---
title: "Update LDAP configuration"
method: PUT
path: "/v1/cluster/ldap"
tags: ["Cluster"]
---

# Update LDAP configuration

`PUT /v1/cluster/ldap`

Set or partially update the LDAP configuration for the cluster

## Request body

- Ldap — An API object that represents the cluster's LDAP configuration.
  - `bind_dn` string — A DN to use when binding with the LDAP server to run queries
  - `bind_pass` string — A password to use when binding with the LDAP server to run queries. Returned as a masked value on GET.
  - `ca_cert` string — A PEM-encoded CA certificate(s) to use for validating TLS connections to the LDAP server
  - `cache_ttl` integer — Maximum TTL of cached entries, in seconds
  - `cba` boolean — Whether to allow LDAP as an identity source for certificate-based authentication
  - `cba_identity_oid` string — The certificate subject OID to use when cba_identity_source is set to subject_oid
  - `cba_identity_source` 'subject_cn' | 'subject_oid' — The certificate subject identity source to use for LDAP lookup
  - `control_plane` boolean — Whether to use LDAP for user authentication/authorization in the control-plane
  - `data_plane` boolean — Whether to use LDAP for user authentication/authorization in the data-plane
  - `directory_timeout_s` integer — The connection timeout to the LDAP server when authenticating a user, in seconds
  - `dn_group_attr` string — The name of an attribute of the LDAP user entity that contains a list of the groups that user belongs to. (Mutually exclusive with "dn_group_query")
  - `dn_group_query` union
    - object
      - `base` string — The DN of the entry at which to start the search
      - `filter` string — An RFC-4515 string representation of the filter to apply in the search
      - `scope` 'base' | 'one' | 'subtree' — One of "base" (to search the base object itself), "one" (to search the base object's immediate children), or "subtree" (to search the base object and all its descendants)
    - object
      - `base` string, required — The DN of the entry at which to start the search
      - `filter` string, required — An RFC-4515 string representation of the filter to apply in the search
      - `scope` 'base' | 'one' | 'subtree', required — One of "base" (to search the base object itself), "one" (to search the base object's immediate children), or "subtree" (to search the base object and all its descendants)
  - `starttls` boolean — Whether to use StartTLS negotiation for the LDAP connection
  - `uris` string[] — URIs of LDAP servers containing only the schema, the host, and the port
  - `user_dn_query` union
    - object
      - `base` string — The DN of the entry at which to start the search
      - `filter` string — An RFC-4515 string representation of the filter to apply in the search
      - `scope` 'base' | 'one' | 'subtree' — One of "base" (to search the base object itself), "one" (to search the base object's immediate children), or "subtree" (to search the base object and all its descendants)
    - object
      - `base` string, required — The DN of the entry at which to start the search
      - `filter` string, required — An RFC-4515 string representation of the filter to apply in the search
      - `scope` 'base' | 'one' | 'subtree', required — One of "base" (to search the base object itself), "one" (to search the base object's immediate children), or "subtree" (to search the base object and all its descendants)
  - `user_dn_template` string — A string template that maps between the username provided to the cluster for authentication, and the LDAP DN. The special substring "%u" shall be replaced with the username. (Mutually exclusive with "user_dn_query")

## Response `200`

LDAP configuration

- Ldap — An API object that represents the cluster's LDAP configuration.
  - `bind_dn` string — A DN to use when binding with the LDAP server to run queries
  - `bind_pass` string — A password to use when binding with the LDAP server to run queries. Returned as a masked value on GET.
  - `ca_cert` string — A PEM-encoded CA certificate(s) to use for validating TLS connections to the LDAP server
  - `cache_ttl` integer — Maximum TTL of cached entries, in seconds
  - `cba` boolean — Whether to allow LDAP as an identity source for certificate-based authentication
  - `cba_identity_oid` string — The certificate subject OID to use when cba_identity_source is set to subject_oid
  - `cba_identity_source` 'subject_cn' | 'subject_oid' — The certificate subject identity source to use for LDAP lookup
  - `control_plane` boolean — Whether to use LDAP for user authentication/authorization in the control-plane
  - `data_plane` boolean — Whether to use LDAP for user authentication/authorization in the data-plane
  - `directory_timeout_s` integer — The connection timeout to the LDAP server when authenticating a user, in seconds
  - `dn_group_attr` string — The name of an attribute of the LDAP user entity that contains a list of the groups that user belongs to. (Mutually exclusive with "dn_group_query")
  - `dn_group_query` union
    - object
      - `base` string — The DN of the entry at which to start the search
      - `filter` string — An RFC-4515 string representation of the filter to apply in the search
      - `scope` 'base' | 'one' | 'subtree' — One of "base" (to search the base object itself), "one" (to search the base object's immediate children), or "subtree" (to search the base object and all its descendants)
    - object
      - `base` string, required — The DN of the entry at which to start the search
      - `filter` string, required — An RFC-4515 string representation of the filter to apply in the search
      - `scope` 'base' | 'one' | 'subtree', required — One of "base" (to search the base object itself), "one" (to search the base object's immediate children), or "subtree" (to search the base object and all its descendants)
  - `starttls` boolean — Whether to use StartTLS negotiation for the LDAP connection
  - `uris` string[] — URIs of LDAP servers containing only the schema, the host, and the port
  - `user_dn_query` union
    - object
      - `base` string — The DN of the entry at which to start the search
      - `filter` string — An RFC-4515 string representation of the filter to apply in the search
      - `scope` 'base' | 'one' | 'subtree' — One of "base" (to search the base object itself), "one" (to search the base object's immediate children), or "subtree" (to search the base object and all its descendants)
    - object
      - `base` string, required — The DN of the entry at which to start the search
      - `filter` string, required — An RFC-4515 string representation of the filter to apply in the search
      - `scope` 'base' | 'one' | 'subtree', required — One of "base" (to search the base object itself), "one" (to search the base object's immediate children), or "subtree" (to search the base object and all its descendants)
  - `user_dn_template` string — A string template that maps between the username provided to the cluster for authentication, and the LDAP DN. The special substring "%u" shall be replaced with the username. (Mutually exclusive with "user_dn_query")

## Other responses

- `400` — Bad Request
- `500` — Internal Server Error

## Changes

- **2026-04-21** `6b64152fc37b` — 1 info
  - endpoint added
- **2026-01-23** `9fdf3bc7ad77` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/redis/apis/redis-software-rest-api/changes/v1/cluster/ldap/put.md)

---

[API](https://skmtc.dev/redis/apis/redis-software-rest-api.md) · [All operations](https://skmtc.dev/redis/apis/redis-software-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/redis/redis-software-rest-api/revisions/caec2005b95b/schema)