Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time group membership in an OpenLDAP directory — adding users to LDAP groups at checkout and removing them at checkin, with no standing group membership.

What you’ll accomplish:

Deploy and configure the Britive Access Broker with access to your OpenLDAP server
Configure checkout and checkin routines from the access-broker-examples repository
Register OpenLDAP as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out group membership and verify end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker with network access to your OpenLDAP server (port 389 or 636)
An LDAP bind DN with sufficient permissions to modify group membership (groupOfNames or posixGroup entries)
ldapmodify available on the broker host

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker runs LDAP operations to manage group membership. At checkout, Britive adds the user’s DN to the target groupOfNames or posixGroup entry. At checkin (or on expiry), the membership is removed — no standing access remains.

User → Britive Console → Access Broker → ldapmodify → OpenLDAP group (add/remove member)

Onboarding the Application

Configure the broker for OpenLDAP group management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under OpenLDAP/permissions/.

Using the Britive Console

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker with your Britive tenant.

Configure the broker scripts

Clone the examples repository and copy the scripts to your broker:

git clone https://github.com/britive/access-broker-examples.git
# Copy OpenLDAP/permissions/ scripts to your broker's scripts directory

Create a bind account

Create an LDAP service account with write access to the target group entries. Store the bind password in the Britive Secrets Store.

Register OpenLDAP in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Define the resource type as OpenLDAP and enter the server hostname and base DN.

Verify broker connectivity

Confirm the broker can reach the OpenLDAP server on port 389 (LDAP) or 636 (LDAPS).

Using Shell

Key environment variables used by the broker scripts:

LDAP_HOST=ldap.example.com
LDAP_PORT=389
LDAP_BASE_DN="dc=example,dc=com"
LDAP_BIND_DN="cn=britive-svc,ou=serviceaccounts,dc=example,dc=com"
LDAP_BIND_PASSWORD=...   # From Britive Secrets Store
LDAP_GROUP_DN="cn=target-group,ou=groups,dc=example,dc=com"
BRITIVE_USER_EMAIL=user@example.com

Refer to the britive/access-broker-examples OpenLDAP/ directory for the full script set.

Using Terraform

resource "britive_resource_manager_resource_type" "openldap" {
  name        = "OpenLDAP"
  description = "OpenLDAP directory server"

  parameters {
    param_name   = "hostname"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "base_dn"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "ldap" {
  name          = "openldap-prod"
  resource_type = britive_resource_manager_resource_type.openldap.name

  parameter_values = {
    hostname = "ldap.example.com"
    base_dn  = "dc=example,dc=com"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `OpenLDAP-VPN-Group`)
Expiration	Set a max session duration (e.g., `8h`)

Associate resources

Under Associations, select the OpenLDAP resource and the target group.

Add a permission

Under Permissions, select the group membership checkout/checkin permission.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "ldap_vpn" {
  name                = "OpenLDAP-VPN-Group"
  expiration_duration = 28800000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "ldap_group" {
  profile_id = britive_resource_manager_profile.ldap_vpn.id
  name       = "OpenLDAP-GroupMembership"
  version    = "latest"

  variables {
    name              = "LDAP_GROUP_DN"
    value             = "cn=vpn-users,ou=groups,dc=example,dc=com"
    is_system_defined = false
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out.

Confirm LDAP group membership

ldapsearch -x -H ldap://ldap.example.com \
  -b "cn=vpn-users,ou=groups,dc=example,dc=com" member

Check in

Return to My Access → click Check In. Run the search again — your user DN should no longer appear.

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails	Broker cannot reach OpenLDAP	Check network connectivity on port 389/636
Membership not added	Bind account lacks write permission	Grant the bind DN `write` access on the target group entry
Membership not removed after checkin	Checkin routine error	Check broker logs; verify `LDAP_GROUP_DN` is correct

Next Steps

Britive documentation

Last updated on July 8, 2026

Manage Group Memberships