Configure MFA for LDAP

If your organization has LDAP applications that require extra security, you can build a Conditional Policy or Global Policy to enable multi-factor authentication (MFA) as a requirement before users can access the applications. 

Prerequisites:

• This article assumes that you have configured LDAP to work with JumpCloud. If not, see Use Cloud LDAP for more information. 
• You must have JumpCloud Protect or TOTP enabled for your users. See the JumpCloud Protect for Admins or Configure TOTP MFA for User Accounts for steps.

Considerations:

• Conditional Access Policies and MFA are not supported for Samba authentications.
  • Conditional Access Policies and MFA can only be supported when a client application BINDs a user’s credentials with the LDAP server directly, which Samba does not do.
• Users are allowed 60 seconds to respond to a JC Protect notification. Most applications have shorter default authentication timeouts, and these can show up as connection errors during BIND requests. We recommend increasing the authentication timeout on your LDAP app to a minimum of 65 seconds to allow for the user to respond to the JC Protect notification.

Configuring MFA for LDAP Applications as a Conditional Policy

To configure MFA for LDAP Applications as a Conditional Policy:

1. Log into the JumpCloud Admin Portal: https://console.jumpcloud.com
2. Navigate to SECURITY MANAGEMENT > Conditional Policies.
3. Click the green + button and select JumpCloud LDAP.
   
4. Ensure that your LDAP hostname is updated and click the I have updated the LDAP hostname for applications I want affected by this policy checkbox.

5. Enter the policy name and an optional description.
6. (Optional) If you do not wish for the policy to go live as soon as you finish creating it, move the Policy Status slider to OFF.
7. Under Assignments, you can choose to apply the policy to all users or select user groups. You can also specify whether to exclude certain user groups as needed.

8. Under Action, for Access select the Allowed button, and for Authentication, select the Password + MFA button.

9. Click create policy. You will see the main policies page, and your LDAP policy will appear in that list.

Configuring MFA for LDAP Applications as a Global Policy

A Global Policy Setting determines how users access a resource when no Conditional access policies apply to them.

To configure MFA for LDAP applications as a global policy:

1. Log into the JumpCloud Admin Portal: https://console.jumpcloud.com
2. Navigate to SECURITY MANAGEMENT > Conditional Policies.
3. Click the Settings gear icon in the top right corner.
4. Expand Global Policy Settings.
5. Under JumpCloud LDAP, in the drop down menu, select Allow authentication & require MFA.
   

6. Click save. MFA has now been enabled for LDAP applications. 

Logging in to LDAP Applications with MFA

Instructions for users logging into LDAP applications with MFA

• JumpCloud Protect: Once LDAP MFA has been enabled, users will receive a push notification on their device when they are authenticating into certain applications. Once the user enters their user name and password, they will get a push notification and should approve it.
• TOTP: Once LDAP MFA has been enabled, users will need to open their authenticator app to get a verification code when authenticating into certain applications.
  • When users are entering their username and password, in the password field they will add a comma, then enter the 6 digit TOTP after their JumpCloud password. For example, a user with a password of MyB@dPa33word and a TOTP of 123456 would enter MyB@dPa33word,1203456 in the password field.