diff --git a/src/translation/en.json b/src/translation/en.json
index 852d0f169..195cfdbf6 100644
--- a/src/translation/en.json
+++ b/src/translation/en.json
@@ -343,6 +343,10 @@
                 "description": "The directory server can be limited to specific IPs or ranges.",
                 "placeholder": "Line separated IP address or Subnet",
                 "label": "Restrict Access"
+            },
+            "secret": {
+                "label": "Secret",
+                "description": "All LDAP queries have to be authenticated with this secret and the user DN <i>{{ userDN }}</i>"
             }
         }
     },
diff --git a/src/views/users.html b/src/views/users.html
index 25f8bf6b6..bd6b50ae8 100644
--- a/src/views/users.html
+++ b/src/views/users.html
@@ -884,6 +884,12 @@
                 <input type="checkbox" ng-model="userDirectoryConfig.enabled" ng-disabled="userDirectoryConfig.busy"> {{ 'users.exposedLdap.enabled' | tr }} <sup><a ng-href="https://docs.cloudron.io/user-management/#exposed-ldap" class="help" target="_blank"><i class="fa fa-question-circle"></i></a></sup>
               </label>
             </div>
+            <div class="form-group">
+              <label class="control-label">{{ 'users.exposedLdap.secret.label' | tr }}</label>
+              <p class="small" ng-bind-html=" 'users.exposedLdap.secret.description' | tr:{ userDN: 'cn=admin,ou=system,dc=cloudron' }"></p>
+              <input type="password" ng-model="userDirectoryConfig.secret" ng-disabled="!userDirectoryConfig.enabled || userDirectoryConfig.busy" name="secret" class="form-control" ng-class="{ 'has-error': !userDirectoryConfigForm.secret.$dirty && userDirectoryConfig.error.secret }" password-reveal/>
+              <div class="has-error" ng-show="userDirectoryConfig.error.secret">{{ userDirectoryConfig.error.secret }}</div>
+            </div>
             <div class="form-group">
               <label class="control-label">{{ 'users.exposedLdap.ipRestriction.label' | tr }}</label>
               <p class="small">{{ 'users.exposedLdap.ipRestriction.description' | tr }}</p>
diff --git a/src/views/users.js b/src/views/users.js
index d3651fefe..5b7f345fd 100644
--- a/src/views/users.js
+++ b/src/views/users.js
@@ -691,6 +691,7 @@ angular.module('Application').controller('UsersController', ['$scope', '$locatio
 
     $scope.userDirectoryConfig = {
         enabled: false,
+        secret: '',
         allowlist: '',
         error: null,
 
@@ -700,6 +701,7 @@ angular.module('Application').controller('UsersController', ['$scope', '$locatio
 
                 $scope.userDirectoryConfig.enabled = !!result.enabled;
                 $scope.userDirectoryConfig.allowlist = result.allowlist;
+                $scope.userDirectoryConfig.secret = result.secret;
             });
         },
 
@@ -710,13 +712,17 @@ angular.module('Application').controller('UsersController', ['$scope', '$locatio
 
             var data = {
                 enabled: $scope.userDirectoryConfig.enabled,
+                secret: $scope.userDirectoryConfig.secret,
                 allowlist: $scope.userDirectoryConfig.allowlist
             };
 
             Client.setUserDirectoryConfig(data, function (error) {
                 $scope.userDirectoryConfig.busy = false;
 
-                if (error && error.statusCode === 400) return $scope.userDirectoryConfig.error = { allowlist: error.message };
+                if (error && error.statusCode === 400) {
+                    if (error.message.indexOf('secret') !== -1) return $scope.userDirectoryConfig.error = { secret: error.message };
+                    else return $scope.userDirectoryConfig.error = { allowlist: error.message };
+                }
                 if (error) return $scope.userDirectoryConfig.error = { generic: error.message };
 
                 $scope.userDirectoryConfigForm.$setUntouched();