LDAP/SSO¶

SentriKat supports LDAP/Active Directory authentication and SAML 2.0 Single Sign-On for enterprise environments.

LDAP / Active Directory¶

Configuration¶

Configure LDAP via environment variables in your .env file:

LDAP_ENABLED=true
LDAP_SERVER=ldap://ldap.example.com
LDAP_PORT=636
LDAP_BIND_DN=cn=sentrikat,ou=services,dc=example,dc=com
LDAP_BIND_PASSWORD=your-bind-password
LDAP_BASE_DN=ou=users,dc=example,dc=com

These six variables are the ones overridable from the environment. All other LDAP options (SSL mode, user filter, group mappings) are configured from the web UI and stored in the database.

After setting these variables, restart SentriKat:

docker compose restart sentrikat

Environment Variables¶

All other LDAP options (user filter, group bases/filters, TLS client certificates) are configured from the web UI (Admin > Settings > LDAP) and stored in the database — they are not read from the environment.

Active Directory Example¶

For Microsoft Active Directory, use these settings:

LDAP_ENABLED=true
LDAP_SERVER=ldaps://dc01.corp.example.com
LDAP_PORT=636
LDAP_BIND_DN=CN=SentriKat Service,OU=Service Accounts,DC=corp,DC=example,DC=com
LDAP_BIND_PASSWORD=your-bind-password
LDAP_BASE_DN=DC=corp,DC=example,DC=com

Set the AD-specific user filter ((sAMAccountName={username})) and the group bases/filters from Admin > Settings > LDAP.

Group-to-Role Mapping¶

Map LDAP/AD groups to SentriKat roles in Admin > Settings > LDAP > Group Mapping:

If a user does not belong to any mapped group, they are assigned the default role configured in Admin > Settings > LDAP > Default Role.

Testing LDAP¶

Validate your LDAP configuration before enabling it for all users:

# Test from within the Docker container
docker compose exec sentrikat flask ldap test

# Or test via the admin panel
# Admin > Settings > LDAP > Test Connection

Expected output:

LDAP Connection: OK
Bind: OK
User Search (test): Found 1 result
Group Search: Found 3 groups

SAML 2.0 SSO¶

Overview¶

SentriKat acts as a SAML 2.0 Service Provider (SP). You configure your Identity Provider (IdP) to trust SentriKat and send signed assertions.

Supported Identity Providers¶

SentriKat has been tested with:

• Microsoft Entra ID (Azure AD)
• Okta
• Google Workspace
• Keycloak
• ADFS

SentriKat SP Metadata¶

Your SentriKat instance exposes SP metadata at:

https://sentrikat.example.com/auth/saml/metadata

Provide this URL to your IdP when configuring the trust relationship.

IdP Configuration¶

SentriKat SAML Settings¶

Configure SAML in your .env file:

SAML_ENABLED=true
SAML_IDP_METADATA_URL=https://login.microsoftonline.com/.../federationmetadata/2007-06/federationmetadata.xml
SAML_ENTITY_ID=https://sentrikat.example.com/auth/saml/metadata
SAML_ACS_URL=https://sentrikat.example.com/auth/saml/acs
SAML_CERT_FILE=/certs/saml-sp.crt
SAML_KEY_FILE=/certs/saml-sp.key

Enabling SSO¶

1. Configure the environment variables above
2. Restart SentriKat: docker compose restart sentrikat
3. Go to Admin > Settings > Authentication
4. Enable SAML SSO
5. Optionally, check Enforce SSO to disable local password login for non-admin users

TOTP Two-Factor Authentication¶

SentriKat supports Time-based One-Time Password (TOTP) two-factor authentication for all user accounts, including local, LDAP, and SSO users.

Enabling TOTP¶

Global Enforcement¶

Require all users to set up TOTP:

1. Go to Admin > Settings > Authentication
2. Enable Require Two-Factor Authentication
3. Save

Users will be prompted to set up TOTP on their next login.

Per-User Setup¶

Individual users can enable TOTP from their profile:

1. Go to Profile > Security
2. Click Enable Two-Factor Authentication
3. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.)
4. Enter the verification code to confirm
5. Save recovery codes in a secure location

Supported Authenticator Apps¶

Any TOTP-compatible authenticator works:

• Google Authenticator
• Microsoft Authenticator
• Authy
• 1Password
• Bitwarden

Recovery¶

If a user loses access to their authenticator:

1. An admin can disable TOTP for the user in Admin > Users > Select user > Disable 2FA
2. The user can use a recovery code (generated during setup)

Hybrid Authentication¶

You can enable both LDAP and SAML simultaneously. SentriKat resolves authentication in this order:

1. SAML SSO (if user clicks "Sign in with SSO")
2. LDAP bind (if LDAP is configured)
3. Local database (fallback)

Next Steps¶

• Manage users and roles
• Configure organizations for LDAP-synced users
• Set up notifications for alert delivery