LDAP / Active Directory

Authenticate your team against an existing LDAP or Active Directory server so every developer can sign in to the code review platform with their corporate credentials — accounts are created automatically on first login, ready to be assigned as code review participants.

Prerequisites

An LDAP server (OpenLDAP, Active Directory, FreeIPA, etc.) reachable from the Codeveira Docker container
A bind account (read-only service account) with permission to search the directory
The base DN of your user objects

LDAP login works alongside regular email/password login and OAuth (GitLab, GitHub). Users can use any method that is configured — once authenticated, they immediately have access to all code reviews they are assigned to.

Configure environment variables

Add the following variables to your .env file. LDAP is enabled automatically when LDAP_HOST is set.

# LDAP server hostname or IP
LDAP_HOST=ldap.example.com

# Port — 389 for plain/STARTTLS, 636 for LDAPS
LDAP_PORT=389

# Base DN to search for users
LDAP_BASE=ou=people,dc=example,dc=com

# Bind DN — service account for searching
LDAP_BIND_DN=cn=service,dc=example,dc=com

# Bind password
LDAP_PASSWORD=service_account_password

# Domain suffix used to build email if the LDAP entry has no 'mail' attribute
LDAP_DOMAIN=example.com

Then restart the application:

docker compose restart app

Use a dedicated read-only service account for LDAP_BIND_DN. It only needs search/read permission on the user subtree.

Active Directory

For Active Directory, the bind DN is typically the user's UPN or sAMAccountName:

LDAP_HOST=dc.example.com
LDAP_PORT=389
LDAP_BASE=CN=Users,DC=example,DC=com
LDAP_BIND_DN=CN=svc-codeveira,CN=Users,DC=example,DC=com
LDAP_PASSWORD=service_account_password
LDAP_DOMAIN=example.com

Codeveira searches users by uid attribute. For Active Directory, uid maps to the sAMAccountName (login name without domain).

Test the login

Open the Codeveira login page. You should see a standard email/password form — LDAP does not add a separate button. Enter the LDAP username (the uid / sAMAccountName) and the LDAP password.

On first successful login, Codeveira creates a local user account populated from the LDAP entry and grants immediate access to the code review queue:

Username — from uid
Display name — from cn
Email — from mail attribute, or uid@LDAP_DOMAIN if absent

Subsequent logins re-authenticate against LDAP each time. If the LDAP password changes, the new password works immediately — no manual sync needed.

Environment variable reference

Variable	Required	Description
LDAP_HOST	required	LDAP server hostname or IP. Setting this variable enables LDAP authentication.
LDAP_PORT	optional	LDAP port. Default: `389`. Use `636` for LDAPS.
LDAP_BASE	required	Search base DN, e.g. `ou=people,dc=example,dc=com`.
LDAP_BIND_DN	required	DN of the service account used to search the directory.
LDAP_PASSWORD	required	Password for the bind account.
LDAP_DOMAIN	optional	Domain suffix appended to the username to build an email address when the LDAP entry has no `mail` attribute.

Troubleshooting

"Invalid email or password" — LDAP bind failed. Check LDAP_BIND_DN and LDAP_PASSWORD. Verify reachability: docker compose exec app nc -zv $LDAP_HOST $LDAP_PORT
User not found — the uid attribute doesn't match. For Active Directory use the sAMAccountName (short login name, no domain prefix).
Email taken error — another account already uses the email Codeveira derived from LDAP. Set LDAP_DOMAIN to a unique domain or clean up the duplicate account.
Connection refused — firewall blocking port 389/636 from the Docker network to the LDAP host. Add an allow rule or use the Docker host IP.

← Installation All docs →