LDAP (Preparing an Install)

LDAP is configured at runtime, per organization — there are no LDAP settings in install.conf or the environment. An org admin saves the server details through /api/admin/ldap-config; see Security → LDAP Configuration for the full field list, the sync model, and what LDAP does and doesn't cover today (it syncs group membership; it does not provide directory-password sign-in).

This page covers what to prepare before an org admin turns it on.

Preparing your directory

1. Create a service account with read access to the user and group OUs you intend to expose. Don't share it with other applications — rotation is easier when each consumer has its own.
2. Decide which directory groups map to Honeyframe groups. Honeyframe groups are flat (no nesting), so plan one directory group per Honeyframe group, and record each group's DN — it goes in the group's LDAP DN field on the Groups page.
3. Pick the matching attribute. Sync matches a directory member to a Honeyframe user by comparing user_id_attribute (default mail) with the user's email. Make sure that attribute holds the same address users have in Honeyframe.
4. Create the users first. Sync never creates users — invite or provision them (for example with bulk import) before the first sync.

Preparing the Platform host

• Network — the Platform host must reach the directory on its LDAP port (636 for LDAPS, 389 for plain LDAP).
• TLS trust — with use_ssl: true, the host must trust the directory server's certificate. If your directory uses an internal CA, add it to the host's system trust store.
• Client library — sync uses the ldap3 Python library. Run a connection test after configuring; if it reports the module is missing, contact your Honeyframe provider.

Sign-in

Users keep signing in the way they do today (local password, Google, Microsoft, or your org's OIDC / SAML provider — see Applications & SSO). LDAP controls group membership, and therefore what a signed-in user can access.