConnection,
@@ -43,7 +51,8 @@ export const APP_CONNECTION_MAP: Record<
  [AppConnection.MsSql]: { name: "Microsoft SQL Server", image: "MsSql.png" },
  [AppConnection.Camunda]: { name: "Camunda", image: "Camunda.png" },
  [AppConnection.Windmill]: { name: "Windmill", image: "Windmill.png" },
-  [AppConnection.Auth0]: { name: "Auth0", image: "Auth0.png", size: 40 }
+  [AppConnection.Auth0]: { name: "Auth0", image: "Auth0.png", size: 40 },
+  [AppConnection.Ldap]: { name: "LDAP", image: "LDAP.png", size: 65 }
 };

 export const getAppConnectionMethodDetails = (method: TAppConnection["method"]) => {
@@ -75,6 +84,8 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
      return { name: "Access Token", icon: faKey };
    case Auth0ConnectionMethod.ClientCredentials:
      return { name: "Client Credentials", icon: faServer };
+    case LdapConnectionMethod.SimpleBind:
+      return { name: "Simple Bind", icon: faLink };
    default:
      throw new Error(`Unhandled App Connection Method: ${method}`);
  }
@@ -19,20 +19,27 @@ export const SECRET_ROTATION_MAP: Record<
    name: "Auth0 Client Secret",
    image: "Auth0.png",
    size: 35
+  },
+  [SecretRotation.LdapPassword]: {
+    name: "LDAP Password",
+    image: "LDAP.png",
+    size: 65
  }
 };

 export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnection> = {
  [SecretRotation.PostgresCredentials]: AppConnection.Postgres,
  [SecretRotation.MsSqlCredentials]: AppConnection.MsSql,
-  [SecretRotation.Auth0ClientSecret]: AppConnection.Auth0
+  [SecretRotation.Auth0ClientSecret]: AppConnection.Auth0,
+  [SecretRotation.LdapPassword]: AppConnection.Ldap
 };

 // if a rotation can potentially have downtime due to rotating a single credential set this to false
 export const IS_ROTATION_DUAL_CREDENTIALS: Record<SecretRotation, boolean> = {
  [SecretRotation.PostgresCredentials]: true,
  [SecretRotation.MsSqlCredentials]: true,
-  [SecretRotation.Auth0ClientSecret]: false
+  [SecretRotation.Auth0ClientSecret]: false,
+  [SecretRotation.LdapPassword]: false
 };

 export const getRotateAtLocal = ({ hours, minutes }: TSecretRotationV2["rotateAtUtc"]) => {
@@ -12,5 +12,6 @@ export enum AppConnection {
  MsSql = "mssql",
  Camunda = "camunda",
  Windmill = "windmill",
-  Auth0 = "auth0"
+  Auth0 = "auth0",
+  Ldap = "ldap"
 }
@@ -67,6 +67,10 @@ export type TAuth0ConnectionOption = TAppConnectionOptionBase & {
  app: AppConnection.Auth0;
 };

+export type TLdapConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Ldap;
+};
+
 export type TAppConnectionOption =
  | TAwsConnectionOption
  | TGitHubConnectionOption
@@ -98,4 +102,5 @@ export type TAppConnectionOptionMap = {
  [AppConnection.Camunda]: TCamundaConnectionOption;
  [AppConnection.Windmill]: TWindmillConnectionOption;
  [AppConnection.Auth0]: TAuth0ConnectionOption;
+  [AppConnection.Ldap]: TLdapConnectionOption;
 };
@@ -9,6 +9,7 @@ import { TDatabricksConnection } from "./databricks-connection";
 import { TGcpConnection } from "./gcp-connection";
 import { TGitHubConnection } from "./github-connection";
 import { THumanitecConnection } from "./humanitec-connection";
+import { TLdapConnection } from "./ldap-connection";
 import { TMsSqlConnection } from "./mssql-connection";
 import { TPostgresConnection } from "./postgres-connection";
 import { TTerraformCloudConnection } from "./terraform-cloud-connection";
@@ -24,6 +25,7 @@ export * from "./databricks-connection";
 export * from "./gcp-connection";
 export * from "./github-connection";
 export * from "./humanitec-connection";
+export * from "./ldap-connection";
 export * from "./mssql-connection";
 export * from "./postgres-connection";
 export * from "./terraform-cloud-connection";
@@ -44,7 +46,8 @@ export type TAppConnection =
  | TMsSqlConnection
  | TCamundaConnection
  | TWindmillConnection
-  | TAuth0Connection;
+  | TAuth0Connection
+  | TLdapConnection;

 export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;

@@ -86,4 +89,5 @@ export type TAppConnectionMap = {
  [AppConnection.Camunda]: TCamundaConnection;
  [AppConnection.Windmill]: TWindmillConnection;
  [AppConnection.Auth0]: TAuth0Connection;
+  [AppConnection.Ldap]: TLdapConnection;
 };
@@ -0,0 +1,21 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum LdapConnectionMethod {
+  SimpleBind = "simple-bind"
+}
+
+export enum LdapConnectionProvider {
+  ActiveDirectory = "active-directory"
+}
+
+export type TLdapConnection = TRootAppConnection & { app: AppConnection.Ldap } & {
+  method: LdapConnectionMethod.SimpleBind;
+  credentials: {
+    provider: LdapConnectionProvider;
+    url: string;
+    dn: string;
+    sslRejectUnauthorized?: boolean;
+    sslCertificate?: string;
+  };
+};
@@ -1,7 +1,8 @@
 export enum SecretRotation {
  PostgresCredentials = "postgres-credentials",
  MsSqlCredentials = "mssql-credentials",
-  Auth0ClientSecret = "auth0-client-secret"
+  Auth0ClientSecret = "auth0-client-secret",
+  LdapPassword = "ldap-password"
 }

 export enum SecretRotationStatus {
@@ -4,6 +4,11 @@ import {
  TAuth0ClientSecretRotationGeneratedCredentialsResponse,
  TAuth0ClientSecretRotationOption
 } from "@app/hooks/api/secretRotationsV2/types/auth0-client-secret-rotation";
+import {
+  TLdapPasswordRotation,
+  TLdapPasswordRotationGeneratedCredentialsResponse,
+  TLdapPasswordRotationOption
+} from "@app/hooks/api/secretRotationsV2/types/ldap-password-rotation";
 import {
  TMsSqlCredentialsRotation,
  TMsSqlCredentialsRotationGeneratedCredentialsResponse
@@ -20,13 +25,15 @@ export type TSecretRotationV2 = (
  | TPostgresCredentialsRotation
  | TMsSqlCredentialsRotation
  | TAuth0ClientSecretRotation
+  | TLdapPasswordRotation
 ) & {
  secrets: (SecretV3RawSanitized | null)[];
 };

 export type TSecretRotationV2Option =
  | TSqlCredentialsRotationOption
-  | TAuth0ClientSecretRotationOption;
+  | TAuth0ClientSecretRotationOption
+  | TLdapPasswordRotationOption;

 export type TListSecretRotationV2Options = { secretRotationOptions: TSecretRotationV2Option[] };

@@ -35,7 +42,8 @@ export type TSecretRotationV2Response = { secretRotation: TSecretRotationV2 };
 export type TViewSecretRotationGeneratedCredentialsResponse =
  | TPostgresCredentialsRotationGeneratedCredentialsResponse
  | TMsSqlCredentialsRotationGeneratedCredentialsResponse
-  | TAuth0ClientSecretRotationGeneratedCredentialsResponse;
+  | TAuth0ClientSecretRotationGeneratedCredentialsResponse
+  | TLdapPasswordRotationGeneratedCredentialsResponse;

 export type TCreateSecretRotationV2DTO = DiscriminativePick<
  TSecretRotationV2,
@@ -82,10 +90,12 @@ export type TSecretRotationOptionMap = {
  [SecretRotation.PostgresCredentials]: TSqlCredentialsRotationOption;
  [SecretRotation.MsSqlCredentials]: TSqlCredentialsRotationOption;
  [SecretRotation.Auth0ClientSecret]: TAuth0ClientSecretRotationOption;
+  [SecretRotation.LdapPassword]: TLdapPasswordRotationOption;
 };

 export type TSecretRotationGeneratedCredentialsResponseMap = {
  [SecretRotation.PostgresCredentials]: TPostgresCredentialsRotationGeneratedCredentialsResponse;
  [SecretRotation.MsSqlCredentials]: TMsSqlCredentialsRotationGeneratedCredentialsResponse;
  [SecretRotation.Auth0ClientSecret]: TAuth0ClientSecretRotationGeneratedCredentialsResponse;
+  [SecretRotation.LdapPassword]: TLdapPasswordRotationGeneratedCredentialsResponse;
 };
@@ -0,0 +1,37 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import {
+  TSecretRotationV2Base,
+  TSecretRotationV2GeneratedCredentialsResponseBase
+} from "@app/hooks/api/secretRotationsV2/types/shared";
+
+export type TLdapPasswordRotation = TSecretRotationV2Base & {
+  type: SecretRotation.LdapPassword;
+  parameters: {
+    dn: string;
+  };
+  secretsMapping: {
+    dn: string;
+    password: string;
+  };
+};
+
+export type TLdapPasswordRotationGeneratedCredentials = {
+  dn: string;
+  password: string;
+};
+
+export type TLdapPasswordRotationGeneratedCredentialsResponse =
+  TSecretRotationV2GeneratedCredentialsResponseBase<
+    SecretRotation.LdapPassword,
+    TLdapPasswordRotationGeneratedCredentials
+  >;
+
+export type TLdapPasswordRotationOption = {
+  name: string;
+  type: SecretRotation.LdapPassword;
+  connection: AppConnection.Ldap;
+  template: {
+    secretsMapping: TLdapPasswordRotation["secretsMapping"];
+  };
+};
@@ -18,6 +18,7 @@ import { DatabricksConnectionForm } from "./DatabricksConnectionForm";
 import { GcpConnectionForm } from "./GcpConnectionForm";
 import { GitHubConnectionForm } from "./GitHubConnectionForm";
 import { HumanitecConnectionForm } from "./HumanitecConnectionForm";
+import { LdapConnectionForm } from "./LdapConnectionFields";
 import { MsSqlConnectionForm } from "./MsSqlConnectionForm";
 import { PostgresConnectionForm } from "./PostgresConnectionForm";
 import { TerraformCloudConnectionForm } from "./TerraformCloudConnectionForm";
@@ -89,6 +90,8 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
      return <WindmillConnectionForm onSubmit={onSubmit} />;
    case AppConnection.Auth0:
      return <Auth0ConnectionForm onSubmit={onSubmit} />;
+    case AppConnection.Ldap:
+      return <LdapConnectionForm onSubmit={onSubmit} />;
    default:
      throw new Error(`Unhandled App ${app}`);
  }
@@ -153,6 +156,8 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
      return <WindmillConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
    case AppConnection.Auth0:
      return <Auth0ConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+    case AppConnection.Ldap:
+      return <LdapConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
    default:
      throw new Error(`Unhandled App ${(appConnection as TAppConnection).app}`);
  }
@@ -0,0 +1,319 @@
+import { useState } from "react";
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { Tab } from "@headlessui/react";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  Input,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem,
+  Switch,
+  TextArea,
+  Tooltip
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import {
+  LdapConnectionMethod,
+  LdapConnectionProvider,
+  TLdapConnection
+} from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TLdapConnection;
+  onSubmit: (formData: FormData) => Promise<void>;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.Ldap)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(LdapConnectionMethod.SimpleBind),
+    credentials: z.object({
+      provider: z.nativeEnum(LdapConnectionProvider),
+      url: z.string().url().trim().min(1, "LDAP URL required"),
+      dn: z.string().trim().min(1, "Distinguished Name (DN) required"),
+      password: z.string().trim().min(1, "Password required"),
+      sslRejectUnauthorized: z.boolean(),
+      sslCertificate: z
+        .string()
+        .trim()
+        .transform((value) => value || undefined)
+        .optional()
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const LdapConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+  const [selectedTabIndex, setSelectedTabIndex] = useState(0);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.Ldap,
+      method: LdapConnectionMethod.SimpleBind,
+      credentials: {
+        provider: LdapConnectionProvider.ActiveDirectory,
+        url: "",
+        dn: "",
+        password: "",
+        sslRejectUnauthorized: true,
+        sslCertificate: undefined
+      }
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty },
+    watch
+  } = form;
+
+  const selectedProvider = watch("credentials.provider");
+  const sslEnabled = watch("credentials.url").startsWith("ldaps://");
+
+  return (
+    <FormProvider {...form}>
+      <form
+        onSubmit={(e) => {
+          setSelectedTabIndex(0);
+          handleSubmit(onSubmit)(e);
+        }}
+      >
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <div className="grid grid-cols-2 items-center gap-2">
+          <Controller
+            name="method"
+            control={control}
+            render={({ field: { value, onChange }, fieldState: { error } }) => (
+              <FormControl
+                tooltipText={`The method you would like to use to connect with ${
+                  APP_CONNECTION_MAP[AppConnection.Ldap].name
+                }. This field cannot be changed after creation.`}
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                label="Method"
+              >
+                <Select
+                  isDisabled={isUpdate}
+                  value={value}
+                  onValueChange={(val) => onChange(val)}
+                  className="w-full border border-mineshaft-500"
+                  position="popper"
+                  dropdownContainerClassName="max-w-none"
+                >
+                  {Object.values(LdapConnectionMethod).map((method) => {
+                    return (
+                      <SelectItem value={method} key={method}>
+                        {getAppConnectionMethodDetails(method).name}
+                      </SelectItem>
+                    );
+                  })}
+                </Select>
+              </FormControl>
+            )}
+          />
+          <Controller
+            name="credentials.provider"
+            control={control}
+            render={({ field: { value, onChange }, fieldState: { error } }) => (
+              <FormControl
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                label="LDAP Provider"
+              >
+                <Select
+                  isDisabled={isUpdate}
+                  value={value}
+                  onValueChange={(val) => onChange(val)}
+                  className="w-full border border-mineshaft-500 capitalize"
+                  position="popper"
+                  dropdownContainerClassName="max-w-none"
+                >
+                  {Object.values(LdapConnectionProvider).map((provider) => {
+                    return (
+                      <SelectItem value={provider} className="capitalize" key={provider}>
+                        {provider.replace("-", " ")}
+                      </SelectItem>
+                    );
+                  })}
+                </Select>
+              </FormControl>
+            )}
+          />
+        </div>
+        <Tab.Group selectedIndex={selectedTabIndex} onChange={setSelectedTabIndex}>
+          <Tab.List
+            className={`-pb-1 ${selectedTabIndex === 1 ? "mb-3" : "mb-6"} w-full border-b-2 border-mineshaft-600`}
+          >
+            <Tab
+              className={({ selected }) =>
+                `w-30 -mb-[0.14rem] px-4 py-2 text-sm font-medium outline-none disabled:opacity-60 ${
+                  selected
+                    ? "border-b-2 border-mineshaft-300 text-mineshaft-200"
+                    : "text-bunker-300"
+                }`
+              }
+            >
+              Configuration
+            </Tab>
+            <Tab
+              className={({ selected }) =>
+                `w-30 -mb-[0.14rem] px-4 py-2 text-sm font-medium outline-none disabled:opacity-60 ${
+                  selected
+                    ? "border-b-2 border-mineshaft-300 text-mineshaft-200"
+                    : "text-bunker-300"
+                }`
+              }
+            >
+              SSL ({sslEnabled ? "Enabled" : "Disabled"})
+            </Tab>
+          </Tab.List>
+          {selectedTabIndex === 1 && (
+            <div className="mb-2 text-xs text-mineshaft-300">Requires ldaps:// URL</div>
+          )}
+          <Tab.Panels className="mb-4 rounded border border-mineshaft-600 bg-mineshaft-700/70 p-3 pb-0">
+            <Tab.Panel>
+              <Controller
+                name="credentials.url"
+                control={control}
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    errorText={error?.message}
+                    isError={Boolean(error?.message)}
+                    label="LDAP URL"
+                  >
+                    <Input {...field} placeholder="ldap://domain-or-ip:389" />
+                  </FormControl>
+                )}
+              />
+              <div className="grid grid-cols-2 gap-2">
+                <Controller
+                  name="credentials.dn"
+                  control={control}
+                  render={({ field, fieldState: { error } }) => (
+                    <FormControl
+                      errorText={error?.message}
+                      isError={Boolean(error?.message)}
+                      label="Binding Distinguised Name (DN)"
+                    >
+                      <Input {...field} placeholder="CN=John,OU=Users,DC=example,DC=com" />
+                    </FormControl>
+                  )}
+                />
+                <Controller
+                  name="credentials.password"
+                  control={control}
+                  render={({ field: { value, onChange }, fieldState: { error } }) => (
+                    <FormControl
+                      errorText={error?.message}
+                      isError={Boolean(error?.message)}
+                      label="Binding Password"
+                    >
+                      <SecretInput
+                        containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                        value={value}
+                        onChange={(e) => onChange(e.target.value)}
+                      />
+                    </FormControl>
+                  )}
+                />
+              </div>
+            </Tab.Panel>
+            <Tab.Panel>
+              <Controller
+                name="credentials.sslCertificate"
+                control={control}
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    errorText={error?.message}
+                    isError={Boolean(error?.message)}
+                    className={sslEnabled ? "" : "opacity-50"}
+                    label="SSL Certificate"
+                    isOptional
+                  >
+                    <TextArea
+                      className="h-[3.6rem] !resize-none"
+                      {...field}
+                      isDisabled={!sslEnabled}
+                    />
+                  </FormControl>
+                )}
+              />
+              <Controller
+                name="credentials.sslRejectUnauthorized"
+                control={control}
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    className={` ${sslEnabled ? "" : "opacity-50"}`}
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="ssl-reject-unauthorized"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={sslEnabled ? value : false}
+                      onCheckedChange={onChange}
+                      isDisabled={!sslEnabled}
+                    >
+                      <p className="w-[9.5rem]">
+                        Reject Unauthorized
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <p>
+                              If enabled, Infisical will only connect to the server if it has a
+                              valid, trusted SSL certificate.
+                            </p>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </FormControl>
+                )}
+              />
+            </Tab.Panel>
+          </Tab.Panels>
+        </Tab.Group>
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4 capitalize"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : `Connect to ${selectedProvider.replace("-", " ")}`}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};
@@ -125,7 +125,7 @@ export const AppConnectionRow = ({
                  <FontAwesomeIcon icon={faEllipsisV} />
                </IconButton>
              </DropdownMenuTrigger>
-              <DropdownMenuContent align="end">
+              <DropdownMenuContent sideOffset={2} align="end">
                <DropdownMenuItem
                  icon={<FontAwesomeIcon icon={isIdCopied ? faCheck : faCopy} />}
                  onClick={() => handleCopyId()}
@@ -135,7 +135,6 @@ export const SecretOverviewSecretRotationRow = ({
                                <img
                                  src={`/images/integrations/${image}`}
                                  style={{
-                                    height: "11px",
                                    width: "11px"
                                  }}
                                  alt={`${rotationType} logo`}
@@ -55,7 +55,6 @@ export const SecretRotationItem = ({
              <img
                src={`/images/integrations/${image}`}
                style={{
-                  height: "11px",
                  width: "11px"
                }}
                alt={`${rotationType} logo`}