Skip to main content

LDAP

Overview​

Ldap is an identity and access management platform. Learn more in the official Ldap documentation.

The DataHub integration for Ldap covers identity entities such as users, groups, and memberships. Depending on module capabilities, it can also capture features such as lineage, usage, profiling, ownership, tags, and stateful deletion detection.

Concept Mapping​

While the specific concept mapping is still pending, this shows the generic concept mapping in DataHub.

Source ConceptDataHub ConceptNotes
Ownership and collaboration principalsCorpUser, CorpGroupEmitted by modules that support ownership and identity metadata.

Module ldap​

Certified

Important Capabilities​

CapabilityStatusNotes
Detect Deleted Entities✅Enabled by default via stateful ingestion.

Overview​

The ldap module ingests metadata from Ldap into DataHub. It is intended for production ingestion workflows and module-specific capabilities are documented below.

Prerequisites​

Before running ingestion, ensure network connectivity to the source, valid authentication credentials, and read permissions for metadata APIs required by this module.

Install the Plugin​

pip install 'acryl-datahub[ldap]'

Starter Recipe​

Check out the following recipe to get started with ingestion! See below for full configuration options.

For general pointers on writing and running a recipe, see our main recipe guide.

source:
  type: "ldap"
  config:
    # Coordinates
    ldap_server: ldap://localhost

    # Credentials
    ldap_user: "cn=admin,dc=example,dc=org"
    ldap_password: "admin"

    # Options
    base_dn: "dc=example,dc=org"

    # TLS Security - Certificate verification is enabled by default
    # Set to false only for testing with self-signed certificates
    # tls_verify: true

sink:
  # sink configs

Config Details​

Note that a . is used to denote nested fields in the YAML recipe.

FieldDescription
base_dn ✅
string
LDAP DN.
ldap_password ✅
string(password)
LDAP password.
ldap_server ✅
string
LDAP server URL.
ldap_user ✅
string
LDAP user.
drop_missing_first_last_name
boolean
If set to true, any users without first and last names will be dropped.
Default: True
filter
string
LDAP extractor filter.
Default: (objectClass=*)
group_attrs_map
object
Default: {}
manager_filter_enabled
boolean
Use LDAP extractor filter to search managers.
Default: True
manager_pagination_enabled
boolean
[deprecated] Use pagination_enabled
Default: True
page_size
integer
Size of each page to fetch when extracting metadata.
Default: 20
pagination_enabled
boolean
Use pagination while do search query (enabled by default).
Default: True
platform_instance
One of string, null
The instance of the platform that all assets produced by this recipe belong to. This should be unique within the platform. See https://docs.datahub.com/docs/platform-instances/ for more details.
Default: None
tls_verify
boolean
Verify server TLS certificates for LDAPS connections. Disabling in production exposes connections to Man-in-the-Middle attacks (CWE-295).
Default: True
use_email_as_username
boolean
Use email for users' usernames instead of username (disabled by default). If enabled, the user and group urn would be having email as the id part of the urn.
Default: False
user_attrs_map
object
Default: {}
env
string
The environment that all assets produced by this connector belong to
Default: PROD
attrs_list
One of array, null
Retrieved attributes list
Default: None
attrs_list.string
string
custom_props_list
One of array, null
A list of custom attributes to extract from the LDAP provider.
Default: None
custom_props_list.string
string
stateful_ingestion
One of StatefulStaleMetadataRemovalConfig, null
Default: None
stateful_ingestion.enabled
boolean
Whether or not to enable stateful ingest. Default: True if a pipeline_name is set and either a datahub-rest sink or datahub_api is specified, otherwise False
Default: False
stateful_ingestion.fail_safe_threshold
number
Prevents large amount of soft deletes & the state from committing from accidental changes to the source configuration if the relative change percent in entities compared to the previous state is above the 'fail_safe_threshold'.
Default: 75.0
stateful_ingestion.remove_stale_metadata
boolean
Soft-deletes the entities present in the last successful run but missing in the current run with stateful_ingestion enabled.
Default: True

Capabilities​

Use the Important Capabilities table above as the source of truth for supported features and whether additional configuration is required.

Limitations​

Module behavior is constrained by source APIs, permissions, and metadata exposed by the platform. Refer to capability notes for unsupported or conditional features.

Troubleshooting​

If ingestion fails, validate credentials, permissions, connectivity, and scope filters first. Then review ingestion logs for source-specific errors and adjust configuration accordingly.

Code Coordinates​

  • Class Name: datahub.ingestion.source.ldap.LDAPSource
  • Browse on GitHub
Questions?

If you've got any questions on configuring ingestion for LDAP, feel free to ping us on our Slack.

💡 Contributing to this documentation

This page is auto-generated from the underlying source code. To make changes, please edit the relevant source files in the metadata-ingestion directory.

Tip: For quick typo fixes or documentation updates, you can click the ✏️ Edit icon directly in the GitHub UI to open a Pull Request. For larger changes and PR naming conventions, please refer to our Contributing Guide.