Your apps speak LDAP.
Your directory is Monosign.
Plenty of infrastructure still authenticates over LDAP: VPN concentrators, NAS boxes, vSphere, Jira, door systems. The LDAP Gateway presents Monosign to them as an AD-compatible directory (same filters, same attributes) so the app keeps its config and the identity, policy, and audit move to Monosign.
- AD-compatible schema
- Per-app scoping
- MFA over LDAP
From appliance config to governed sign-in.
Five steps. The legacy app never learns anything changed.
- 01
Create the LDAP application in Monosign and assign users
Each connecting system gets its own application with an LDAP key: the key doubles as the service-account bind credential, and the application’s access list decides who may authenticate through it. A user outside the list is refused at bind time, per app.
Tip — This is the audit answer legacy LDAP never had: every appliance is a distinct application with its own user scope and log trail. - 02
Deploy the gateway close to the apps
Run the gateway container on the network segment your LDAP clients live in and point it at your Monosign API. Configuration is environment variables; a health endpoint reports readiness and configuration age for your monitoring.
- 03
Point the app at the gateway
Swap the directory host in the appliance for the gateway address. The service account binds with the application key and secret; users resolve under the application’s own branch of the directory tree, so two apps never see each other’s scope.
Tip — AD-style lookups work as-is: sAMAccountName, objectCategory person/group, objectGUID, objectSid, userPrincipalName, memberOf, plus optional RFC 2307 posix attributes for NAS and Linux PAM/SSSD clients. - 04
Turn on MFA, on a protocol that never had it
User binds can require a second factor: append the OTP or method to the password (password,123456 or password,push), or let the gateway fire an automatic push and wait for approval. Timeouts are configurable, and the default is fail-closed.
Tip — Service-account binds complete with the key secret and never enter the MFA path; the classic "MFA broke the bind account" integration trap is structurally impossible. - 05
Verify with ldapsearch, then cut over
Run your app’s real queries against the gateway: bind as the service account, search by sAMAccountName, check memberOf and paged results. When the responses match what the app expects, change the directory address in production; the rollback is changing it back.
The complete walkthrough — with every screenshot, every flag, and version-specific notes — lives in our help center.
Ready to start managing
identities the right way?
Spin up a fully-loaded trial tenant in under five minutes. No credit card. No sales gate.