Liferay SSO with LDAP – Configuration & Flow Explained

 Single Sign-On (SSO) with LDAP is a common enterprise requirement where user authentication and authorization are centralized in a directory service such as Active Directory or OpenLDAP.

Liferay DXP provides native LDAP integration, allowing organizations to authenticate users using their corporate credentials.

This blog explains how Liferay SSO with LDAP works, its configuration, and best practices.

---

🔹 1. What Is LDAP SSO in Liferay?

LDAP (Lightweight Directory Access Protocol) is a directory service used to store:

• Users

• Groups

• Roles

• Organizational units

With LDAP SSO, users:

• Log in once using LDAP credentials

• Access Liferay without creating separate passwords

• Are automatically synced into Liferay

👉 Liferay does not store passwords locally when LDAP authentication is enabled.

---

🔹 2. Liferay LDAP SSO Architecture

Authentication Flow

1. User enters credentials on Liferay login page

2. Liferay forwards credentials to LDAP

3. LDAP validates username & password

4. On success:

   • User is created/updated in Liferay

   • Roles and groups are synced

5. User is logged into Liferay

User → Liferay → LDAP Server → Liferay → Portal Access

---

🔹 3. Supported LDAP Servers

Liferay supports:

• Microsoft Active Directory

• OpenLDAP

• Apache Directory Server

• IBM Tivoli Directory Server

---

🔹 4. Enable LDAP Authentication in Liferay

Step 1: Login as Portal Administrator

Navigate to:

Control Panel → Configuration → System Settings

---

Step 2: Configure LDAP Server

Go to:

Security → LDAP → LDAP Server Configuration

Enable:

• ✅ LDAP Authentication Enabled

• ✅ Import Enabled

---

🔹 5. LDAP Connection Configuration

Typical configuration parameters:

Setting	Example
Base Provider URL	ldap://ldap.company.com:389
Base DN	dc=company,dc=com
Principal	cn=admin,dc=company,dc=com
Credentials	********
Authentication Method	Simple

👉 For Active Directory, use:

Principal: administrator@company.com

---

🔹 6. User Mapping Configuration

Navigate to:

LDAP → Users

Example mappings:

Liferay Field	LDAP Attribute
Screen Name	sAMAccountName
Email Address	mail
First Name	givenName
Last Name	sn
UUID	objectGUID

---

🔹 7. Group & Role Mapping

Navigate to:

LDAP → Groups

• Map LDAP groups to Liferay Roles

• Enable Group Import

• Assign default site roles automatically

Example:

LDAP Group: IT_USERS
→ Liferay Role: Portal User

---

🔹 8. Import & Sync Behavior

Liferay supports:

• Automatic import on login

• Scheduled sync (via scheduler)

• Manual sync from Control Panel

Sync options:

• Users only

• Groups only

• Users + Groups

---

🔹 9. Common LDAP SSO Issues & Fixes

❌ User cannot login

✔ Check Base DN
✔ Verify credentials
✔ Test LDAP connection

---

❌ User created but cannot authenticate

✔ Ensure LDAP authentication is enabled
✔ Disable local password authentication

---

❌ Groups not syncing

✔ Check group search filter
✔ Verify group DN
✔ Enable group import

---

🔹 10. Security Best Practices

✔ Use LDAPS (port 636)
✔ Restrict LDAP service account permissions
✔ Enable audit logs
✔ Do not allow local password override
✔ Use scheduled sync carefully

---

🔹 11. LDAP vs Other SSO Options in Liferay

SSO Type	Use Case
LDAP	Internal enterprise users
SAML	External partners
OAuth2 / OIDC	Modern apps & APIs
CAS	Legacy systems

---

✅ Conclusion

Liferay’s LDAP SSO integration provides a secure, centralized, and enterprise-grade authentication solution. It simplifies user management, improves security, and ensures consistent access control across systems.

LDAP SSO is ideal when:

• Users already exist in Active Directory

• Centralized identity management is required

• Passwords must not be stored locally

💼 Need Help with Liferay, Alfresco, Jira, or Enterprise Content Management?

I help teams solve real production issues and build scalable systems.

Services I offer:

• Liferay, Alfresco setup, customization, and integration

• Repository structure design and content modeling  

• Workflow implementation (jBPM / Activiti / APS)  

• Java backend development, multithreading, and concurrency optimization  

• Performance tuning and production issue troubleshooting  

• Java, Spring Boot & microservices architecture  

• Production issue troubleshooting  

🔗 View Services: https://shikhanirankari.blogspot.com/p/professional-services.html  

📩 Email: ishikhanirankari@gmail.com | info@realtechnologiesindia.com

🌐 IT Trainings | Digital metal podium

✔ Available for quick consulting calls and project-based support

✔ Response within 24 hours

🎥 Learn IT with Shikha on YouTube

Prefer learning through videos? Watch practical tutorials on Kafka, Camunda, Alfresco, Java, Spring Boot, Microservices and Enterprise Architecture.

▶ Subscribe to Learn IT with Shikha on YouTube