# ACL and LDAP not working together **URL:** \ **Category:** Questions\ **Created:** [March 19, 2019, 1:47pm UTC](https://discuss.konghq.com/t/acl-and-ldap-not-working-together/3050 "2019-03-19T13:47:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Prashant\_Shandilya](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/prashant_shandilya/32/805_2.png) [@Prashant\_Shandilya](https://discuss.konghq.com/u/Prashant_Shandilya)\ **Post date:** [March 19, 2019, 1:47pm UTC](https://discuss.konghq.com/t/acl-and-ldap-not-working-together/3050/1 "2019-03-19T13:47:31Z")
Can I use ACL and LDAP plugin together. Steps that followed - 1. Added Service and Route 2. Added consumer with consumerid user1 with group gr1 3. Setup ldap that host user with userid user1 4. Added ldap plugin to service 5. Tested with ldap auth - it works 6. Added ACL to restrict access to gr1 7. Tested with step # 5 - does not work with message {“message”:“You cannot consume this service”} 8. Disabled ACL step # 5 works again Please clarify if there is some potential restriction on usage of LDAP and ACL plugins together ---
**Author:** ![Tieske](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/tieske/32/54_2.png) [@Tieske](https://discuss.konghq.com/u/Tieske)\ **Post date:** [March 20, 2019, 5:56pm UTC](https://discuss.konghq.com/t/acl-and-ldap-not-working-together/3050/2 "2019-03-20T17:56:54Z")
Did you follow some documentation when setting this up? if so a link please? I have actually no idea whether this is supported. ACL typically works on consumers with Kong, but LDAP relies on remote authentication. ---
**Author:** ![Prashant\_Shandilya](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/prashant_shandilya/32/805_2.png) [@Prashant\_Shandilya](https://discuss.konghq.com/u/Prashant_Shandilya)\ **Post date:** [March 27, 2019, 9:05am UTC](https://discuss.konghq.com/t/acl-and-ldap-not-working-together/3050/3 "2019-03-27T09:05:35Z")
Did not follow any link but my own use case where wanted to use LDAP as credential providor and ACL to do access control with API gateway ---
**Author:** ![darrenjennings](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/darrenjennings/32/203_2.png) [@darrenjennings](https://discuss.konghq.com/u/darrenjennings)\ **Post date:** [March 27, 2019, 8:47pm UTC](https://discuss.konghq.com/t/acl-and-ldap-not-working-together/3050/4 "2019-03-27T20:47:27Z")
@Prashant_Shandilya the ldap auth plugin only has consumer mapping in the Enterprise edition with [LDAP Auth Advanced Plugin](https://docs.konghq.com/hub/kong-inc/ldap-auth-advanced/) via the `config.consumer_by` property. With the LDAP plugin, you can only bind to an anonymous consumer. There is future support for LDAP\<-\>ACL planned via authenticated\_groups context ([https://github.com/Kong/kong/pull/4013](https://github.com/Kong/kong/pull/4013)), but for now the community edition lacks this support. ---
**Author:** ![lziegler](https://avatars.discourse-cdn.com/v4/letter/l/5daacb/32.png) [@lziegler](https://discuss.konghq.com/u/lziegler)\ **Post date:** [March 31, 2019, 11:27pm UTC](https://discuss.konghq.com/t/acl-and-ldap-not-working-together/3050/5 "2019-03-31T23:27:10Z")
Hi, it seems like Kong EE also lacks this feature, see this related question: [KongEE OpenID Connect Plugin - ACL plugin ignores groups returned in Access Token](https://discuss.konghq.com/t/kongee-openid-connect-plugin-acl-plugin-ignores-groups-returned-in-access-token/2875) ---
**Author:** ![Prashant\_Shandilya](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/prashant_shandilya/32/805_2.png) [@Prashant\_Shandilya](https://discuss.konghq.com/u/Prashant_Shandilya)\ **Post date:** [April 5, 2019, 10:44am UTC](https://discuss.konghq.com/t/acl-and-ldap-not-working-together/3050/6 "2019-04-05T10:44:35Z")
This feature is very much required and since external authentication and autherization matix implementation are standard use cases. If this basic is not supported, its would be very difficult to adopt Kong. What is the plan to include pull requests mentioned in previous comments ? ---
**Author:** ![darrenjennings](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/darrenjennings/32/203_2.png) [@darrenjennings](https://discuss.konghq.com/u/darrenjennings)\ **Post date:** [May 4, 2019, 9:54pm UTC](https://discuss.konghq.com/t/acl-and-ldap-not-working-together/3050/7 "2019-05-04T21:54:33Z")
Kong EE does _not_ lack the support that @Prashant_Shandilya originally is referring to, where a service/ route is mapped by the LDAP Auth Advanced plugin to a Consumer who is part of an ACL group. But it does currently lacks the authenticated\_groups context PR 4013 that I mentioned, which is for when you do not even need a Kong Consumer. I cannot comment with any certainty on how soon 4013 will be available for usage with the LDAP Auth Advanced plugin, but I do know that it is planned for this year sometime.