Directory connector (Active Directory and LDAP)

When your people live in an on-premises Active Directory or an LDAP directory, a directory connector can read them and keep them in sync. It is the alternative to SCIM for organizations that use neither Microsoft Entra ID nor Okta.

What does the connector do?

• It reads the directory read-only, over LDAPS or StartTLS (TLS 1.2 or 1.3), validating the controller's certificate against your organization's certificate authority.
• It supports Active Directory (DirSync) and generic LDAPv3 directories (OpenLDAP, FreeIPA, 389-DS).
• At each scheduled round it sends the service a complete, signed snapshot of the selected accounts and groups.
• An account that disappears is disabled and its sessions end. Nothing is deleted.
• It never takes over accounts created in the console or SCIM accounts, and never disables the last active administrator.

Who installs and runs it?

The connector is a scheduled process (authguard-scim-ldap-worker) installed and run by the team that operates the service, close to your directory. Installation, credentials and monitoring belong to the operator; there is no configuration pane in the console. Ask your provider for it.

What do I prepare?

1. A read-only service account in the directory (simple bind with its password kept in a protected file) or a client certificate (SASL EXTERNAL). Anonymous binds are refused.
2. The controller's LDAPS or StartTLS address and your certificate authority's certificate.
3. The search base and the filters of the people and groups to sync.
4. The list of groups you want to use in policies.

And the Edge appliance?

The Edge appliance's directory module is not available yet: the appliance currently runs only the privileged access module. See Appliance configuration and modules.

Large directories

Large directories are read in paged rounds. A directory beyond the configured limits is refused whole, without truncation; the operator narrows the filter or raises the limits.