LDAP integration

Overview

LDAP (Lightweight Directory Access Protocol) tool for interacting with directory services such as Active Directory, OpenLDAP, and other LDAP-compliant servers. Supports searching entries with filters, comparing attribute values, creating new entries, updating (add/replace/delete) attributes on existing entries, deleting entries, and renaming/moving entries by changing their distinguished name. Uses the ldapjs library for direct LDAP protocol communication over TCP with optional TLS/STARTTLS encryption.

Node Type

Action — processes input items and produces output

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires LDAP credentials. See the Credentials Guide for setup instructions.

Operations

Operation	Value	Description
Compare	compare	Compare an attribute value
Create	create	Create a new entry
Delete	delete	Delete an entry
Rename	rename	Rename the DN of an existing entry
Search	search	Search the LDAP directory
Update	update	Update attributes on an existing entry

Parameters

Compare

Parameter	Type	Required	Default	Description
DN	string	Yes	—	The distinguished name of the entry.
Attribute ID	string	Yes	—	The attribute ID to compare. Find attribute names by performing a search operation on the entry first.
Value	string	No	—	The value to compare the attribute against.

Create

Parameter	Type	Required	Default	Description
DN	string	Yes	—	The distinguished name of the entry.
Attributes	fixedCollection	No	{}	Attribute name/value pairs to set on the new entry. Each row is one attribute ID and its value; repeat the same ID to give that attribute multiple values.
— Attribute ID	string	Yes	—	The attribute name (e.g. cn, sn, mail, objectClass).
— Value	string	No	—	The value for this attribute.

Delete

Parameter	Type	Required	Default	Description
DN	string	Yes	—	The distinguished name of the entry.

Rename

Parameter	Type	Required	Default	Description
DN	string	Yes	—	The distinguished name of the entry.
New DN	string	Yes	—	The new distinguished name for the entry.

Search

Parameter	Type	Required	Default	Description
Base DN	string	Yes	—	The distinguished name of the subtree to search in.
Search For	options	No	custom	How to construct the search filter. Use “Custom Filter” for raw LDAP filter syntax, or “Object Class Filter” to build a filter from object class + attribute + search text.
				Options: custom (use a custom LDAP filter string), objectClass (search by object class and attribute)
Custom Filter	string	No	(objectclass=*)	Raw LDAP filter string. Escape special characters (* ( ) ) with a backslash. Example: (&(objectClass=person)(cn=john*)) (shown when Search For is custom)
Object Class	string	No	(objectclass=*)	LDAP object class filter. Use LDAP filter syntax, e.g. (objectclass=person), (objectclass=organizationalUnit). Type the object class name or use * for all. (shown when Search For is objectClass)
Attribute	string	Yes	—	Attribute name to search by (e.g. cn, mail, sn, uid). Find attribute names by first running a search with a custom filter like (objectclass=*). (shown when Search For is objectClass)
Search Text	string	Yes	—	Text to match against the attribute. Use * for wildcard matching. (shown when Search For is objectClass)
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}
				Options: base
— Attributes	string	No	—	Comma-separated list of attribute names to return in results. Leave empty to return all attributes.
— Page Size	number	No	1000	Maximum number of results to request at one time. Set to 0 to disable paging.
— Scope	options	No	sub	The set of entries at or below the BaseDN that may be considered potential matches.
				Options: base, one, sub

Update

Parameter	Type	Required	Default	Description
DN	string	Yes	—	The distinguished name of the entry.
Update Attributes	fixedCollection	No	{}	Attribute changes to apply to the existing entry, grouped as Add, Replace or Remove.
— Attribute ID	string	Yes	—	The attribute name to add.
— Value	string	No	—	The value to add.
— Attribute ID	string	Yes	—	The attribute name to replace.
— Value	string	No	—	The new value for this attribute.
— Attribute ID	string	Yes	—	The attribute name to remove.
— Value	string	No	—	The specific value to remove (leave empty to remove all values for this attribute).

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	1	Maximum number of items to process concurrently. LDAP operations share a single connection, so keep this low to avoid issues.

Output Data

Binary data is forwarded unchanged on every operation. Everything else depends on whether you searched or wrote:

Operation	Output items per input item
search	Fans out — one item per matching entry. Each entry is merged onto the input item JSON, so upstream fields pass through.
compare, create, delete, rename, update	One item whose JSON replaces the input item JSON with the result object below. Upstream fields do not pass through.

Search entries carry dn plus one property per returned attribute. A single-valued attribute is a string; a multi-valued attribute is an array. The Active Directory binary attributes objectGUID and objectSid are converted to hex strings so they survive JSON. Two flags may appear:

• _searchResultCount: 0 — the search matched nothing, and one item is emitted anyway so the branch is not silently empty.
• _truncated: true — the directory server stopped early because of its own size limit, so the results are incomplete.

Write results carry:

Operation	Fields
compare	dn, attribute, result (true when the value matches)
create	dn, result: "success"
delete	dn, result: "success"
rename	dn (the new DN), result: "success"
update	dn, result: "success", changes[] — one entry per modification, each { operation, modification: { type, values } }

The item’s own dn field wins. For every operation except Search, if the incoming item JSON already has a dn property, that value is used as the target DN and the DN parameter is ignored. This makes it easy to chain a Search into a Delete or Update without wiring the DN through by hand — but it also means an unrelated upstream dn field will silently redirect the operation.

Reference the result downstream by expression, e.g. {{ $json.dn }} or {{ $json.mail }}.

Example Configuration

Search a subtree with a raw LDAP filter, returning only selected attributes:

{
  "type": "ldap",
  "parameters": {
    "operation": "search",
    "baseDN": "ou=users,dc=example,dc=com",
    "searchFor": "custom",
    "customFilter": "(&(objectClass=person)(department=Engineering))",
    "returnAll": false,
    "limit": 100,
    "options": {
      "attributes": "cn, mail, department",
      "scope": "sub",
      "pageSize": 1000
    }
  }
}

Search by object class and attribute instead of writing a filter:

{
  "type": "ldap",
  "parameters": {
    "operation": "search",
    "baseDN": "ou=users,dc=example,dc=com",
    "searchFor": "objectClass",
    "objectClassFilter": "(objectclass=person)",
    "attribute": "mail",
    "searchText": "{{ $json.email }}",
    "returnAll": true
  }
}

Create a new entry:

{
  "type": "ldap",
  "parameters": {
    "operation": "create",
    "dn": "cn={{ $json.username }},ou=users,dc=example,dc=com",
    "attributes": {
      "attribute": [
        { "id": "objectClass", "value": "inetOrgPerson" },
        { "id": "cn", "value": "{{ $json.username }}" },
        { "id": "sn", "value": "{{ $json.lastName }}" },
        { "id": "mail", "value": "{{ $json.email }}" }
      ]
    }
  }
}

Replace one attribute and remove another:

{
  "type": "ldap",
  "parameters": {
    "operation": "update",
    "dn": "{{ $json.dn }}",
    "attributes": {
      "replace": [
        { "id": "department", "value": "{{ $json.newDepartment }}" }
      ],
      "delete": [
        { "id": "telephoneNumber", "value": "" }
      ]
    }
  }
}

Check whether an attribute holds a given value:

{
  "type": "ldap",
  "parameters": {
    "operation": "compare",
    "dn": "{{ $json.dn }}",
    "id": "mail",
    "value": "{{ $json.email }}"
  }
}

Move an entry to a different OU:

{
  "type": "ldap",
  "parameters": {
    "operation": "rename",
    "dn": "{{ $json.dn }}",
    "targetDn": "cn={{ $json.cn }},ou=archive,dc=example,dc=com"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

This tool interacts with LDAP directory servers to search, compare, create, update, delete, and rename entries. It is ideal for managing directory services like Active Directory or OpenLDAP when direct manipulation of entries and their attributes is required. The tool produces the results of searches, confirmation of comparisons, or the status of creation, update, deletion, and rename operations.