diff --git a/net/freeradius/Makefile b/net/freeradius/Makefile
index ae1df533a..4b8bd02ea 100644
--- a/net/freeradius/Makefile
+++ b/net/freeradius/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		freeradius
-PLUGIN_VERSION=		1.4.1
+PLUGIN_VERSION=		1.5.0
 PLUGIN_COMMENT=		RADIUS Authentication, Authorization and Accounting Server
 PLUGIN_DEPENDS=		freeradius3
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/LdapController.php b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/LdapController.php
new file mode 100644
index 000000000..e70edcb34
--- /dev/null
+++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/LdapController.php
@@ -0,0 +1,39 @@
+<?php
+/**
+ *    Copyright (C) 2015 - 2017 Deciso B.V.
+ *    Copyright (C) 2017 Michael Muenz
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\Freeradius\Api;
+
+use \OPNsense\Base\ApiMutableModelControllerBase;
+
+class LdapController extends ApiMutableModelControllerBase
+{
+    static protected $internalModelName = 'ldap';
+    static protected $internalModelClass = '\OPNsense\Freeradius\Ldap';
+}
diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/LdapController.php b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/LdapController.php
new file mode 100644
index 000000000..19fb64422
--- /dev/null
+++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/LdapController.php
@@ -0,0 +1,38 @@
+<?php
+
+/*
+ * Copyright (C) 2017 Michael Muenz
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Freeradius;
+
+class LdapController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->ldapForm = $this->getForm("ldap");
+        $this->view->pick('OPNsense/Freeradius/ldap');
+    }
+}
diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/general.xml b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/general.xml
index 518529fa8..d39801687 100644
--- a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/general.xml
+++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/general.xml
@@ -11,6 +11,12 @@
         <type>checkbox</type>
         <help>This allows you to dynamically assign VLANs on your physical switch ports.</help>
     </field>
+    <field>
+        <id>general.ldap_enabled</id>
+        <label>Enable LDAP</label>
+        <type>checkbox</type>
+        <help>This allows you to bind to an external LDAP server. Be aware that FreeRADIUS will not start if there is no further configuration.</help>
+    </field>
     <field>
         <id>general.wispr</id>
         <label>Enable WISPr attributes</label>
diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
new file mode 100644
index 000000000..bb91a2d01
--- /dev/null
+++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
@@ -0,0 +1,32 @@
+<form>
+    <field>
+        <id>ldap.protocol</id>
+        <label>Protocol Type</label>
+        <type>dropdown</type>
+        <help>Set the protocol to use.</help>
+    </field>
+    <field>
+        <id>ldap.server</id>
+        <label>Server</label>
+        <type>text</type>
+        <help>Set the hostname or IP address to connect to.</help>
+    </field>
+    <field>
+        <id>ldap.identity</id>
+        <label>Bind User</label>
+        <type>text</type>
+        <help>Username to bind to LDAP, same format as in Base DN.</help>
+    </field>
+    <field>
+        <id>ldap.password</id>
+        <label>Bind Password</label>
+        <type>password</type>
+        <help>Password for the bind user.</help>
+    </field>
+    <field>
+        <id>ldap.base_dn</id>
+        <label>Base DN</label>
+        <type>text</type>
+        <help>Set the Base DN in format dc=example,dc=domain,dc=com</help>
+    </field>
+</form>
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/General.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/General.xml
index c210db4b6..0440296f9 100644
--- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/General.xml
+++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/General.xml
@@ -11,6 +11,10 @@
             <default>0</default>
             <Required>N</Required>
         </vlanassign>
+        <ldap_enabled type="BooleanField">
+            <default>0</default>
+            <Required>N</Required>
+        </ldap_enabled>
         <wispr type="BooleanField">
             <default>0</default>
             <Required>N</Required>
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.php b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.php
new file mode 100644
index 000000000..d018a57b1
--- /dev/null
+++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.php
@@ -0,0 +1,34 @@
+<?php
+namespace OPNsense\Freeradius;
+
+use OPNsense\Base\BaseModel;
+
+/*
+    Copyright (C) 2017 Michael Muenz
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+class Ldap extends BaseModel
+{
+}
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
new file mode 100644
index 000000000..296a2384e
--- /dev/null
+++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
@@ -0,0 +1,29 @@
+<model>
+    <mount>//OPNsense/freeradius/ldap</mount>
+    <description>LDAP configuration</description>
+    <version>1.0.0</version>
+    <items>
+        <protocol type="OptionField">
+            <default>LDAPS</default>
+            <Required>Y</Required>
+            <OptionValues>
+                <LDAP>LDAP</LDAP>
+                <LDAPS>LDAPS</LDAPS>
+            </OptionValues>
+        </protocol>
+        <server type="TextField">
+            <Required>N</Required>
+        </server>
+        <identity type="TextField">
+            <Required>N</Required>
+        </identity>
+        <password type="TextField">
+            <Required>N</Required>
+        </password>
+        <base_dn type="TextField">
+            <default>dc=example,dc=domain,dc=com</default>
+            <Required>N</Required>
+        </base_dn>
+    </items>
+</model>
+
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml
index 062f54ea2..396a66caf 100644
--- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml
+++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml
@@ -5,6 +5,7 @@
       <Users url="/ui/freeradius/user/index" order="20"/>
       <Clients url="/ui/freeradius/client/index" order="30"/>
       <EAP url="/ui/freeradius/eap/index" order="40"/>
+      <LDAP url="/ui/freeradius/ldap/index" order="50"/>
       <LogFile VisibleName="Log File" order="80" url="/diag_logs_freeradius.php"/>
     </FreeRADIUS>
   </Services>
diff --git a/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/ldap.volt b/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/ldap.volt
new file mode 100644
index 000000000..777801049
--- /dev/null
+++ b/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/ldap.volt
@@ -0,0 +1,62 @@
+{#
+
+OPNsense® is Copyright © 2014 – 2017 by Deciso B.V.
+This file is Copyright © 2017 by Michael Muenz
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+1.  Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+
+2.  Redistributions in binary form must reproduce the above copyright notice,
+    this list of conditions and the following disclaimer in the documentation
+    and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+#}
+
+<div class="content-box" style="padding-bottom: 1.5em;">
+    {{ partial("layout_partials/base_form",['fields':ldapForm,'id':'frm_ldap_settings'])}}
+    <div class="col-md-12">
+        <hr />
+        <button class="btn btn-primary" id="saveAct" type="button"><b>{{ lang._('Save') }}</b> <i id="saveAct_progress" class=""></i></button>
+    </div>
+</div>
+
+<script type="text/javascript">
+    $( document ).ready(function () {
+        var data_get_map = {'frm_ldap_settings':"/api/freeradius/ldap/get"};
+        mapDataToFormUI(data_get_map).done(function (data) {
+            formatTokenizersUI();
+            $('.selectpicker').selectpicker('refresh');
+        });
+        ajaxCall(url="/api/freeradius/service/status", sendData={}, callback=function (data, status) {
+            updateServiceStatusUI(data['status']);
+        });
+
+        // link save button to API set action
+        $("#saveAct").click(function () {
+            saveFormToEndpoint(url="/api/freeradius/ldap/set", formid='frm_ldap_settings',callback_ok=function () {
+            $("#saveAct_progress").addClass("fa fa-spinner fa-pulse");
+                ajaxCall(url="/api/freeradius/service/reconfigure", sendData={}, callback=function (data,status) {
+                    ajaxCall(url="/api/freeradius/service/status", sendData={}, callback=function (data,status) {
+                        updateServiceStatusUI(data['status']);
+                    });
+                    $("#saveAct_progress").removeClass("fa fa-spinner fa-pulse");
+                });
+            });
+        });
+    });
+</script>
diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/+TARGETS b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/+TARGETS
index 48a559703..98bf63b72 100644
--- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/+TARGETS
+++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/+TARGETS
@@ -2,6 +2,7 @@ clients.conf:/usr/local/etc/raddb/clients.conf
 dictionary:/usr/local/etc/raddb/dictionary
 mods-enabled-counter:/usr/local/etc/raddb/mods-enabled/counter
 mods-enabled-eap:/usr/local/etc/raddb/mods-enabled/eap
+mods-enabled-ldap:/usr/local/etc/raddb/mods-enabled/ldap
 radiusd:/etc/rc.conf.d/radiusd
 radiusd.conf:/usr/local/etc/raddb/radiusd.conf
 sites-enabled-default:/usr/local/etc/raddb/sites-enabled/default
diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap
new file mode 100644
index 000000000..6ee50bc6f
--- /dev/null
+++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap
@@ -0,0 +1,116 @@
+{% if helpers.exists('OPNsense.freeradius.general.enabled') and OPNsense.freeradius.general.enabled == '1' %}
+{%   if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %}
+ldap {
+{%     if helpers.exists('OPNsense.freeradius.ldap.server') and OPNsense.freeradius.ldap.server != '' %}
+        server = '{{ OPNsense.freeradius.ldap.protocol }}://{{ OPNsense.freeradius.ldap.server }}'
+{%     endif %}
+
+{%     if helpers.exists('OPNsense.freeradius.ldap.identity') and OPNsense.freeradius.ldap.identity != '' %}
+        identity = '{{ OPNsense.freeradius.ldap.identity }}'
+{%     endif %}
+
+{%     if helpers.exists('OPNsense.freeradius.ldap.password') and OPNsense.freeradius.ldap.password != '' %}
+        password = {{ OPNsense.freeradius.ldap.password }}
+{%     endif %}        
+
+{%     if helpers.exists('OPNsense.freeradius.ldap.base_dn') and OPNsense.freeradius.ldap.base_dn != '' %}
+        base_dn = '{{ OPNsense.freeradius.ldap.base_dn }}'
+{%     endif %}
+{%     raw %}
+        sasl {
+        }
+        update {
+                control:Password-With-Header    += 'userPassword'
+                control:                        += 'radiusControlAttribute'
+                request:                        += 'radiusRequestAttribute'
+                reply:                          += 'radiusReplyAttribute'
+        }
+        user {
+                base_dn = "${..base_dn}"
+                filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
+                sasl {
+                }
+        }
+        group {
+                base_dn = "${..base_dn}"
+                filter = '(objectClass=posixGroup)'
+                membership_attribute = 'memberOf'
+        }
+        profile {
+        }
+        client {
+                base_dn = "${..base_dn}"
+                filter = '(objectClass=radiusClient)'
+                template {
+                }
+                attribute {
+                        ipaddr                          = 'radiusClientIdentifier'
+                        secret                          = 'radiusClientSecret'
+                }
+        }
+        accounting {
+                reference = "%{tolower:type.%{Acct-Status-Type}}"
+
+                type {
+                        start {
+                                update {
+                                        description := "Online at %S"
+                                }
+                        }
+
+                        interim-update {
+                                update {
+                                        description := "Last seen at %S"
+                                }
+                        }
+
+                        stop {
+                                update {
+                                        description := "Offline at %S"
+                                }
+                        }
+                }
+        }
+
+        post-auth {
+                update {
+                        description := "Authenticated at %S"
+                }
+        }
+
+        options {
+                chase_referrals = yes
+                rebind = yes
+                res_timeout = 10
+                srv_timelimit = 3
+                net_timeout = 1
+                idle = 60
+                probes = 3
+                interval = 3
+                ldap_debug = 0x0028
+                max = ${thread[pool].max_servers}
+                spare = ${thread[pool].max_spare_servers}
+                uses = 0
+                retry_delay = 30
+                lifetime = 0
+                idle_timeout = 60
+
+        }
+        tls {
+                require_cert    = 'allow'
+        }
+        pool {
+                start = ${thread[pool].start_servers}
+                min = ${thread[pool].min_spare_servers}
+                max = ${thread[pool].max_servers}
+                spare = ${thread[pool].max_spare_servers}
+                uses = 0
+                retry_delay = 30
+                lifetime = 0
+                idle_timeout = 60
+        }
+
+}
+{%   endraw %}
+{%   endif %}
+{% endif %}
diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default
index 92e968506..dc3c6bec3 100644
--- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default
+++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default
@@ -56,8 +56,11 @@ authorize {
         }
         files
         -sql
+{% if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %}
+        ldap
+{% else %}
         -ldap
-
+{% endif %}
 {% if helpers.exists('OPNsense.freeradius.general.sessionlimit') and OPNsense.freeradius.general.sessionlimit == '1' %}
         daily
 {% endif %}
@@ -77,6 +80,11 @@ authenticate {
         Auth-Type MS-CHAP {
                 mschap
         }
+{% if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %}
+        Auth-Type LDAP {
+                ldap
+        }
+{% endif %}
         mschap
         digest
         eap