LDAP/SSO¶

SentriKat supports LDAP/Active Directory authentication and SAML 2.0 Single Sign-On for enterprise environments.

LDAP / Active Directory¶

Configuration¶

Configure LDAP via environment variables in your .env file:

LDAP_ENABLED=true
LDAP_SERVER=ldap://ldap.example.com
LDAP_PORT=636
LDAP_BIND_DN=cn=sentrikat,ou=services,dc=example,dc=com
LDAP_BIND_PASSWORD=your-bind-password
LDAP_BASE_DN=ou=users,dc=example,dc=com

These six variables are the ones overridable from the environment. All other LDAP options (SSL mode, user filter, group mappings) are configured from the web UI and stored in the database.

After setting these variables, restart SentriKat:

docker compose restart sentrikat

Environment Variables¶

All other LDAP options (user filter, group bases/filters, TLS client certificates) are configured from the web UI (Settings > Authentication) and stored in the database. They are not read from the environment.

Active Directory Example¶

For Microsoft Active Directory, use these settings:

LDAP_ENABLED=true
LDAP_SERVER=ldaps://dc01.corp.example.com
LDAP_PORT=636
LDAP_BIND_DN=CN=SentriKat Service,OU=Service Accounts,DC=corp,DC=example,DC=com
LDAP_BIND_PASSWORD=your-bind-password
LDAP_BASE_DN=DC=corp,DC=example,DC=com

Set the AD-specific user filter ((sAMAccountName={username})) and the group bases/filters from Settings > Authentication.

Group-to-Role Mapping¶

Map LDAP/AD groups to SentriKat roles in Settings > Authentication:

If a user does not belong to any mapped group, they are assigned the default role, configured on the same Settings > Authentication page.

Testing LDAP¶

Validate your LDAP configuration before enabling it for all users:

# Test from within the Docker container
docker compose exec sentrikat flask ldap test

# Or test via the admin panel
# Settings > Authentication > Test Connection

Expected output:

LDAP Connection: OK
Bind: OK
User Search (test): Found 1 result
Group Search: Found 3 groups

SAML 2.0 SSO¶

Overview¶

SentriKat acts as a SAML 2.0 Service Provider (SP). You configure your Identity Provider (IdP) to trust SentriKat and send signed assertions.

Supported Identity Providers¶

SentriKat has been tested with:

• Microsoft Entra ID (Azure AD)
• Okta
• Google Workspace
• Keycloak
• ADFS

SentriKat SP Metadata¶

Your SentriKat instance exposes SP metadata at:

https://sentrikat.example.com/api/saml/metadata

Provide this URL to your IdP when configuring the trust relationship.

IdP Configuration¶

SentriKat SAML Settings¶

SAML is configured in the application, not in .env. Unlike LDAP (which has six environment overrides, listed above), SAML has none: the settings live in the database and are edited from the admin UI, so a change takes effect without a restart.

1. Go to Settings > Authentication
2. Enable SAML SSO
3. Paste your IdP's metadata XML into IdP Metadata
4. Set the Service Provider fields to match what you registered with the IdP:
   • SP Entity ID: https://sentrikat.example.com/api/saml/metadata
   • SP ACS URL: https://sentrikat.example.com/saml/acs
   • SP SLS URL: https://sentrikat.example.com/saml/sls
5. Use Test Connection before saving

The SP metadata SentriKat publishes for your IdP is served at /api/saml/metadata. 5. Optionally, check Enforce SSO to disable local password login for non-admin users

TOTP Two-Factor Authentication¶

SentriKat supports Time-based One-Time Password (TOTP) two-factor authentication for all user accounts, including local, LDAP, and SSO users.

Enabling TOTP¶

Global Enforcement¶

Require all users to set up TOTP:

1. Go to Settings > Authentication
2. Enable Require Two-Factor Authentication
3. Save

Users will be prompted to set up TOTP on their next login.

Per-User Setup¶

Individual users can enable TOTP from their profile:

1. Go to Profile > Security
2. Click Enable Two-Factor Authentication
3. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.)
4. Enter the verification code to confirm

Supported Authenticator Apps¶

Any TOTP-compatible authenticator works:

• Google Authenticator
• Microsoft Authenticator
• Authy
• 1Password
• Bitwarden

Recovery¶

If a user loses access to their authenticator:

An administrator disables TOTP for that user in Users & Access > select the user > Disable 2FA, and the user then enrols a new authenticator.

Hybrid Authentication¶

You can enable both LDAP and SAML simultaneously. SentriKat resolves authentication in this order:

1. SAML SSO (if user clicks "Sign in with SSO")
2. LDAP bind (if LDAP is configured)
3. Local database (fallback)

Next Steps¶

• Manage users and roles
• Configure organizations for LDAP-synced users
• Set up notifications for alert delivery