LDAP

Identity Server and bind credentials

Query and manage an LDAP or Active Directory server from any Windmill script, flow or app.

Set up in 3 steps

Get your credential

You need the server address, and the distinguished name and password of an account allowed to bind and search.

Add the resource in Windmill

Open Resources, add a resource of type ldap, and fill it in.

Run your first script

Fork any script below and read before writing anything.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Modify LDAP object

Script ldap Verified

LDAP Search

Script ldap Verified

Resource type

ldap — the shape of the credential every script on this page expects.

View raw schema →

Field	Type	Required	What it is
server	string	Yes	Use format like: ldap://ipa.demo1.freeipa.org:389. If you use SSL, specify ldaps:// as the scheme and usually port 636.
bind_user	string	Yes	for Active Directory, you may use DOMAIN\username or UPN here. For normal LDAP, use the distinguished name of the user.
bind_password	string	Yes
use_ssl	boolean	No	Whether to use SSL/TLS when connecting to LDAP. If not further specified in the server string, this implies connecting to the server on port 636 instead of 389.
ssl_validate	boolean	No	validate SSL server certificate?

Questions

What does ssl_validate do?

It checks the server's certificate. Turning it off accepts any certificate, which defeats the encryption — only do it against a server with a private CA you cannot install.

Is my credential stored on the hub?

Never. It lives only in your own Windmill workspace, encrypted at rest.