LDAP and OnPremise Active Directory

Authenticate users against any LDAP server. This integration can help organizations that use on-premise directory services like Microsoft Active Directory or Red Hat Directory Server.

LDAP Authentication with SFTPPlus ​

SFTPPlus can connect to an LDAP server using either the legacy TCP protocol or the more modern and secure LDAPS (LDAP over TLS/SSL). This accommodates different security requirements and infrastructure configurations.

  • TCP Authentication: This method uses the standard LDAP protocol over an unencrypted connection. While functional, it is generally less secure and not recommended for production environments where sensitive data is being transmitted.
  • LDAPS Authentication: This method secures the LDAP connection by encrypting the data stream using TLS/SSL. LDAPS ensures that user credentials and other sensitive information transmitted between SFTPPlus and the LDAP server are protected from eavesdropping.

When a user attempts to connect to SFTPPlus, the software performs a bind operation to the LDAP server, attempting to authenticate the user's credentials against the directory. If the credentials are valid, the user is granted access to the SFTPPlus services.

You can check our documentation page dedicated to LDAP authentication for a detailed technical description on how to integrate SFTPPlus MFT and LDAP or Active Directory servers.

Dynamic Authorization Based on LDAP Attributes ​

Beyond simple authentication, SFTPPlus can leverage LDAP attributes to determine a user's permissions and access level. This dynamic authorization capability streamlines administration and ensures that users have appropriate access without manual configuration for each individual. The authorization rules are based on predefined filters that map LDAP attributes to specific access policies within SFTPPlus.

Key attributes used for this purpose include:

  • Group Membership: SFTPPlus can read a user's group memberships from the LDAP directory. For instance, users in the "Finance" group can be granted read/write access to the financial_reports folder, while users in the "Sales" group might only have access to the sales_data directory.
  • Office Location: An organization can use the officeLocation attribute to restrict a user's access to specific file transfer services or folders. For example, users from the "London" office could be restricted to accessing servers within the EU region.
  • Custom Attributes: SFTPPlus's flexibility allows for the use of custom attributes defined within the LDAP schema to create more granular access rules.

This attribute-based access control (ABAC) system ensures that permissions are always synchronized with the central directory, reducing the risk of security vulnerabilities that can arise from stale or incorrect permissions.

Multi-Protocol Support for LDAP Users ​

Once authenticated via LDAP, users can access any of SFTPPlus's supported file transfer services, which include:

  • SFTP/SCP (SSH File Transfer Protocol)
  • FTP/FTPS (File Transfer Protocol Secure)
  • HTTPS (Hypertext Transfer Protocol Secure)

Additionally, administrator users can also be authenticated against the LDAP server. This provides a single source of truth for all user credentials, simplifying management and improving security across the entire SFTPPlus platform.

The ability to manage both file transfer users and administrators centrally within an existing LDAP infrastructure is a major benefit for large-scale deployments.

LDAP with Active Directory in a DMZ Environment ​

SFTPPlus can use LDAP with Microsoft Active Directory to implement an isolated DMZ (Demilitarized Zone) environment. The DMZ is a security zone that sits between an organization's internal network and the public internet. It's designed to host public-facing services while protecting the internal network from direct external access.

In this configuration, the virtual machine (VM) running SFTPPlus within the DMZ does not have to be a member of the Active Directory domain. This is a critical security measure as it prevents the VM from accessing any domain resources or internal network assets. Instead of using domain-integrated authentication, SFTPPlus is configured to connect to the Active Directory server over the LDAP protocol with the firewall opened for a single port.

This setup offers several security benefits:

  • Isolation: The SFTPPlus server remains isolated from the internal network. If the DMZ server is compromised, the attacker cannot use its domain membership to move laterally into the internal network.
  • Reduced Attack Surface: The DMZ server is not a full-fledged domain member, which reduces its attack surface. It only requires the necessary ports open to communicate with the LDAP server and external clients.
  • Centralized User Management: Despite the physical and logical isolation, administrators can still manage user accounts centrally within Active Directory. They don't need to create and manage separate user accounts for the SFTPPlus application.

This approach allows organizations to continue to use their existing Active Directory infrastructure for user authentication while maintaining the security and isolation required for a DMZ. It provides a secure way to offer file transfer services to external partners or customers without exposing the internal network to unnecessary risks.

Get support and consultancy from security experts ​

With over 20 years of experience, our support team has helped customers implement secure transfers and navigate complex migrations, from legacy systems to modern cloud SSO solutions.

Whether you're looking to establish a new LDAP user base or transition your existing authentication methods, the support team can provide guidance throughout the implementation process.

Contact us to get started.