> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.generaltranslation.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Describes the AD/LDAP Connector Configuration file contents.

# AD/LDAP Connector Configuration File Schema

The AD/LDAP Connector's main configuration file is `config.json`. You can modify this file to make changes that are not available via the AD/LDAP **Connector Admin Console**. You can also view this file to determine which tenant is using a particular Connector. The file is located in the install directory for the AD/LDAP Connector, which (for Windows) is usually found at `C:\Program Files (x86)\Auth0\AD LDAP Connector`. The following settings are supported in this file:

<table class="table">
  <thead>
    <tr>
      <th>Setting</th>
      <th>Description</th>
      <th>Default</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>AD\_HUB</code></td>
      <td>The Auth0 endpoint to which the connector will connect. This value is maintained by the connector.</td>

      <td />
    </tr>

    <tr>
      <td><code>CA\_CERT</code></td>
      <td>An authority certificate or array of authority certificates to check the remote host against.</td>

      <td />
    </tr>

    <tr>
      <td><code>CLIENT\_CERT\_AUTH</code></td>
      <td>Specifies if <strong>Client Certificate Authentication</strong> is enabled or not. This value is configured in Auth0 and maintained by the connector.</td>

      <td />
    </tr>

    <tr>
      <td><code>CONNECTION</code></td>
      <td>The name of the connection in Auth0 which is linked to this instance of the connector. This value is maintained by the connector.</td>

      <td />
    </tr>

    <tr>
      <td><code>CONNECTIONS\_API\_V2\_KEY</code></td>
      <td>A Management API token used to call the Get a connection endpoint. Set this when you need to troubleshoot the connector. This compares the local certificate to the one configured in Auth0 and detects a possible mismatch.</td>

      <td />
    </tr>

    <tr>
      <td><code>FIREWALL\_RULE\_CREATED</code></td>
      <td>Set to <code>true</code> once the Firewall rule has been created for the Kerberos Server (only when Kerberos is enabled).</td>

      <td />
    </tr>

    <tr>
      <td><code>GROUPS</code></td>
      <td>Include the user's groups when enriching the profile.</td>
      <td><code>true</code></td>
    </tr>

    <tr>
      <td><code>GROUP\_PROPERTY</code></td>
      <td>The attribute of the group object used when adding the groups to a user.</td>
      <td><code>cn</code></td>
    </tr>

    <tr>
      <td><code>GROUPS\_CACHE\_SECONDS</code></td>
      <td>Total time in seconds to cache a user's groups.</td>
      <td>600 seconds.</td>
    </tr>

    <tr>
      <td><code>GROUPS\_TIMEOUT\_SECONDS</code></td>
      <td>The timeout in seconds for searching all groups a user belongs to.</td>
      <td>20 seconds</td>
    </tr>

    <tr>
      <td><code>HTTP\_PROXY</code></td>
      <td>The proxy server URL if one is required to connect from the AD/LDAP Connector to Auth0.</td>

      <td />
    </tr>

    <tr>
      <td><code>KERBEROS\_AUTH</code></td>
      <td>Set if <strong>Kerberos Authentication</strong> is enabled or not. This value is configured in Auth0 and maintained by the connector.</td>

      <td />
    </tr>

    <tr>
      <td><code>LAST\_SENT\_THUMBPRINT</code></td>
      <td>Thumbprint of the last certificate which was sent to Auth0.</td>

      <td />
    </tr>

    <tr>
      <td><code>LDAP\_BASE</code></td>
      <td>Defines the location in the directory where the LDAP search begins. For example: <code>DC=fabrikam,DC=local</code>.</td>

      <td />
    </tr>

    <tr>
      <td><code>LDAP\_BASE\_GROUPS</code></td>
      <td>Defines the location in the directory where the LDAP groups search begins.</td>

      <td />
    </tr>

    <tr>
      <td><code>LDAP\_BIND\_PASSWORD</code></td>
      <td>The password of the LDAP user. This setting is automatically removed after the connector initializes.</td>

      <td />
    </tr>

    <tr>
      <td><code>LDAP\_BIND\_CREDENTIALS</code></td>
      <td>The encrypted password of the LDAP user. This setting is automatically added after the connector initializes.</td>

      <td />
    </tr>

    <tr>
      <td><code>LDAP\_BIND\_USER</code></td>
      <td>The user for binding a connection to LDAP.</td>

      <td />
    </tr>

    <tr>
      <td><code>LDAP\_HEARTBEAT\_SEARCH\_QUERY</code></td>
      <td>The LDAP search query used for heartbeat checks.</td>
      <td><code>(&(objectclass=user)(|(sAMAccountName=foo)(UserPrincipalName=foo)))</code></td>
    </tr>

    <tr>
      <td><code>LDAP\_HEARTBEAT\_SECONDS</code></td>
      <td>Time in seconds to keep the LDAP connection open.</td>

      <td />
    </tr>

    <tr>
      <td><code>LDAP\_SEARCH\_ALL\_QUERY</code></td>
      <td>The LDAP query used to list all users in the LDAP store.</td>
      <td><code>(objectCategory=person)</code></td>
    </tr>

    <tr>
      <td><code>LDAP\_SEARCH\_GROUPS</code></td>
      <td>The LDAP query used to find groups in the LDAP store. For example: <code>(&(objectCategory=group)(member={0}))</code></td>
      <td><code>(member:1.2.840.113556.1.4.1941:={0})</code></td>
    </tr>

    <tr>
      <td><code>LDAP\_SEARCH\_QUERY</code></td>
      <td>The LDAP query used to find users in the LDAP store.</td>
      <td><code>(&(objectCategory=person)(anr={0}))</code></td>
    </tr>

    <tr>
      <td><code>LDAP\_USER\_BY\_NAME</code></td>
      <td>The LDAP query used to find the user during authentication. This setting lets you specify which attribute is considered the user's username. For example, like the common name: the sAMAccountName, UPN, et cetera. This setting also supports multiple values for an OR search, for example: <code>(|(sAMAccountName={0})(userPrincipalName={0}))</code></td>
      <td><code>(sAMAccountName={0})</code></td>
    </tr>

    <tr>
      <td><code>LDAP\_URL</code></td>
      <td>The LDAP connection string. For example: <code>ldap\://fabrikam-dc.fabrikam.local</code>.</td>

      <td />
    </tr>

    <tr>
      <td><code>PORT</code></td>
      <td>The port the server runs on when Kerberos or Client Certificate Authentication is enabled.</td>

      <td />
    </tr>

    <tr>
      <td><code>PROVISIONING\_TICKET</code></td>
      <td>The Auth0 provisioning ticket used to communicate with Auth0.</td>

      <td />
    </tr>

    <tr>
      <td><code>REALM</code></td>
      <td>The Auth0 realm, for example: <code>urn:auth0:fabrikam</code>. This value is maintained by the connector.</td>

      <td />
    </tr>

    <tr>
      <td><code>SERVER\_URL</code></td>
      <td>The default connector URL will be <code>server-name:port</code>, but this setting allows you to overwrite this. For example: <code>connector.mycompany.com</code>.</td>

      <td />
    </tr>

    <tr>
      <td><code>SESSION\_SECRET</code></td>
      <td>The session secret used to encrypt the session cookie.</td>

      <td />
    </tr>

    <tr>
      <td><code>SITE\_NAME</code></td>
      <td>When Client Certificate Authentication is enabled, but not possible the AD Connector will show a fallback login page. This setting allows you to specify the title that will show on top of the page.</td>
      <td>Name of the AD connection.</td>
    </tr>

    <tr>
      <td><code>SSL\_CA\_PATH</code></td>
      <td>Absolute path to the base directory where the CA certificate file(s) are located.</td>

      <td />
    </tr>

    <tr>
      <td><code>SSL\_KEY\_PASSWORD</code></td>
      <td>The password for the SSL certificate.</td>

      <td />
    </tr>

    <tr>
      <td><code>SSL\_PFX</code></td>
      <td>Base64 encoded certificate to use for SSL.</td>

      <td />
    </tr>

    <tr>
      <td><code>TENANT\_SIGNING\_KEY</code></td>
      <td>Your Auth0 tenant used to verify JWTs.</td>

      <td />
    </tr>

    <tr>
      <td><code>WSFED\_ISSUER</code></td>
      <td>The issuer being set in the WS-Federation responses. If a connection is configured with email domains, the first email domain configured in Auth0 will be used as issuer.</td>
      <td><code>urn:auth0</code></td>
    </tr>
  </tbody>
</table>

See [Active Directory: LDAP Syntax Filters](https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx) for information about LDAP queries.