feat: ldap provider login (#5448)

Add the logic to configure and use LDAP provider as an external IDP with a dedicated login GUI.

internal/command/idp.go

@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"time"
 
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/command/preparation"
@@ -94,17 +95,18 @@ type GoogleProvider struct {
 }
 
 type LDAPProvider struct {
-	Name                string
-	Host                string
-	Port                string
-	TLS                 bool
-	BaseDN              string
-	UserObjectClass     string
-	UserUniqueAttribute string
-	Admin               string
-	Password            string
-	LDAPAttributes      idp.LDAPAttributes
-	IDPOptions          idp.Options
+	Name              string
+	Servers           []string
+	StartTLS          bool
+	BaseDN            string
+	BindDN            string
+	BindPassword      string
+	UserBase          string
+	UserObjectClasses []string
+	UserFilters       []string
+	Timeout           time.Duration
+	LDAPAttributes    idp.LDAPAttributes
+	IDPOptions        idp.Options
 }
 
 func ExistsIDP(ctx context.Context, filter preparation.FilterToQueryReducer, id, orgID string) (exists bool, err error) {

internal/command/idp_model.go

@@ -2,6 +2,7 @@ package command
 
 import (
 	"reflect"
+	"time"
 
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
@@ -999,16 +1000,17 @@ func (wm *GoogleIDPWriteModel) NewChanges(
 type LDAPIDPWriteModel struct {
 	eventstore.WriteModel
 
-	ID                  string
-	Name                string
-	Host                string
-	Port                string
-	TLS                 bool
-	BaseDN              string
-	UserObjectClass     string
-	UserUniqueAttribute string
-	Admin               string
-	Password            *crypto.CryptoValue
+	ID                string
+	Name              string
+	Servers           []string
+	StartTLS          bool
+	BaseDN            string
+	BindDN            string
+	BindPassword      *crypto.CryptoValue
+	UserBase          string
+	UserObjectClasses []string
+	UserFilters       []string
+	Timeout           time.Duration
 	idp.LDAPAttributes
 	idp.Options
 
@@ -1040,14 +1042,15 @@ func (wm *LDAPIDPWriteModel) Reduce() error {
 
 func (wm *LDAPIDPWriteModel) reduceAddedEvent(e *idp.LDAPIDPAddedEvent) {
 	wm.Name = e.Name
-	wm.Host = e.Host
-	wm.Port = e.Port
-	wm.TLS = e.TLS
+	wm.Servers = e.Servers
+	wm.StartTLS = e.StartTLS
 	wm.BaseDN = e.BaseDN
-	wm.UserObjectClass = e.UserObjectClass
-	wm.UserUniqueAttribute = e.UserUniqueAttribute
-	wm.Admin = e.Admin
-	wm.Password = e.Password
+	wm.BindDN = e.BindDN
+	wm.BindPassword = e.BindPassword
+	wm.UserBase = e.UserBase
+	wm.UserObjectClasses = e.UserObjectClasses
+	wm.UserFilters = e.UserFilters
+	wm.Timeout = e.Timeout
 	wm.LDAPAttributes = e.LDAPAttributes
 	wm.Options = e.Options
 	wm.State = domain.IDPStateActive
@@ -1060,44 +1063,48 @@ func (wm *LDAPIDPWriteModel) reduceChangedEvent(e *idp.LDAPIDPChangedEvent) {
 	if e.Name != nil {
 		wm.Name = *e.Name
 	}
-	if e.Host != nil {
-		wm.Host = *e.Host
+	if e.Servers != nil {
+		wm.Servers = e.Servers
 	}
-	if e.Port != nil {
-		wm.Port = *e.Port
-	}
-	if e.TLS != nil {
-		wm.TLS = *e.TLS
+	if e.StartTLS != nil {
+		wm.StartTLS = *e.StartTLS
 	}
 	if e.BaseDN != nil {
 		wm.BaseDN = *e.BaseDN
 	}
-	if e.UserObjectClass != nil {
-		wm.UserObjectClass = *e.UserObjectClass
+	if e.BindDN != nil {
+		wm.BindDN = *e.BindDN
 	}
-	if e.UserUniqueAttribute != nil {
-		wm.UserUniqueAttribute = *e.UserUniqueAttribute
+	if e.BindPassword != nil {
+		wm.BindPassword = e.BindPassword
 	}
-	if e.Admin != nil {
-		wm.Admin = *e.Admin
+	if e.UserBase != nil {
+		wm.UserBase = *e.UserBase
 	}
-	if e.Password != nil {
-		wm.Password = e.Password
+	if e.UserObjectClasses != nil {
+		wm.UserObjectClasses = e.UserObjectClasses
+	}
+	if e.UserFilters != nil {
+		wm.UserFilters = e.UserFilters
+	}
+	if e.Timeout != nil {
+		wm.Timeout = *e.Timeout
 	}
 	wm.LDAPAttributes.ReduceChanges(e.LDAPAttributeChanges)
 	wm.Options.ReduceChanges(e.OptionChanges)
 }
 
 func (wm *LDAPIDPWriteModel) NewChanges(
-	name,
-	host,
-	port string,
-	tls bool,
-	baseDN,
-	userObjectClass,
-	userUniqueAttribute,
-	admin string,
-	password string,
+	name string,
+	servers []string,
+	startTLS bool,
+	baseDN string,
+	bindDN string,
+	bindPassword string,
+	userBase string,
+	userObjectClasses []string,
+	userFilters []string,
+	timeout time.Duration,
 	secretCrypto crypto.Crypto,
 	attributes idp.LDAPAttributes,
 	options idp.Options,
@@ -1105,36 +1112,39 @@ func (wm *LDAPIDPWriteModel) NewChanges(
 	changes := make([]idp.LDAPIDPChanges, 0)
 	var cryptedPassword *crypto.CryptoValue
 	var err error
-	if password != "" {
-		cryptedPassword, err = crypto.Crypt([]byte(password), secretCrypto)
+	if bindPassword != "" {
+		cryptedPassword, err = crypto.Crypt([]byte(bindPassword), secretCrypto)
 		if err != nil {
 			return nil, err
 		}
-		changes = append(changes, idp.ChangeLDAPPassword(cryptedPassword))
+		changes = append(changes, idp.ChangeLDAPBindPassword(cryptedPassword))
 	}
 	if wm.Name != name {
 		changes = append(changes, idp.ChangeLDAPName(name))
 	}
-	if wm.Host != host {
-		changes = append(changes, idp.ChangeLDAPHost(host))
+	if !reflect.DeepEqual(wm.Servers, servers) {
+		changes = append(changes, idp.ChangeLDAPServers(servers))
 	}
-	if wm.Port != port {
-		changes = append(changes, idp.ChangeLDAPPort(port))
-	}
-	if wm.TLS != tls {
-		changes = append(changes, idp.ChangeLDAPTLS(tls))
+	if wm.StartTLS != startTLS {
+		changes = append(changes, idp.ChangeLDAPStartTLS(startTLS))
 	}
 	if wm.BaseDN != baseDN {
 		changes = append(changes, idp.ChangeLDAPBaseDN(baseDN))
 	}
-	if wm.UserObjectClass != userObjectClass {
-		changes = append(changes, idp.ChangeLDAPUserObjectClass(userObjectClass))
+	if wm.BindDN != bindDN {
+		changes = append(changes, idp.ChangeLDAPBindDN(bindDN))
 	}
-	if wm.UserUniqueAttribute != userUniqueAttribute {
-		changes = append(changes, idp.ChangeLDAPUserUniqueAttribute(userUniqueAttribute))
+	if wm.UserBase != userBase {
+		changes = append(changes, idp.ChangeLDAPUserBase(userBase))
 	}
-	if wm.Admin != admin {
-		changes = append(changes, idp.ChangeLDAPAdmin(admin))
+	if !reflect.DeepEqual(wm.UserObjectClasses, userObjectClasses) {
+		changes = append(changes, idp.ChangeLDAPUserObjectClasses(userObjectClasses))
+	}
+	if !reflect.DeepEqual(wm.UserFilters, userFilters) {
+		changes = append(changes, idp.ChangeLDAPUserFilters(userFilters))
+	}
+	if wm.Timeout != timeout {
+		changes = append(changes, idp.ChangeLDAPTimeout(timeout))
 	}
 	attrs := wm.LDAPAttributes.Changes(attributes)
 	if !attrs.IsZero() {

internal/command/instance_idp.go

@@ -1278,23 +1278,26 @@ func (c *Commands) prepareAddInstanceLDAPProvider(a *instance.Aggregate, writeMo
 		if provider.Name = strings.TrimSpace(provider.Name); provider.Name == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-SAfdd", "Errors.Invalid.Argument")
 		}
-		if provider.Host = strings.TrimSpace(provider.Host); provider.Host == "" {
-			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-SDVg2", "Errors.Invalid.Argument")
-		}
 		if provider.BaseDN = strings.TrimSpace(provider.BaseDN); provider.BaseDN == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-sv31s", "Errors.Invalid.Argument")
 		}
-		if provider.UserObjectClass = strings.TrimSpace(provider.UserObjectClass); provider.UserObjectClass == "" {
+		if provider.BindDN = strings.TrimSpace(provider.BindDN); provider.BindDN == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-sdgf4", "Errors.Invalid.Argument")
 		}
-		if provider.UserUniqueAttribute = strings.TrimSpace(provider.UserUniqueAttribute); provider.UserUniqueAttribute == "" {
+		if provider.BindPassword = strings.TrimSpace(provider.BindPassword); provider.BindPassword == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-AEG2w", "Errors.Invalid.Argument")
 		}
-		if provider.Admin = strings.TrimSpace(provider.Admin); provider.Admin == "" {
+		if provider.UserBase = strings.TrimSpace(provider.UserBase); provider.UserBase == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-SAD5n", "Errors.Invalid.Argument")
 		}
-		if provider.Password = strings.TrimSpace(provider.Password); provider.Password == "" {
-			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-sdf5h", "Errors.Invalid.Argument")
+		if len(provider.Servers) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-SAx905n", "Errors.Invalid.Argument")
+		}
+		if len(provider.UserObjectClasses) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-S1x905n", "Errors.Invalid.Argument")
+		}
+		if len(provider.UserFilters) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-aAx905n", "Errors.Invalid.Argument")
 		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			events, err := filter(ctx, writeModel.Query())
@@ -1305,7 +1308,7 @@ func (c *Commands) prepareAddInstanceLDAPProvider(a *instance.Aggregate, writeMo
 			if err = writeModel.Reduce(); err != nil {
 				return nil, err
 			}
-			secret, err := crypto.Encrypt([]byte(provider.Password), c.idpConfigEncryption)
+			secret, err := crypto.Encrypt([]byte(provider.BindPassword), c.idpConfigEncryption)
 			if err != nil {
 				return nil, err
 			}
@@ -1315,14 +1318,15 @@ func (c *Commands) prepareAddInstanceLDAPProvider(a *instance.Aggregate, writeMo
 					&a.Aggregate,
 					writeModel.ID,
 					provider.Name,
-					provider.Host,
-					provider.Port,
-					provider.TLS,
+					provider.Servers,
+					provider.StartTLS,
 					provider.BaseDN,
-					provider.UserObjectClass,
-					provider.UserUniqueAttribute,
-					provider.Admin,
+					provider.BindDN,
 					secret,
+					provider.UserBase,
+					provider.UserObjectClasses,
+					provider.UserFilters,
+					provider.Timeout,
 					provider.LDAPAttributes,
 					provider.IDPOptions,
 				),
@@ -1339,21 +1343,24 @@ func (c *Commands) prepareUpdateInstanceLDAPProvider(a *instance.Aggregate, writ
 		if provider.Name = strings.TrimSpace(provider.Name); provider.Name == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-Sffgd", "Errors.Invalid.Argument")
 		}
-		if provider.Host = strings.TrimSpace(provider.Host); provider.Host == "" {
-			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-Dz62d", "Errors.Invalid.Argument")
-		}
 		if provider.BaseDN = strings.TrimSpace(provider.BaseDN); provider.BaseDN == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-vb3ss", "Errors.Invalid.Argument")
 		}
-		if provider.UserObjectClass = strings.TrimSpace(provider.UserObjectClass); provider.UserObjectClass == "" {
+		if provider.BindDN = strings.TrimSpace(provider.BindDN); provider.BindDN == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-hbere", "Errors.Invalid.Argument")
 		}
-		if provider.UserUniqueAttribute = strings.TrimSpace(provider.UserUniqueAttribute); provider.UserUniqueAttribute == "" {
-			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-ASFt6", "Errors.Invalid.Argument")
-		}
-		if provider.Admin = strings.TrimSpace(provider.Admin); provider.Admin == "" {
+		if provider.UserBase = strings.TrimSpace(provider.UserBase); provider.UserBase == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-DG45z", "Errors.Invalid.Argument")
 		}
+		if len(provider.Servers) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-SAx945n", "Errors.Invalid.Argument")
+		}
+		if len(provider.UserObjectClasses) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-S1x605n", "Errors.Invalid.Argument")
+		}
+		if len(provider.UserFilters) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-aAx901n", "Errors.Invalid.Argument")
+		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			events, err := filter(ctx, writeModel.Query())
 			if err != nil {
@@ -1370,16 +1377,16 @@ func (c *Commands) prepareUpdateInstanceLDAPProvider(a *instance.Aggregate, writ
 				ctx,
 				&a.Aggregate,
 				writeModel.ID,
-				writeModel.Name,
 				provider.Name,
-				provider.Host,
-				provider.Port,
-				provider.TLS,
+				provider.Servers,
+				provider.StartTLS,
 				provider.BaseDN,
-				provider.UserObjectClass,
-				provider.UserUniqueAttribute,
-				provider.Admin,
-				provider.Password,
+				provider.BindDN,
+				provider.BindPassword,
+				provider.UserBase,
+				provider.UserObjectClasses,
+				provider.UserFilters,
+				provider.Timeout,
 				c.idpConfigEncryption,
 				provider.LDAPAttributes,
 				provider.IDPOptions,

internal/command/instance_idp_model.go

@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"time"
 
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/eventstore"
@@ -744,16 +745,16 @@ func (wm *InstanceLDAPIDPWriteModel) NewChangedEvent(
 	ctx context.Context,
 	aggregate *eventstore.Aggregate,
 	id,
-	oldName,
-	name,
-	host,
-	port string,
-	tls bool,
-	baseDN,
-	userObjectClass,
-	userUniqueAttribute,
-	admin string,
-	password string,
+	name string,
+	servers []string,
+	startTLS bool,
+	baseDN string,
+	bindDN string,
+	bindPassword string,
+	userBase string,
+	userObjectClasses []string,
+	userFilters []string,
+	timeout time.Duration,
 	secretCrypto crypto.Crypto,
 	attributes idp.LDAPAttributes,
 	options idp.Options,
@@ -761,14 +762,15 @@ func (wm *InstanceLDAPIDPWriteModel) NewChangedEvent(
 
 	changes, err := wm.LDAPIDPWriteModel.NewChanges(
 		name,
-		host,
-		port,
-		tls,
+		servers,
+		startTLS,
 		baseDN,
-		userObjectClass,
-		userUniqueAttribute,
-		admin,
-		password,
+		bindDN,
+		bindPassword,
+		userBase,
+		userObjectClasses,
+		userFilters,
+		timeout,
 		secretCrypto,
 		attributes,
 		options,
@@ -776,7 +778,7 @@ func (wm *InstanceLDAPIDPWriteModel) NewChangedEvent(
 	if err != nil || len(changes) == 0 {
 		return nil, err
 	}
-	return instance.NewLDAPIDPChangedEvent(ctx, aggregate, id, oldName, changes)
+	return instance.NewLDAPIDPChangedEvent(ctx, aggregate, id, changes)
 }
 
 type InstanceIDPRemoveWriteModel struct {

internal/command/instance_idp_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"testing"
+	"time"
 
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
@@ -18,7 +19,6 @@ import (
 	"github.com/zitadel/zitadel/internal/id"
 	id_mock "github.com/zitadel/zitadel/internal/id/mock"
 	"github.com/zitadel/zitadel/internal/repository/idp"
-	"github.com/zitadel/zitadel/internal/repository/idpconfig"
 	"github.com/zitadel/zitadel/internal/repository/instance"
 )
 
@@ -3677,24 +3677,6 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 				},
 			},
 		},
-		{
-			"invalid host",
-			fields{
-				eventstore:  eventstoreExpect(t),
-				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-			},
-			args{
-				ctx: authz.WithInstanceID(context.Background(), "instance1"),
-				provider: LDAPProvider{
-					Name: "name",
-				},
-			},
-			res{
-				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-SDVg2", ""))
-				},
-			},
-		},
 		{
 			"invalid baseDN",
 			fields{
@@ -3705,7 +3687,6 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				provider: LDAPProvider{
 					Name: "name",
-					Host: "host",
 				},
 			},
 			res{
@@ -3715,7 +3696,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid userObjectClass",
+			"invalid bindDN",
 			fields{
 				eventstore:  eventstoreExpect(t),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3724,7 +3705,6 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				provider: LDAPProvider{
 					Name:   "name",
-					Host:   "host",
 					BaseDN: "baseDN",
 				},
 			},
@@ -3735,7 +3715,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid userUniqueAttribute",
+			"invalid bindPassword",
 			fields{
 				eventstore:  eventstoreExpect(t),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3743,10 +3723,9 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				provider: LDAPProvider{
-					Name:            "name",
-					Host:            "host",
-					BaseDN:          "baseDN",
-					UserObjectClass: "userObjectClass",
+					Name:   "name",
+					BindDN: "binddn",
+					BaseDN: "baseDN",
 				},
 			},
 			res{
@@ -3756,7 +3735,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid admin",
+			"invalid userBase",
 			fields{
 				eventstore:  eventstoreExpect(t),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3764,11 +3743,10 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
+					Name:         "name",
+					BindDN:       "binddn",
+					BaseDN:       "baseDN",
+					BindPassword: "password",
 				},
 			},
 			res{
@@ -3778,7 +3756,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid password",
+			"invalid servers",
 			fields{
 				eventstore:  eventstoreExpect(t),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3786,17 +3764,63 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
+					Name:         "name",
+					BindDN:       "binddn",
+					BaseDN:       "baseDN",
+					BindPassword: "password",
+					UserBase:     "user",
 				},
 			},
 			res{
 				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-sdf5h", ""))
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-SAx905n", ""))
+				},
+			},
+		},
+		{
+			"invalid userObjectClasses",
+			fields{
+				eventstore:  eventstoreExpect(t),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
+			},
+			args{
+				ctx: authz.WithInstanceID(context.Background(), "instance1"),
+				provider: LDAPProvider{
+					Name:         "name",
+					Servers:      []string{"server"},
+					BindDN:       "binddn",
+					BaseDN:       "baseDN",
+					BindPassword: "password",
+					UserBase:     "user",
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-S1x905n", ""))
+				},
+			},
+		},
+		{
+			"invalid userFilters",
+			fields{
+				eventstore:  eventstoreExpect(t),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
+			},
+			args{
+				ctx: authz.WithInstanceID(context.Background(), "instance1"),
+				provider: LDAPProvider{
+					Name:              "name",
+					Servers:           []string{"server"},
+					BindDN:            "binddn",
+					BaseDN:            "baseDN",
+					BindPassword:      "password",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-aAx905n", ""))
 				},
 			},
 		},
@@ -3812,24 +3836,24 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 								instance.NewLDAPIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate,
 									"id1",
 									"name",
-									"host",
-									"",
+									[]string{"server"},
 									false,
 									"baseDN",
-									"userObjectClass",
-									"userUniqueAttribute",
-									"admin",
+									"dn",
 									&crypto.CryptoValue{
 										CryptoType: crypto.TypeEncryption,
 										Algorithm:  "enc",
 										KeyID:      "id",
 										Crypted:    []byte("password"),
 									},
+									"user",
+									[]string{"object"},
+									[]string{"filter"},
+									time.Second*30,
 									idp.LDAPAttributes{},
 									idp.Options{},
 								)),
 						},
-						uniqueConstraintsFromEventConstraintWithInstanceID("instance1", idpconfig.NewAddIDPConfigNameUniqueConstraint("name", "instance1")),
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3838,13 +3862,16 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
-					Password:            "password",
+					Name:              "name",
+					Servers:           []string{"server"},
+					StartTLS:          false,
+					BaseDN:            "baseDN",
+					BindDN:            "dn",
+					BindPassword:      "password",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+					UserFilters:       []string{"filter"},
+					Timeout:           time.Second * 30,
 				},
 			},
 			res: res{
@@ -3864,19 +3891,20 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 								instance.NewLDAPIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate,
 									"id1",
 									"name",
-									"host",
-									"port",
-									true,
+									[]string{"server"},
+									false,
 									"baseDN",
-									"userObjectClass",
-									"userUniqueAttribute",
-									"admin",
+									"dn",
 									&crypto.CryptoValue{
 										CryptoType: crypto.TypeEncryption,
 										Algorithm:  "enc",
 										KeyID:      "id",
 										Crypted:    []byte("password"),
 									},
+									"user",
+									[]string{"object"},
+									[]string{"filter"},
+									time.Second*30,
 									idp.LDAPAttributes{
 										IDAttribute:                "id",
 										FirstNameAttribute:         "firstName",
@@ -3900,7 +3928,6 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 									},
 								)),
 						},
-						uniqueConstraintsFromEventConstraintWithInstanceID("instance1", idpconfig.NewAddIDPConfigNameUniqueConstraint("name", "instance1")),
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3909,15 +3936,16 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) {
 			args: args{
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					Port:                "port",
-					TLS:                 true,
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
-					Password:            "password",
+					Name:              "name",
+					Servers:           []string{"server"},
+					StartTLS:          false,
+					BaseDN:            "baseDN",
+					BindDN:            "dn",
+					BindPassword:      "password",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+					UserFilters:       []string{"filter"},
+					Timeout:           time.Second * 30,
 					LDAPAttributes: idp.LDAPAttributes{
 						IDAttribute:                "id",
 						FirstNameAttribute:         "firstName",
@@ -4020,24 +4048,6 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 				},
 			},
 		},
-		{
-			"invalid host",
-			fields{
-				eventstore: eventstoreExpect(t),
-			},
-			args{
-				ctx: authz.WithInstanceID(context.Background(), "instance1"),
-				id:  "id1",
-				provider: LDAPProvider{
-					Name: "name",
-				},
-			},
-			res{
-				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-Dz62d", ""))
-				},
-			},
-		},
 		{
 			"invalid baseDN",
 			fields{
@@ -4048,7 +4058,6 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 				id:  "id1",
 				provider: LDAPProvider{
 					Name: "name",
-					Host: "host",
 				},
 			},
 			res{
@@ -4058,7 +4067,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid userObjectClass",
+			"invalid bindDN",
 			fields{
 				eventstore: eventstoreExpect(t),
 			},
@@ -4067,7 +4076,6 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 				id:  "id1",
 				provider: LDAPProvider{
 					Name:   "name",
-					Host:   "host",
 					BaseDN: "baseDN",
 				},
 			},
@@ -4078,7 +4086,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid userUniqueAttribute",
+			"invalid userbase",
 			fields{
 				eventstore: eventstoreExpect(t),
 			},
@@ -4086,32 +4094,9 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				id:  "id1",
 				provider: LDAPProvider{
-					Name:            "name",
-					Host:            "host",
-					BaseDN:          "baseDN",
-					UserObjectClass: "userObjectClass",
-				},
-			},
-			res{
-				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-ASFt6", ""))
-				},
-			},
-		},
-		{
-			"invalid admin",
-			fields{
-				eventstore: eventstoreExpect(t),
-			},
-			args{
-				ctx: authz.WithInstanceID(context.Background(), "instance1"),
-				id:  "id1",
-				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
+					Name:   "name",
+					BaseDN: "baseDN",
+					BindDN: "bindDN",
 				},
 			},
 			res{
@@ -4120,6 +4105,72 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 				},
 			},
 		},
+		{
+			"invalid servers",
+			fields{
+				eventstore: eventstoreExpect(t),
+			},
+			args{
+				ctx: authz.WithInstanceID(context.Background(), "instance1"),
+				id:  "id1",
+				provider: LDAPProvider{
+					Name:     "name",
+					BaseDN:   "baseDN",
+					BindDN:   "bindDN",
+					UserBase: "user",
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-SAx945n", ""))
+				},
+			},
+		},
+		{
+			"invalid userObjectClasses",
+			fields{
+				eventstore: eventstoreExpect(t),
+			},
+			args{
+				ctx: authz.WithInstanceID(context.Background(), "instance1"),
+				id:  "id1",
+				provider: LDAPProvider{
+					Name:     "name",
+					Servers:  []string{"server"},
+					BaseDN:   "baseDN",
+					BindDN:   "bindDN",
+					UserBase: "user",
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-S1x605n", ""))
+				},
+			},
+		},
+		{
+			"invalid userFilters",
+			fields{
+				eventstore: eventstoreExpect(t),
+			},
+			args{
+				ctx: authz.WithInstanceID(context.Background(), "instance1"),
+				id:  "id1",
+				provider: LDAPProvider{
+					Name:              "name",
+					Servers:           []string{"server"},
+					BaseDN:            "baseDN",
+					BindDN:            "bindDN",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "INST-aAx901n", ""))
+				},
+			},
+		},
 		{
 			name: "not found",
 			fields: fields{
@@ -4131,16 +4182,20 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				id:  "id1",
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
+					Name:              "name",
+					Servers:           []string{"server"},
+					BaseDN:            "baseDN",
+					BindDN:            "binddn",
+					BindPassword:      "password",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+					UserFilters:       []string{"filter"},
 				},
 			},
 			res: res{
-				err: caos_errors.IsNotFound,
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowNotFound(nil, "INST-ASF3F", ""))
+				},
 			},
 		},
 		{
@@ -4152,19 +4207,20 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 							instance.NewLDAPIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate,
 								"id1",
 								"name",
-								"host",
-								"",
+								[]string{"server"},
 								false,
-								"baseDN",
-								"userObjectClass",
-								"userUniqueAttribute",
-								"admin",
+								"basedn",
+								"binddn",
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
 									Algorithm:  "enc",
 									KeyID:      "id",
 									Crypted:    []byte("password"),
 								},
+								"user",
+								[]string{"object"},
+								[]string{"filter"},
+								time.Second*30,
 								idp.LDAPAttributes{},
 								idp.Options{},
 							)),
@@ -4175,12 +4231,15 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				id:  "id1",
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
+					Name:              "name",
+					Servers:           []string{"server"},
+					StartTLS:          false,
+					BaseDN:            "basedn",
+					BindDN:            "binddn",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+					UserFilters:       []string{"filter"},
+					Timeout:           time.Second * 30,
 				},
 			},
 			res: res{
@@ -4196,19 +4255,20 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 							instance.NewLDAPIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate,
 								"id1",
 								"name",
-								"host",
-								"port",
+								[]string{"server"},
 								false,
-								"baseDN",
-								"userObjectClass",
-								"userUniqueAttribute",
-								"admin",
+								"basedn",
+								"binddn",
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
 									Algorithm:  "enc",
 									KeyID:      "id",
 									Crypted:    []byte("password"),
 								},
+								"user",
+								[]string{"object"},
+								[]string{"filter"},
+								time.Second*30,
 								idp.LDAPAttributes{},
 								idp.Options{},
 							)),
@@ -4221,22 +4281,22 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 									t := true
 									event, _ := instance.NewLDAPIDPChangedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate,
 										"id1",
-										"name",
 										[]idp.LDAPIDPChanges{
 											idp.ChangeLDAPName("new name"),
-											idp.ChangeLDAPHost("new host"),
-											idp.ChangeLDAPPort("new port"),
-											idp.ChangeLDAPTLS(true),
-											idp.ChangeLDAPBaseDN("new baseDN"),
-											idp.ChangeLDAPUserObjectClass("new userObjectClass"),
-											idp.ChangeLDAPUserUniqueAttribute("new userUniqueAttribute"),
-											idp.ChangeLDAPAdmin("new admin"),
-											idp.ChangeLDAPPassword(&crypto.CryptoValue{
+											idp.ChangeLDAPServers([]string{"new server"}),
+											idp.ChangeLDAPStartTLS(true),
+											idp.ChangeLDAPBaseDN("new basedn"),
+											idp.ChangeLDAPBindDN("new binddn"),
+											idp.ChangeLDAPBindPassword(&crypto.CryptoValue{
 												CryptoType: crypto.TypeEncryption,
 												Algorithm:  "enc",
 												KeyID:      "id",
 												Crypted:    []byte("new password"),
 											}),
+											idp.ChangeLDAPUserBase("new user"),
+											idp.ChangeLDAPUserObjectClasses([]string{"new object"}),
+											idp.ChangeLDAPUserFilters([]string{"new filter"}),
+											idp.ChangeLDAPTimeout(time.Second * 20),
 											idp.ChangeLDAPAttributes(idp.LDAPAttributeChanges{
 												IDAttribute:                stringPointer("new id"),
 												FirstNameAttribute:         stringPointer("new firstName"),
@@ -4264,8 +4324,6 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 								}(),
 							),
 						},
-						uniqueConstraintsFromEventConstraintWithInstanceID("instance1", idpconfig.NewRemoveIDPConfigNameUniqueConstraint("name", "instance1")),
-						uniqueConstraintsFromEventConstraintWithInstanceID("instance1", idpconfig.NewAddIDPConfigNameUniqueConstraint("new name", "instance1")),
 					),
 				),
 				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
@@ -4274,15 +4332,16 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) {
 				ctx: authz.WithInstanceID(context.Background(), "instance1"),
 				id:  "id1",
 				provider: LDAPProvider{
-					Name:                "new name",
-					Host:                "new host",
-					Port:                "new port",
-					TLS:                 true,
-					BaseDN:              "new baseDN",
-					UserObjectClass:     "new userObjectClass",
-					UserUniqueAttribute: "new userUniqueAttribute",
-					Admin:               "new admin",
-					Password:            "new password",
+					Name:              "new name",
+					Servers:           []string{"new server"},
+					StartTLS:          true,
+					BaseDN:            "new basedn",
+					BindDN:            "new binddn",
+					BindPassword:      "new password",
+					UserBase:          "new user",
+					UserObjectClasses: []string{"new object"},
+					UserFilters:       []string{"new filter"},
+					Timeout:           time.Second * 20,
 					LDAPAttributes: idp.LDAPAttributes{
 						IDAttribute:                "new id",
 						FirstNameAttribute:         "new firstName",

internal/command/org_idp.go

@@ -1268,23 +1268,26 @@ func (c *Commands) prepareAddOrgLDAPProvider(a *org.Aggregate, writeModel *OrgLD
 		if provider.Name = strings.TrimSpace(provider.Name); provider.Name == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-SAfdd", "Errors.Invalid.Argument")
 		}
-		if provider.Host = strings.TrimSpace(provider.Host); provider.Host == "" {
-			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-SDVg2", "Errors.Invalid.Argument")
-		}
 		if provider.BaseDN = strings.TrimSpace(provider.BaseDN); provider.BaseDN == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-sv31s", "Errors.Invalid.Argument")
 		}
-		if provider.UserObjectClass = strings.TrimSpace(provider.UserObjectClass); provider.UserObjectClass == "" {
+		if provider.BindDN = strings.TrimSpace(provider.BindDN); provider.BindDN == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-sdgf4", "Errors.Invalid.Argument")
 		}
-		if provider.UserUniqueAttribute = strings.TrimSpace(provider.UserUniqueAttribute); provider.UserUniqueAttribute == "" {
+		if provider.BindPassword = strings.TrimSpace(provider.BindPassword); provider.BindPassword == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-AEG2w", "Errors.Invalid.Argument")
 		}
-		if provider.Admin = strings.TrimSpace(provider.Admin); provider.Admin == "" {
+		if provider.UserBase = strings.TrimSpace(provider.UserBase); provider.UserBase == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-SAD5n", "Errors.Invalid.Argument")
 		}
-		if provider.Password = strings.TrimSpace(provider.Password); provider.Password == "" {
-			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-sdf5h", "Errors.Invalid.Argument")
+		if len(provider.Servers) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-SAy945n", "Errors.Invalid.Argument")
+		}
+		if len(provider.UserObjectClasses) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-S1x705n", "Errors.Invalid.Argument")
+		}
+		if len(provider.UserFilters) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-aAx9x1n", "Errors.Invalid.Argument")
 		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			events, err := filter(ctx, writeModel.Query())
@@ -1295,7 +1298,7 @@ func (c *Commands) prepareAddOrgLDAPProvider(a *org.Aggregate, writeModel *OrgLD
 			if err = writeModel.Reduce(); err != nil {
 				return nil, err
 			}
-			secret, err := crypto.Encrypt([]byte(provider.Password), c.idpConfigEncryption)
+			secret, err := crypto.Encrypt([]byte(provider.BindPassword), c.idpConfigEncryption)
 			if err != nil {
 				return nil, err
 			}
@@ -1305,14 +1308,15 @@ func (c *Commands) prepareAddOrgLDAPProvider(a *org.Aggregate, writeModel *OrgLD
 					&a.Aggregate,
 					writeModel.ID,
 					provider.Name,
-					provider.Host,
-					provider.Port,
-					provider.TLS,
+					provider.Servers,
+					provider.StartTLS,
 					provider.BaseDN,
-					provider.UserObjectClass,
-					provider.UserUniqueAttribute,
-					provider.Admin,
+					provider.BindDN,
 					secret,
+					provider.UserBase,
+					provider.UserObjectClasses,
+					provider.UserFilters,
+					provider.Timeout,
 					provider.LDAPAttributes,
 					provider.IDPOptions,
 				),
@@ -1329,21 +1333,24 @@ func (c *Commands) prepareUpdateOrgLDAPProvider(a *org.Aggregate, writeModel *Or
 		if provider.Name = strings.TrimSpace(provider.Name); provider.Name == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-Sffgd", "Errors.Invalid.Argument")
 		}
-		if provider.Host = strings.TrimSpace(provider.Host); provider.Host == "" {
-			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-Dz62d", "Errors.Invalid.Argument")
-		}
 		if provider.BaseDN = strings.TrimSpace(provider.BaseDN); provider.BaseDN == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-vb3ss", "Errors.Invalid.Argument")
 		}
-		if provider.UserObjectClass = strings.TrimSpace(provider.UserObjectClass); provider.UserObjectClass == "" {
+		if provider.BindDN = strings.TrimSpace(provider.BindDN); provider.BindDN == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-hbere", "Errors.Invalid.Argument")
 		}
-		if provider.UserUniqueAttribute = strings.TrimSpace(provider.UserUniqueAttribute); provider.UserUniqueAttribute == "" {
-			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-ASFt6", "Errors.Invalid.Argument")
-		}
-		if provider.Admin = strings.TrimSpace(provider.Admin); provider.Admin == "" {
+		if provider.UserBase = strings.TrimSpace(provider.UserBase); provider.UserBase == "" {
 			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-DG45z", "Errors.Invalid.Argument")
 		}
+		if len(provider.Servers) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-Sxx945n", "Errors.Invalid.Argument")
+		}
+		if len(provider.UserObjectClasses) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-S1p605n", "Errors.Invalid.Argument")
+		}
+		if len(provider.UserFilters) == 0 {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "ORG-aBx901n", "Errors.Invalid.Argument")
+		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			events, err := filter(ctx, writeModel.Query())
 			if err != nil {
@@ -1360,16 +1367,16 @@ func (c *Commands) prepareUpdateOrgLDAPProvider(a *org.Aggregate, writeModel *Or
 				ctx,
 				&a.Aggregate,
 				writeModel.ID,
-				writeModel.Name,
 				provider.Name,
-				provider.Host,
-				provider.Port,
-				provider.TLS,
+				provider.Servers,
+				provider.StartTLS,
 				provider.BaseDN,
-				provider.UserObjectClass,
-				provider.UserUniqueAttribute,
-				provider.Admin,
-				provider.Password,
+				provider.BindDN,
+				provider.BindPassword,
+				provider.UserBase,
+				provider.UserObjectClasses,
+				provider.UserFilters,
+				provider.Timeout,
 				c.idpConfigEncryption,
 				provider.LDAPAttributes,
 				provider.IDPOptions,

internal/command/org_idp_model.go

@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"time"
 
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/eventstore"
@@ -754,16 +755,16 @@ func (wm *OrgLDAPIDPWriteModel) NewChangedEvent(
 	ctx context.Context,
 	aggregate *eventstore.Aggregate,
 	id,
-	oldName,
-	name,
-	host,
-	port string,
-	tls bool,
-	baseDN,
-	userObjectClass,
-	userUniqueAttribute,
-	admin string,
-	password string,
+	name string,
+	servers []string,
+	startTLS bool,
+	baseDN string,
+	bindDN string,
+	bindPassword string,
+	userBase string,
+	userObjectClasses []string,
+	userFilters []string,
+	timeout time.Duration,
 	secretCrypto crypto.Crypto,
 	attributes idp.LDAPAttributes,
 	options idp.Options,
@@ -771,14 +772,15 @@ func (wm *OrgLDAPIDPWriteModel) NewChangedEvent(
 
 	changes, err := wm.LDAPIDPWriteModel.NewChanges(
 		name,
-		host,
-		port,
-		tls,
+		servers,
+		startTLS,
 		baseDN,
-		userObjectClass,
-		userUniqueAttribute,
-		admin,
-		password,
+		bindDN,
+		bindPassword,
+		userBase,
+		userObjectClasses,
+		userFilters,
+		timeout,
 		secretCrypto,
 		attributes,
 		options,
@@ -786,7 +788,7 @@ func (wm *OrgLDAPIDPWriteModel) NewChangedEvent(
 	if err != nil || len(changes) == 0 {
 		return nil, err
 	}
-	return org.NewLDAPIDPChangedEvent(ctx, aggregate, id, oldName, changes)
+	return org.NewLDAPIDPChangedEvent(ctx, aggregate, id, changes)
 }
 
 type OrgIDPRemoveWriteModel struct {

internal/command/org_idp_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"testing"
+	"time"
 
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
@@ -17,7 +18,6 @@ import (
 	"github.com/zitadel/zitadel/internal/id"
 	id_mock "github.com/zitadel/zitadel/internal/id/mock"
 	"github.com/zitadel/zitadel/internal/repository/idp"
-	"github.com/zitadel/zitadel/internal/repository/idpconfig"
 	"github.com/zitadel/zitadel/internal/repository/org"
 )
 
@@ -3734,25 +3734,6 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 				},
 			},
 		},
-		{
-			"invalid host",
-			fields{
-				eventstore:  eventstoreExpect(t),
-				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-			},
-			args{
-				ctx:           context.Background(),
-				resourceOwner: "org1",
-				provider: LDAPProvider{
-					Name: "name",
-				},
-			},
-			res{
-				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-SDVg2", ""))
-				},
-			},
-		},
 		{
 			"invalid baseDN",
 			fields{
@@ -3764,7 +3745,6 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 				resourceOwner: "org1",
 				provider: LDAPProvider{
 					Name: "name",
-					Host: "host",
 				},
 			},
 			res{
@@ -3774,7 +3754,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid userObjectClass",
+			"invalid binddn",
 			fields{
 				eventstore:  eventstoreExpect(t),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3784,7 +3764,6 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 				resourceOwner: "org1",
 				provider: LDAPProvider{
 					Name:   "name",
-					Host:   "host",
 					BaseDN: "baseDN",
 				},
 			},
@@ -3794,51 +3773,6 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 				},
 			},
 		},
-		{
-			"invalid userUniqueAttribute",
-			fields{
-				eventstore:  eventstoreExpect(t),
-				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-			},
-			args{
-				ctx:           context.Background(),
-				resourceOwner: "org1",
-				provider: LDAPProvider{
-					Name:            "name",
-					Host:            "host",
-					BaseDN:          "baseDN",
-					UserObjectClass: "userObjectClass",
-				},
-			},
-			res{
-				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-AEG2w", ""))
-				},
-			},
-		},
-		{
-			"invalid admin",
-			fields{
-				eventstore:  eventstoreExpect(t),
-				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
-			},
-			args{
-				ctx:           context.Background(),
-				resourceOwner: "org1",
-				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-				},
-			},
-			res{
-				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-SAD5n", ""))
-				},
-			},
-		},
 		{
 			"invalid password",
 			fields{
@@ -3849,17 +3783,108 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 				ctx:           context.Background(),
 				resourceOwner: "org1",
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
+					Name:   "name",
+					BindDN: "binddn",
+					BaseDN: "baseDN",
 				},
 			},
 			res{
 				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-sdf5h", ""))
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-AEG2w", ""))
+				},
+			},
+		},
+		{
+			"invalid userbase",
+			fields{
+				eventstore:  eventstoreExpect(t),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
+			},
+			args{
+				ctx:           context.Background(),
+				resourceOwner: "org1",
+				provider: LDAPProvider{
+					Name:         "name",
+					BindDN:       "binddn",
+					BaseDN:       "baseDN",
+					BindPassword: "password",
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-SAD5n", ""))
+				},
+			},
+		},
+		{
+			"invalid servers",
+			fields{
+				eventstore:  eventstoreExpect(t),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
+			},
+			args{
+				ctx:           context.Background(),
+				resourceOwner: "org1",
+				provider: LDAPProvider{
+					Name:         "name",
+					BindDN:       "binddn",
+					BaseDN:       "baseDN",
+					BindPassword: "password",
+					UserBase:     "user",
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-SAy945n", ""))
+				},
+			},
+		},
+		{
+			"invalid userObjectClasses",
+			fields{
+				eventstore:  eventstoreExpect(t),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
+			},
+			args{
+				ctx:           context.Background(),
+				resourceOwner: "org1",
+				provider: LDAPProvider{
+					Name:         "name",
+					Servers:      []string{"server"},
+					BindDN:       "binddn",
+					BaseDN:       "baseDN",
+					BindPassword: "password",
+					UserBase:     "user",
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-S1x705n", ""))
+				},
+			},
+		},
+		{
+			"invalid userFilters",
+			fields{
+				eventstore:  eventstoreExpect(t),
+				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"),
+			},
+			args{
+				ctx:           context.Background(),
+				resourceOwner: "org1",
+				provider: LDAPProvider{
+					Name:              "name",
+					Servers:           []string{"server"},
+					BindDN:            "binddn",
+					BaseDN:            "baseDN",
+					BindPassword:      "password",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-aAx9x1n", ""))
 				},
 			},
 		},
@@ -3873,23 +3898,23 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 							org.NewLDAPIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate,
 								"id1",
 								"name",
-								"host",
-								"",
+								[]string{"server"},
 								false,
 								"baseDN",
-								"userObjectClass",
-								"userUniqueAttribute",
-								"admin",
+								"dn",
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
 									Algorithm:  "enc",
 									KeyID:      "id",
 									Crypted:    []byte("password"),
 								},
+								"user",
+								[]string{"object"},
+								[]string{"filter"},
+								time.Second*30,
 								idp.LDAPAttributes{},
 								idp.Options{},
 							)),
-						uniqueConstraintsFromEventConstraint(idpconfig.NewAddIDPConfigNameUniqueConstraint("name", "org1")),
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3899,13 +3924,16 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 				ctx:           context.Background(),
 				resourceOwner: "org1",
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
-					Password:            "password",
+					Name:              "name",
+					Servers:           []string{"server"},
+					StartTLS:          false,
+					BaseDN:            "baseDN",
+					BindDN:            "dn",
+					BindPassword:      "password",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+					UserFilters:       []string{"filter"},
+					Timeout:           time.Second * 30,
 				},
 			},
 			res: res{
@@ -3923,19 +3951,20 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 							org.NewLDAPIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate,
 								"id1",
 								"name",
-								"host",
-								"port",
-								true,
+								[]string{"server"},
+								false,
 								"baseDN",
-								"userObjectClass",
-								"userUniqueAttribute",
-								"admin",
+								"dn",
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
 									Algorithm:  "enc",
 									KeyID:      "id",
 									Crypted:    []byte("password"),
 								},
+								"user",
+								[]string{"object"},
+								[]string{"filter"},
+								time.Second*30,
 								idp.LDAPAttributes{
 									IDAttribute:                "id",
 									FirstNameAttribute:         "firstName",
@@ -3958,7 +3987,6 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 									IsAutoUpdate:      true,
 								},
 							)),
-						uniqueConstraintsFromEventConstraint(idpconfig.NewAddIDPConfigNameUniqueConstraint("name", "org1")),
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "id1"),
@@ -3968,15 +3996,16 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) {
 				ctx:           context.Background(),
 				resourceOwner: "org1",
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					Port:                "port",
-					TLS:                 true,
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
-					Password:            "password",
+					Name:              "name",
+					Servers:           []string{"server"},
+					StartTLS:          false,
+					BaseDN:            "baseDN",
+					BindDN:            "dn",
+					BindPassword:      "password",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+					UserFilters:       []string{"filter"},
+					Timeout:           time.Second * 30,
 					LDAPAttributes: idp.LDAPAttributes{
 						IDAttribute:                "id",
 						FirstNameAttribute:         "firstName",
@@ -4082,25 +4111,6 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 				},
 			},
 		},
-		{
-			"invalid host",
-			fields{
-				eventstore: eventstoreExpect(t),
-			},
-			args{
-				ctx:           context.Background(),
-				resourceOwner: "org1",
-				id:            "id1",
-				provider: LDAPProvider{
-					Name: "name",
-				},
-			},
-			res{
-				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-Dz62d", ""))
-				},
-			},
-		},
 		{
 			"invalid baseDN",
 			fields{
@@ -4112,7 +4122,6 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 				id:            "id1",
 				provider: LDAPProvider{
 					Name: "name",
-					Host: "host",
 				},
 			},
 			res{
@@ -4122,7 +4131,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid userObjectClass",
+			"invalid binddn",
 			fields{
 				eventstore: eventstoreExpect(t),
 			},
@@ -4132,7 +4141,6 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 				id:            "id1",
 				provider: LDAPProvider{
 					Name:   "name",
-					Host:   "host",
 					BaseDN: "baseDN",
 				},
 			},
@@ -4143,7 +4151,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 			},
 		},
 		{
-			"invalid userUniqueAttribute",
+			"invalid userbase",
 			fields{
 				eventstore: eventstoreExpect(t),
 			},
@@ -4152,33 +4160,9 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 				resourceOwner: "org1",
 				id:            "id1",
 				provider: LDAPProvider{
-					Name:            "name",
-					Host:            "host",
-					BaseDN:          "baseDN",
-					UserObjectClass: "userObjectClass",
-				},
-			},
-			res{
-				err: func(err error) bool {
-					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-ASFt6", ""))
-				},
-			},
-		},
-		{
-			"invalid admin",
-			fields{
-				eventstore: eventstoreExpect(t),
-			},
-			args{
-				ctx:           context.Background(),
-				resourceOwner: "org1",
-				id:            "id1",
-				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
+					Name:   "name",
+					BaseDN: "baseDN",
+					BindDN: "bindDN",
 				},
 			},
 			res{
@@ -4187,6 +4171,75 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 				},
 			},
 		},
+		{
+			"invalid servers",
+			fields{
+				eventstore: eventstoreExpect(t),
+			},
+			args{
+				ctx:           context.Background(),
+				resourceOwner: "org1",
+				id:            "id1",
+				provider: LDAPProvider{
+					Name:     "name",
+					BaseDN:   "baseDN",
+					BindDN:   "bindDN",
+					UserBase: "user",
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-Sxx945n", ""))
+				},
+			},
+		},
+		{
+			"invalid userObjectClasses",
+			fields{
+				eventstore: eventstoreExpect(t),
+			},
+			args{
+				ctx:           context.Background(),
+				resourceOwner: "org1",
+				id:            "id1",
+				provider: LDAPProvider{
+					Name:     "name",
+					Servers:  []string{"server"},
+					BaseDN:   "baseDN",
+					BindDN:   "bindDN",
+					UserBase: "user",
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-S1p605n", ""))
+				},
+			},
+		},
+		{
+			"invalid userFilters",
+			fields{
+				eventstore: eventstoreExpect(t),
+			},
+			args{
+				ctx:           context.Background(),
+				resourceOwner: "org1",
+				id:            "id1",
+				provider: LDAPProvider{
+					Name:              "name",
+					Servers:           []string{"server"},
+					BaseDN:            "baseDN",
+					BindDN:            "bindDN",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+				},
+			},
+			res{
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowInvalidArgument(nil, "ORG-aBx901n", ""))
+				},
+			},
+		},
 		{
 			name: "not found",
 			fields: fields{
@@ -4199,16 +4252,20 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 				resourceOwner: "org1",
 				id:            "id1",
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
+					Name:              "name",
+					Servers:           []string{"server"},
+					BaseDN:            "baseDN",
+					BindDN:            "binddn",
+					BindPassword:      "password",
+					UserBase:          "user",
+					UserObjectClasses: []string{"object"},
+					UserFilters:       []string{"filter"},
 				},
 			},
 			res: res{
-				err: caos_errors.IsNotFound,
+				err: func(err error) bool {
+					return errors.Is(err, caos_errors.ThrowNotFound(nil, "ORG-ASF3F", ""))
+				},
 			},
 		},
 		{
@@ -4220,19 +4277,20 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 							org.NewLDAPIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate,
 								"id1",
 								"name",
-								"host",
-								"",
+								[]string{"server"},
 								false,
-								"baseDN",
-								"userObjectClass",
-								"userUniqueAttribute",
-								"admin",
+								"basedn",
+								"binddn",
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
 									Algorithm:  "enc",
 									KeyID:      "id",
 									Crypted:    []byte("password"),
 								},
+								"user",
+								[]string{"object"},
+								[]string{"filter"},
+								time.Second*30,
 								idp.LDAPAttributes{},
 								idp.Options{},
 							)),
@@ -4244,12 +4302,14 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 				resourceOwner: "org1",
 				id:            "id1",
 				provider: LDAPProvider{
-					Name:                "name",
-					Host:                "host",
-					BaseDN:              "baseDN",
-					UserObjectClass:     "userObjectClass",
-					UserUniqueAttribute: "userUniqueAttribute",
-					Admin:               "admin",
+					Name:              "name",
+					Servers:           []string{"server"},
+					BaseDN:            "basedn",
+					BindDN:            "binddn",
+					UserObjectClasses: []string{"object"},
+					UserFilters:       []string{"filter"},
+					UserBase:          "user",
+					Timeout:           time.Second * 30,
 				},
 			},
 			res: res{
@@ -4265,19 +4325,20 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 							org.NewLDAPIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate,
 								"id1",
 								"name",
-								"host",
-								"port",
+								[]string{"server"},
 								false,
-								"baseDN",
-								"userObjectClass",
-								"userUniqueAttribute",
-								"admin",
+								"basedn",
+								"binddn",
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
 									Algorithm:  "enc",
 									KeyID:      "id",
 									Crypted:    []byte("password"),
 								},
+								"user",
+								[]string{"object"},
+								[]string{"filter"},
+								time.Second*30,
 								idp.LDAPAttributes{},
 								idp.Options{},
 							)),
@@ -4288,22 +4349,22 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 								t := true
 								event, _ := org.NewLDAPIDPChangedEvent(context.Background(), &org.NewAggregate("org1").Aggregate,
 									"id1",
-									"name",
 									[]idp.LDAPIDPChanges{
 										idp.ChangeLDAPName("new name"),
-										idp.ChangeLDAPHost("new host"),
-										idp.ChangeLDAPPort("new port"),
-										idp.ChangeLDAPTLS(true),
-										idp.ChangeLDAPBaseDN("new baseDN"),
-										idp.ChangeLDAPUserObjectClass("new userObjectClass"),
-										idp.ChangeLDAPUserUniqueAttribute("new userUniqueAttribute"),
-										idp.ChangeLDAPAdmin("new admin"),
-										idp.ChangeLDAPPassword(&crypto.CryptoValue{
+										idp.ChangeLDAPServers([]string{"new server"}),
+										idp.ChangeLDAPStartTLS(true),
+										idp.ChangeLDAPBaseDN("new basedn"),
+										idp.ChangeLDAPBindDN("new binddn"),
+										idp.ChangeLDAPBindPassword(&crypto.CryptoValue{
 											CryptoType: crypto.TypeEncryption,
 											Algorithm:  "enc",
 											KeyID:      "id",
 											Crypted:    []byte("new password"),
 										}),
+										idp.ChangeLDAPUserBase("new user"),
+										idp.ChangeLDAPUserObjectClasses([]string{"new object"}),
+										idp.ChangeLDAPUserFilters([]string{"new filter"}),
+										idp.ChangeLDAPTimeout(time.Second * 20),
 										idp.ChangeLDAPAttributes(idp.LDAPAttributeChanges{
 											IDAttribute:                stringPointer("new id"),
 											FirstNameAttribute:         stringPointer("new firstName"),
@@ -4330,8 +4391,6 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 								return event
 							}(),
 						),
-						uniqueConstraintsFromEventConstraint(idpconfig.NewRemoveIDPConfigNameUniqueConstraint("name", "org1")),
-						uniqueConstraintsFromEventConstraint(idpconfig.NewAddIDPConfigNameUniqueConstraint("new name", "org1")),
 					),
 				),
 				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
@@ -4341,15 +4400,16 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) {
 				resourceOwner: "org1",
 				id:            "id1",
 				provider: LDAPProvider{
-					Name:                "new name",
-					Host:                "new host",
-					Port:                "new port",
-					TLS:                 true,
-					BaseDN:              "new baseDN",
-					UserObjectClass:     "new userObjectClass",
-					UserUniqueAttribute: "new userUniqueAttribute",
-					Admin:               "new admin",
-					Password:            "new password",
+					Name:              "new name",
+					Servers:           []string{"new server"},
+					StartTLS:          true,
+					BaseDN:            "new basedn",
+					BindDN:            "new binddn",
+					BindPassword:      "new password",
+					UserBase:          "new user",
+					UserObjectClasses: []string{"new object"},
+					UserFilters:       []string{"new filter"},
+					Timeout:           time.Second * 20,
 					LDAPAttributes: idp.LDAPAttributes{
 						IDAttribute:                "new id",
 						FirstNameAttribute:         "new firstName",