Test LDAP User Auth

Version 4.0.24.18 (latest)

Test the user authentication settings for an LDAP configuration.

This test accepts a full LDAP configuration along with a username/password pair and attempts to authenticate the user with the LDAP server. The configuration is validated before attempting the authentication.

Looker will never return an auth_password. If this request omits the auth_password field, then the auth_password value from the active config (if present) will be used for the test.

test_ldap_user and test_ldap_password are required.

The active LDAP settings are not modified.

Calls to this endpoint may be denied by Looker (Google Cloud core).

Request

PUT /ldap_config/test_user_auth
Datatype
Description
Request
HTTP Request
body
HTTP Body
Expand HTTP Body definition...
body
LDAP Config
Expand LDAPConfig definition...
can
object
Operations the current user is able to perform on this object
alternate_email_login_allowed
boolean
Allow alternate email-based login via '/login/email' for admins and for specified users with the 'login_special_email' permission. This option is useful as a fallback during ldap setup, if ldap config problems occur later, or if you need to support some users who are not in your ldap directory. Looker email/password logins are always disabled for regular users when ldap is enabled.
auth_password
string
(Write-Only) Password for the LDAP account used to access the LDAP server
auth_requires_role
boolean
Users will not be allowed to login at all unless a role for them is found in LDAP if set to true
auth_username
string
Distinguished name of LDAP account used to access the LDAP server
connection_host
string
LDAP server hostname
connection_port
string
LDAP host port
connection_tls
boolean
Use Transport Layer Security
connection_tls_no_verify
boolean
Do not verify peer when using TLS
default_new_user_group_ids
string[]
default_new_user_groups
Group[]
default_new_user_role_ids
string[]
default_new_user_roles
Role[]
enabled
boolean
Enable/Disable LDAP authentication for the server
force_no_page
boolean
Don't attempt to do LDAP search result paging (RFC 2696) even if the LDAP server claims to support it.
groups
groups_base_dn
string
Base dn for finding groups in LDAP searches
groups_finder_type
string
Identifier for a strategy for how Looker will search for groups in the LDAP server
groups_member_attribute
string
LDAP Group attribute that signifies the members of the groups. Most commonly 'member'
groups_objectclasses
string
Optional comma-separated list of supported LDAP objectclass for groups when doing groups searches
groups_user_attribute
string
LDAP Group attribute that signifies the user in a group. Most commonly 'dn'
groups_with_role_ids
has_auth_password
boolean
(Read-only) Has the password been set for the LDAP account used to access the LDAP server
merge_new_users_by_email
boolean
Merge first-time ldap login to existing user account by email addresses. When a user logs in for the first time via ldap this option will connect this user into their existing account by finding the account with a matching email address. Otherwise a new user account will be created for the user.
modified_at
string
When this config was last modified
modified_by
string
User id of user who last modified this config
set_roles_from_groups
boolean
Set user roles in Looker based on groups from LDAP
test_ldap_password
string
(Write-Only) Test LDAP user password. For ldap tests only.
test_ldap_user
string
(Write-Only) Test LDAP user login id. For ldap tests only.
user_attribute_map_email
string
Name of user record attributes used to indicate email address field
user_attribute_map_first_name
string
Name of user record attributes used to indicate first name
user_attribute_map_last_name
string
Name of user record attributes used to indicate last name
user_attribute_map_ldap_id
string
Name of user record attributes used to indicate unique record id
user_attributes
user_attributes_with_ids
user_bind_base_dn
string
Distinguished name of LDAP node used as the base for user searches
user_custom_filter
string
(Optional) Custom RFC-2254 filter clause for use in finding user during login. Combined via 'and' with the other generated filter clauses.
user_id_attribute_names
string
Name(s) of user record attributes used for matching user login id (comma separated list)
user_objectclass
string
(Optional) Name of user record objectclass used for finding user during login id
allow_normal_group_membership
boolean
Allow LDAP auth'd users to be members of non-reflected Looker groups. If 'false', user will be removed from non-reflected groups on login.
allow_roles_from_normal_groups
boolean
LDAP auth'd users will be able to inherit roles from non-reflected Looker groups.
allow_direct_roles
boolean
Allows roles to be directly assigned to LDAP auth'd users.
url
string
Link to get this item

Response

200: Result info.

Datatype
Description
details
string
Additional details for error cases
Expand LDAPConfigTestIssue definition...
severity
string
Severity of the issue. Error or Warning
message
string
Message describing the issue
message
string
Short human readable test about the result
status
string
Test status code: always 'success' or 'error'
trace
string
A more detailed trace of incremental results during auth tests
user
User details from LDAP server for auth tests
Expand LDAPUser definition...
all_emails
string[]
attributes
object
Dictionary of user's attributes (name/value)
email
string
Primary email address
first_name
string
First name
groups
string[]
last_name
string
Last Name
ldap_dn
string
LDAP's distinguished name for the user record
ldap_id
string
LDAP's Unique ID for the user
roles
string[]
url
string
Link to ldap config
url
string
Link to ldap config

400: Bad Request

Datatype
Description
(object)
message
string
Error details
documentation_url
string
Documentation link

403: Permission Denied

Datatype
Description
(object)
message
string
Error details
documentation_url
string
Documentation link

404: Not Found

Datatype
Description
(object)
message
string
Error details
documentation_url
string
Documentation link

422: Validation Error

Datatype
Description
(object)
message
string
Error details
Expand ValidationErrorDetail definition...
field
string
Field with error
code
string
Error code
message
string
Error info message
documentation_url
string
Documentation link
documentation_url
string
Documentation link

429: Too Many Requests

Datatype
Description
(object)
message
string
Error details
documentation_url
string
Documentation link