--- layout: docs page_title: Domain Model - Auth Methods description: |- The anatomy of a Boundary auth method --- # Auth Methods An auth method is a resource that provides a mechanism for [users][] to authenticate to Boundary. An auth method contains [accounts][] which link an individual user to a set of credentials and [managed groups][] which groups [accounts][] that satisfy criteria and can be used as principals in [roles][]. Auth methods can be defined at either a [Global][] or [Organization][] [scope][]. ## Attributes All auth methods have the following configurable attributes: - `name` - (optional) If set, the `name` must be unique within the auth method's scope. - `description` - (optional) ### Password Auth Method Attributes The password auth method has the following additional attributes: - `min_login_name_length` - (required) The default is 3. - `min_password_length` - (required) The default is 8. ### LDAP Auth Method Attributes The ldap auth method has the following additional attributes: - `state` - The state of the auth method; either inactive, active-private, or active-public. - `start_tls` - (optional) If true, issues a StartTLS command after establishing an unencrypted connection. Defaults to false. - `insecure_tls` - (optional) If true, skips LDAP server SSL certificate validation, which is insecure and should be used with caution. Defaults to false. - `discover_dn` - (optional) If true, use anon bind to discover the bind DN (Distinguished Name) of a user. Defaults to false. - `anon_group_search` - (optional) If true, use anon bind when performing LDAP group searches. Defaults to false. - `upn_domain` - (optional) If set, the userPrincipalDomain is used to construct the UPN string for the authenticating user. The constructed UPN appears as [username]@UPNDomain Example: example.com, which causes Boundary to bind as username@example.com when it authenticates the user. - `urls` - (required) The LDAP URLS that specify LDAP servers to connect to. There must be at least one URL for each LDAP auth method. When attempting to connect, the URLs are tried in the order specified. - `user_dn` - (optional) If set, the base DN under which to perform user search. Example: ou=Users,dc=example,dc=com - `user_attr` - (optional) If set, defines the attribute on a user's entry matching the login-name passed when the user authenticates. Examples: cn, uid - `user_filter` - (optional) If set, the Go template used to construct an LDAP user search filter. The template can access the following context variables: [UserAttr, Username]. The default user_filter is ({{.UserAttr}}={{.Username}}) or (userPrincipalName={{.Username}}@UPNDomain) if the upn-domain parameter is set. - `enable_groups` - (optional) If true, an authenticated user's groups are found during authentication. Defaults to false. - `group_dn` - (optional) If set, the base DN under which to perform a group search. Example: ou=Groups,dc=example,dc=com Note: There is no default, so no base DN is used for group searches, if it's not specified. - `group_attr` - (optional) If set, the LDAP attribute to follow on objects returned by group_filter in order to enumerate user group membership. Examples: for group_filter queries returning group objects, use: cn. For queries returning user objects, use: memberOf. The default is cn. - `group_filter` - (optional) If set, the Go template used when constructing the group membership query. The template can access the following context variables: [UserDN, Username]. The default is (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}})), which is compatible with several common directory schemas. - `certificates` - (optional) If set, PEM encoded x509 certificates in ASN.1 DER form that can be used as trust anchors when connecting to an LDAP provider. - `client_certificate` - (optional) If set, a PEM encoded x509 certificate in ASN.1 DER form to be used as a client certificate. It must be set, if you specify the optional client_certificate_key. - `client_certificate_key` - (optional) If set, a PEM encoded certificate key in PKCS #8, ASN.1 DER form. It must be set, if you specify the optional client_certificate. - `bind_dn` - (optional) If set, the distinguished name of entry to bind when performing user and group searches. Example: cn=vault,ou=Users,dc=example,dc=com - `bind_password` - (optional) If set, the password to use along with bind_dn when performing user search. It must be set, if you specify the optional bind_dn. - `use_token_groups` - (optional) If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This finds all security groups, including nested ones. - `account_attribute_maps` - (optional) If set, the attribute maps from custom attributes to the standard fullname and email account attributes. These maps are represented as key=value where the key equals the from_attribute, and the value equals the to_attribute. For example, "preferredName=fullName". All attribute names are case insensitive. ## Referenced By - [Account][] - [Global][] - [Managed Group][] - [Organization][] [account]: /boundary/docs/concepts/domain-model/accounts [accounts]: /boundary/docs/concepts/domain-model/accounts [global]: /boundary/docs/concepts/domain-model/scopes#global [managed group]: /boundary/docs/concepts/domain-model/managed-groups [managed groups]: /boundary/docs/concepts/domain-model/managed-groups [organization]: /boundary/docs/concepts/domain-model/scopes#organizations [roles]: /boundary/docs/concepts/domain-model/roles [scope]: /boundary/docs/concepts/domain-model/scopes [users]: /boundary/docs/concepts/domain-model/users ## Service API Docs The following services are relevant to this resource: - [Auth Method Service](/boundary/api-docs/auth-method-service) - [Auth Token Service](/boundary/api-docs/auth-token-service)