CUBA applications can be integrated with LDAP to provide the following benefits:

If the LDAP integration is enabled, a user still needs an account in the application. All the user permissions and properties (except password) are stored in the application database, LDAP is used only for authentication. It is recommended to leave the application password empty for most users except the ones that require the standard authentication (see below). The password field in the user editor screen is not required if the cuba.web.requirePasswordForNewUsers property is set to false.

If the user login is listed in the cuba.web.standardAuthenticationUsers application property, the application tries to authenticate the user only by the password hash stored in the database. As a result, a user from this list can log in to the system with this password if he is not registered in LDAP.

A CUBA-based application interacts with LDAP via the LdapLoginProvider bean.

You can use the Jespa library with the corresponding LoginProvider described in the Active Directory Integration Using Jespa section in order to enable advanced integration with Active Directory, including Single Sign-On for Windows domain users.

You can implement your own login mechanism using custom LoginProvider, HttpRequestFilter or events described in Web Login Specifics.

Also, you can enable LDAP authentication for REST API clients: REST API Authentication with LDAP.