Context sources

Enrich authorization with LDAP directory data

Automatically pull user attributes, group memberships, and organizational units from your LDAP directory into Cerbos policy evaluations, no application code changes required.

LDAP context

Automatically enrich authorization requests with user profiles, group memberships, and organizational units from your LDAP directory

Cached responses

Configurable TTLs cache enrichment results to balance data freshness against evaluation latency

Zero application code

Identity enrichment happens at the policy layer, your application code stays clean

How Cerbos works with LDAP

Authorization decisions are only as good as the data behind them. LDAP provides real-time context (user profiles, group memberships, or external attributes) that makes Cerbos policies richer and more accurate.

Cerbos lets you write fine-grained, context-aware authorization policies in human-readable YAML. With LDAP as a context source, those policies can evaluate attributes beyond what's in the initial request.

Because enrichment happens at the policy layer, your application code stays clean, no custom plumbing to fetch and merge identity data before making authorization calls.

Policy-as-codeHuman-readable YAML policies managed like source code Scalable PDPStateless policy decision point with sub-millisecond latency Centralized managementManage, test, and deploy policies from a single control plane

Authorization powered by your LDAP directory

LDAP directories remain the backbone of identity management in many organizations, especially those with on-premises infrastructure, legacy systems, or regulated environments. Cerbos identity enrichment connects directly to your LDAP directory, making user attributes, group memberships, and organizational unit data available in your authorization policies.

How it works

Your application sends an authorization request with a user identifier (DN, uid, or sAMAccountName).
Cerbos Synapse queries your LDAP directory for the user's attributes, group memberships, and organizational unit via a proxy extension, including nested group resolution.
Enriched data is available in your policies, write rules based on LDAP groups, organizational units, custom attributes, or any combination.
Connections are pooled and results cached for reliable, low-latency performance.

Bridging legacy identity and modern authorization

Many organizations have decades of identity data in LDAP that they cannot easily migrate. Cerbos lets you build modern, fine-grained authorization policies on top of your existing directory without requiring a migration to a cloud identity provider.

Get started

LDAP identity enrichment is available as part of Cerbos Synapse. Talk to us to learn more about enriching your authorization decisions with LDAP directory data.

FAQ

How does LDAP enrichment work with Cerbos?

Cerbos queries your LDAP directory at evaluation time to fetch the user's attributes, group memberships, and organizational unit. This data is available as principal attributes in your policies, enabling rules based on any directory attribute.

How is this different from the LDAP authentication integration?

The authentication integration relies on your application to query LDAP and pass identity data to Cerbos. Identity enrichment is handled by Cerbos itself, it queries the directory directly at authorization time, so your application only needs to provide a user identifier.

Which LDAP directories does Cerbos support for enrichment?

Cerbos supports any LDAPv3-compatible directory, including Active Directory, OpenLDAP, 389 Directory Server, FreeIPA, and Oracle Internet Directory. Connections support LDAPS and StartTLS for encryption, and client certificate authentication for mutual TLS.