Active Directory/LDAP Authentication for Admin Interface

[cvillegas1976]

Currently, Nginx Proxy Manager lacks native Active Directory/LDAP integration for admin authentication, forcing enterprises to maintain separate credentials or implement complex workarounds.

Proposed Solution
Implement LDAP/AD authentication for the admin UI with:

• Secure LDAP/LDAPS connectivity
• Group-based role mapping (Admin/User)
• Standard attribute support (sAMAccountName, memberOf, etc.)

Example Configuration

"auth": {
  "ldap": {
    "enabled": true,
    "url": "ldap://ad.example.com:389",
    "bindDN": "cn=admin,dc=example,dc=com",
    "bindCredentials": "secret",
    "userSearchBase": "ou=users,dc=example,dc=com",
    "usernameAttribute": "sAMAccountName",
    "groupSearchBase": "ou=groups,dc=example,dc=com"
  }
}

Key Benefits

✅ Enterprise-ready authentication
✅ Centralized user management
✅ Improved security compliance
✅ Reduced credential fatigue

Additional Context
This would mirror functionality found in:

• Authelia (but more lightweight)
• Portainer's LDAP implementation
• TrueNAS directory services

Willingness to Help
I can:

• Test beta versions in production
• Provide AD server samples
• Assist with documentation

[sergeybezlepkin]

Claudio this is the top feature that NPM is missing, very much looking forward to it, thank you

[gdeeble]

Claudio, does it need to be LDAP or could it be OIDC? I know that there is Pull Request #4010 that is for adding OIDC functionality.

[cvillegas1976]

For my use case, the ideal functionality is direct authentication against AD/LDAP. While OIDC could achieve this, it would require adding an intermediary identity provider (IdP). Moreover, this type of functionality is widely implemented in various systems that require user authentication. El jue, 24 abr 2025 a las 8:54, gdeeble ***@***.***>) escribió:

…

*gdeeble* left a comment (NginxProxyManager/nginx-proxy-manager#4485) <#4485 (comment)> Claudio, does it need to be LDAP or could it be OIDC? I know that there is Pull Request #4010 <#4010> that is for adding OIDC functionality. — Reply to this email directly, view it on GitHub <#4485 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AORI5Q5LWMTEL4KBZJEGCY323DNJXAVCNFSM6AAAAAB3DVYZQOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQMRXGUYTQNZTGQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[gdeeble]

That's fair, I figured I'd make mention incase you had something already in place. I can see LDAP being beneficial though.

[adamoutler]

+1 for this feature. I'd like to have this as it makes Basic Auth very easy to manage.

[darwoodcdn]

+1 This plus a samba AD (Synology Directory Server) makes life easier :)

[aisalem-mtz]

+2 for me and my colleague as well, we would love to have this feature

[brno-git]

+2 for me. Maybe also look at Entra auth, for native passkey/MFA

[Wadera]

Enjoy! #5345

[brno-git]

Is there a guesstimate on when it will be in the official image?

I just made a new pull and can't see it there... yet.
That is v2.14.0 as of writing

[Wadera]

New on GitHub huh? ;-) It can take from minutes to months. It depends of when main project maintainer decide it's worth to merge. Base on just size of that merge (over 5k lines to be added) and that it touches the most critical think which is authentication - I don't think it will be quick process.

But in link you have automated nev forked version build:
nginxproxymanager/nginx-proxy-manager-dev:pr-5345

You can use that for now if you willing to risk it.

[brno-git]

That was the reason I asked for a guestimate.
I can't afford to run test images in production.
But thanks for your answer.

[timothestoifl24]

@cvillegas1976 I completely understand your problem. For authentication in the enterprise environment, it makes sense to connect our applications to existing directory services before having to manage local users everywhere. That's why I've developed a new feature that offers LDAP, SAML, and OAuth support: #5797