> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenLDAP

> Integrate SafeSquid with OpenLDAP for centralized user authentication and group-based access control in Linux/Unix environments.

# OpenLDAP Integration

Integrate SafeSquid with OpenLDAP to enable centralized user identification and group-based access control for Linux/Unix-centric environments.

## Problem statement

Linux- and Unix-heavy environments still need attributable proxy identity and group-aware policy. Local proxy-only users do not scale well across centrally managed teams.

## Integration Workflow

| Step | Task                                                     | Goal                                                                                                                                    |
| ---- | -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| 1    | [Simple Authentication](/OpenLDAP_Simple_Authentication) | Configure LDAP server connection and enable browser-prompt authentication.                                                              |
| 2    | [SSO Authentication](/OpenLDAP_SSO_Authentication)       | Follow the documented access flow on that page and confirm the exact scope before describing it as transparent SSO in your environment. |

## Why use OpenLDAP with SafeSquid?

* **Centralized Identity:** Use your existing OpenLDAP directory for proxy authentication.
* **Group-Based Access:** Categorize users into groups (e.g., `developers`, `marketing`) and apply different filtering rules.
* **Linux Compatibility:** Ideal for environments that don't use Active Directory but require identity-based security.
* **Audit Trails:** Identity logs attribute all web activity to specific LDAP usernames.

## Scope clarification

OpenLDAP is a confirmed directory integration path. Do not assume it provides the same Kerberos-style transparent SSO experience documented for Active Directory unless the target implementation proves that behavior in your environment.

## Verification

After configuring OpenLDAP:

1. **Fetch Entries:** Confirm that LDAP users and groups are listed in the **LDAP Entities** section of the SafeSquid interface.
2. **Log Check:** Verify successful LDAP binds in `/var/log/safesquid/safesquid.log`.
3. **Policy Test:** Ensure that a rule restricted to an LDAP group correctly allows members and blocks others.

## Troubleshooting

**Symptom:** LDAP users exist, but authentication fails.\
**Likely cause:** Bind settings, base DN, or server reachability are wrong.\
**Isolation:** Check the connection details and bind-related logs.\
**Remediation:** Correct the LDAP settings and retry.\
**Retest:** Authenticate with a known-good LDAP user.

**Symptom:** Group-based policy does not differentiate users.\
**Likely cause:** Group retrieval or mapping is incomplete.\
**Isolation:** Confirm LDAP groups are visible in the interface and compare the policy scope.\
**Remediation:** Correct the group mapping.\
**Retest:** Compare different LDAP users against the same protected target.

## Source register

| Topic                  | Status                | Source                                                                                                    |
| ---------------------- | --------------------- | --------------------------------------------------------------------------------------------------------- |
| Simple LDAP bind flow  | **Confirmed**         | [Simple Authentication](/OpenLDAP_Simple_Authentication)                                                  |
| OpenLDAP “SSO” wording | **Needs scope check** | Keep the wording bounded to the implementation page unless transparent SSO is proven in the target design |

## Next steps

* [Configure Simple Authentication](/OpenLDAP_Simple_Authentication) to establish the connection.
* [Configure SSO Authentication](/OpenLDAP_SSO_Authentication) to enable user-aware policies.
* [Access Restriction](/Access_Restriction) to define what your LDAP groups can access.


## Related topics

- [Directory Services](/use_cases/authentication/directory_services.md)
- [Simple Authentication](/use_cases/authentication/openldap_simple_authentication.md)
- [SSO Authentication](/use_cases/authentication/openldap_sso_authentication.md)
- [User Identification](/use_cases/authentication/user_identities.md)
- [Integrations](/use_cases/integrations/integrations.md)