> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Configure an on-premises Active Directory You can create an on-premises directory to sync users and groups from your Active Directory to IDaaS. note If you currently use an on-premises directory to sync users and groups from Microsoft Entra ID, Entrust recommends that you configure a [Configure a Microsoft Entra ID](/docs/directories-and-provisioning/manage-directories/configure-microsoft-entra-id.md). The Directory Sync agent is an on-premises application that is of part of an IDaaS Gateway to automatically import user and group information from your Active Directory server. The directory sync agent periodically queries your AD server to ensure that new user and group information is automatically added to IDaaS. When you configure an on-premises directory, you can add multiple directory servers for failover in case a directory cannot be reached. warning Depending on the configuration of the domain controller, when you change your password due to it being in a **Change Required** or **Expired** state, the old password can remain active for a period of time (default 1 hour). See the following for more details: . For Enterprise Service Gateways prior to 5.3, only the first directory server in the list is used. warning Once you configure a directory and associate it to a Gateway through the directory sync agent, the synchronization begins immediately. If you configure a directory without Group Filter values, every user identified in your corporate directory is imported into IDaaS immediately after the directory setup is complete. All user groups are also imported if no Group Filters are set. ## Supported Domain user roles The following are Active Directory Domain user roles: - **Domain Administrator.** Users with this role can connect with IDaaS with write permissions and can perform User synchronization, Group synchronization, Password Reset, and Password change. - **Domain User.** Users with this role can connect with IDaaS with read only permissions and can perform User synchronization and Group synchronization but not Password Reset and Password change. ## Group synchronization - When synchronizing users from AD, if synchronization is configured to synchronize all groups, then all users share a group in common. - If an administration role is configured with OWN group access, a synchronized administrator shares that same group in common and can administer all synchronized users. - If you want administrators to not have access to all synchronized users, you can do one of the following: - Configure synchronization to synchronize only groups that match the group filter and do not include a group that is common to all users in AD in your group filter. This allows you to have an administrator role with access to OWN groups. - Configure an administrator role that has access to DEFINED groups and do not include groups that are common to all users. ## Add an on-premises directory Complete the following to add an on-premises directory: 1. [Set the connection settings](#set-the-connection-settings) 2. [Add Directory servers](#add-directory-servers) 3. [Set search bases and group filters](#set-search-bases-and-group-filters) 4. [Set the attribute mappings](#set-the-attribute-mappings) 5. [Set the synchronization settings](#set-the-synchronization-settings) 6. [Save the directory](#save-the-directory) ### Set the connection settings 1. Click Menu icon **>** **Resources > Directories**. The **Directories List** page appears. 2. Click Circle Plus icon and select **On-premises Active Directory** from the drop-down list. The **Add** **Directory** page appears. 3. In the **Directory Name** field, enter a name for your directory. 4. In the **Root Domain Naming Context** field, enter the full DN of the AD server. > Example: `DC=AnyCorp,DC=biz` 5. In the **Username** field, enter the name used to administer your directory in LDAP format. The user name can be a fully distinguished name or UPN. For example, `CN=Administrator,CN=Users,DC=AnyCorp,DC=biz` or `Administrator@AnyCorp.biz`. 6. In the **Password** field, enter your directory account password. ### Add Directory servers 1. Click **Add** to add Directory Servers. The **Directory Server** dialog box appears. 2. In the **Hostname** field, enter the host name the AD server. The hostname can be either a hostname or IP address. 3. In the **Port** field, enter the port the directory communicates on. 4. Optional: Select **Use SSL** if you want secure communication to the directory. While optional, it is highly recommended that you use an SSL connection. note IDaaS supports the `.cer` and `.pem` SSL certificate extension types. It does not support the .p7b extension. 5. If you select **Use SSL you** are prompted to upload your SSL certificate. 6. Click in the box, browse to select SSL certificate, and click **Open**. 7. Click **Add** to add your directory server. 8. Repeat these steps to add additional directory servers for failover. note A Lock Keyhole Open icon next to the directory server connection indicates that SSL is not being used. To edit the Directory Server information, click the row of the server you want to edit. The **Edit** dialog box appears. Make your changes and click **Edit**. Click Menu icon to drag and drop the order of the Directory Server used for failover. For Enterprise Service Gateways prior to 5.3, only the first directory server in the list is used. ### Set search bases and group filters In the **SearchBases & Group Filters** section, specify which users and groups are synchronized. These settings are optional. 1. Optional: Enter the **Root Domain Naming Context** (for example, DC=AnyCorp,DC=biz). SearchBases are combined with your **Root Domain Naming Context**. > For example, the **SearchBase** DC=Users would combine with the **Root Domain Naming Context** DC=AnyCorp,DC=biz to form DC=Users,DC=AnyCorp,DC=biz. - If you do not specify any SearchBases then all search bases under the root context are searched for users. - If you do specify SearchBases, then only those search bases under the root context are searched for users. 2. Click **Add** to add **SearchBases**. - When specifying a SearchBase, by default ![Subtree](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACMAAAAgCAYAAACYTcH3AAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAAI6ADAAQAAAABAAAAIAAAAAD/HDl3AAACv0lEQVRYCWP8DwQMgwQwDRJ3gJ0xqBzDQk7I/P33l2HNhbUMt9/cwdAuzCXMEGkcwSDAyY8hR0iALMccvHuYYcLByTjN/vD9A0OlazlOeVwSZEXTvTf3cJkHFn/y4SleeVySZDkGl2GUio86BlcIkhUybCxsuMwDixOSx6WZLMfYK9sy8LDz4DKTwVHVAaccPglGcquD77+/M3z4/pFh9809DNOPzGRwAjogxy6bgZOVk6wyBuRIssoZkEaQpSAMKuTAfDZOBkk+CTCbXIKsaCLXMkL6cEYTKBqWnlnOcP7JBbxmvP32juHhu4cMwtxCDPKC8njVyghIMySYx+MMQZyOAdU9vfsn4DWcHElTOROGScH9WLXiTDOH7h4Ba9CX1mMA+QgXABX9F59eAqqRYdCX1sWljOH7r+8M+24fYDj96AxONTgdA6qZQcBX24fBW9sTpwFbr24HOwbkkBq3Kpzqnn96AXYMTgVAiUGVgAeVY5gbgAA56N5+fcew5uJahuefnjNws3Ez/Pn3m+EbML4VhRUYmBgRbgdF4/ZrOxkuPL3A8B8IWZhYGd4Dc5aCkDwDenVw7sl5hl039jD8AOZQUK4D2cHLwQNkQ8oomP0YuSlobijQIS9g8nA6EZgl06xS4Pwph6YxLD27HM6HMeSBjlkRvwTGZQA5JHt1HpyPzFiduByc8GFiCK8CRUCOwOYQkGJQjkEGoNYeNgAqc5DBucfnkbko7ItPL6PwURyDIkOA8/ffHwIqSJcm2zGkW0VYx/BwDDMTzvKScBDgUIESMqAmAKhYxwZA1QIyADWwsAFVUVUUYVBdhAugVx8YWfvLzy8MR+4dY4BVByCDQGUDyFBmJma4uSD5o/ePMXz+8QUuBpK3UbLCaAXefn2b4dYr1A6fjqQWA6gYQAYYjkGWpDcbJZrobTm6fYPKMQCVsOE26kJ4GgAAAABJRU5ErkJggg==)(Include subtree) is selected. - When Include Subtree is selected, all subtrees under your SearchBase are searched for users. - Click ![Exclude Subtree](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACEAAAAfCAYAAABplKSyAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAAIaADAAQAAAABAAAAHwAAAAAIUYbnAAACw0lEQVRYCe1Vy2sTQRj/7W6bsiZqm1xSEhuxqGBqK9YXvqoFBVFB8KIo+LiI6M2DKB78B8RSD6IX8VDERw8eVKS+ohUEax+iB9umWtuaikmItWZL2t04s7LLpJtJ2RhtC36QzPf+fvvNzDdCmhCmmcRprq+XL7IDQtVU3OlsRk+01xLmmePB/tp9KJXnW2xTKWyBCIVfoCF0iZszoSRwZttprp1nsLUdfdE+Xh5dP5gYymnnGW2B4CX5U/1/EEYHbXXCUeQw4rKuU9mzBhGlLRB1lZvgKnHxcmHr4i1cWy6DYHdiKuMKEsp3tHx4hMutV1BPCp/cfAJysZzXjKDgbM0JGkCL0R8dTrrskFE+z6vz+f7Z2o58i0wVZ9kO2u6mthvoGOzMGRtLxtEf74fH6UagLJDT11/qw+G1h7gds4Cgb8OFpw05k+ZjXF2xCo17L2YNtZyJ5+FW3bHGVw36BTyiI7pr6C3x8aPGt5znBiWl4EnPM7z+3Mb1sYCgLyWl3cFd2BncwQ289/6BDoICOLf9LNcvMjKsg+A6EMOMOJgzAoR0nhBtVToew8Td2/B+/IL1ozKC31JwjvyEGFhE+sVgVVVMtNyHs70D1TENtQkJ7kgcYkUAgqOEpjJJ7WoHHj/E0q9J1I+VwT8QheCaC8H9e8YYjubtSB7cg/RwxNCba/GBo3AcOWbKqauNGL/VZMoGIy5YCPnaTUMEBTB26rgps4x8vRmiz2+q9E+kxbMBoF7au8x5ob4MmcEsow18YkUC4k2GzAqTczJ9Zt34fJpsR6HJNohCA6D5ZicIQZIK3gy9E4K3POO0slXEqhWsCGlDXYZsCGLlEoPVV2nlmgyZFSbnNK9oevQH1Ffk3WAOHr3PejL264md+lF/k4hdWrdRnwGmjjBauBtabzergrisCvQ6s2SCYJX/mp+dB/NvdOkXAX/at9nwyGMAAAAASUVORK5CYII=) to exclude the subtree. - When Exclude Subtree is selected, then only entries immediately in your SearchBase are searched. > For example, if you have SearchBase ou= department and subtree ou= sales and subtree ou= marketing, then all users in ou= department and the subtrees ou= sales and ou= marketing are synchronized. 3. Click **Add** to add more SearchBases. 4. Optional. Under **Group Filters**, click **Add**. 5. In the **Group Filter** field enter the name of the group that you want to filter. For example, enter **Sales** to sync all users in the Sales Department. By default all groups are synchronized. note If there are no group filters set, all users are imported. If there is more than one group filter set, the user must belong to one of the groups identified by the group filters. Only enter one value per **Group Filter** text box. 6. Optional: Click **Add** to add more group filters. ### Set the attribute mappings In the **Attributes Mappings** section, map directory attributes in your Active Directory to IDaaS attributes. You must at a minimum map the mandatory system attributes. They are flagged with an asterisk (*). 1. The **Security ID** is an optional system attribute that uniquely identifies users in a Microsoft Windows environment. The attribute is automatically assigned the value **ObjectSID**. Do not change this value. 2. Optional: Add or modify the attributes. (See [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md)). note Once a user is synchronized from AD, the user is read-only in IDaaS and an administrator cannot manually update the attribute. In addition, mandatory attributes must be populated. If there is no value, then the user will not be synchronized. 3. Optional: To configure your directory for AD LDS, enter **msDS-UserAccountDisabled=True** as the **State** attribute value. This setting specifies the required directory attribute and potential value. - Entering `msDS-UserAccountDisabled=True` disables the user account. - Configuring your directory for AD LDS allows for directories other than Active Directories to be used on IDaaS, including Entrust Identity Enterprise. - It also supports directory synchronization and directory password authentication. note This step is recommended for most AD LDS directories that have disabled users with the `msDS-UserAccountDisabled` set to `True`. By configuring the IDaaS user with the value set to `True`, the user is synchronized in the disabled state. Configure this setting differently if your directory settings contain a different attribute and attribute value that indicates that a user is disabled. ### Set the synchronization settings In the **Synchronization** section, do the following: 1. From the **Synchronization Agent** drop-down list, select the Gateway Agent used to connect to the directory and sync users. 2. In the **Page Size** field, enter the number of results on a page. The minimum is `10` and the maximum is `1000`. 3. In the **Crawl Frequency** field, enter the rate at which Active Directory (AD) is queried. The maximum is 24 hours (86400000 ms). note To disable crawling, set the Crawl Frequency to `0`. This feature is available with Gateways 5.4 or later. For Gateways prior to 5.4, the default setting of 1 hour is used. tip Click the time option, for example, **hr** to select to enter the Crawl Frequency rate in milliseconds, seconds, minutes, or hours. 4. In the **User Object Class** field, enter the object class names that define your users in your on-premises directory. For Active Directory users, the User Object Class is usually user, which is the IDaaS default value. Depending on the type of directory you are configuring, valid values can include - user - userProxy - user,userProxy - user, userProxy 5. In the **User Unique Id Attribute** field, specify the directory attribute that IDaaS uses as the persistent identifier for each synchronized user. Leave this field blank to use the Active Directory `objectGUID` attribute. If you specify another attribute, every synchronized user must have a stable, unique value in that attribute, and each value must be a valid UUID in canonical 36-character format. Do not use an account identifier such as `sAMAccountName`. warning Configure this field before the initial synchronization. Changing the unique identifier attribute after users are synchronized can cause IDaaS to treat existing users as new users or cause them to become unsynchronized. 6. From the **Group Synchronization** drop-down list, select the groups that you want to add to IDaaS. Only groups with users synced to IDaaS are created. The group synchronization options include: - **All groups.** All groups from users synced to IDaaS are added. - **Groups Matching Group Filter.** Only groups matching the filter are added to IDaaS. - **No Groups.** No groups are added to IDaaS. 7. The **Group Name Attribute** is `cn` by default. This is the name of the attribute from which IDaaS obtains the group name. 8. Select the **User Desynchronization Policy** from the drop-down list. This policy determines what happens to user accounts in IDaaS that are no longer found in the directory or no longer match the filters. Options include: - **Group removed from IDaaS** to remove the group from IDaaS. - **Group becomes a directory-localized IDaaS group** to keep the group but change it to an unsynchronized group. note For Active Directory directories, scheduled sync runs use Delta sync by default. Delta sync processes only changed objects, making scheduled sync runs faster and reducing LDAP and network load. When you change directory configuration, run a force sync in **Full** mode (full crawl). For detailed information on Delta sync and Full sync and how to choose between them, see [Delta sync and full sync for Active Directory](/docs/directories-and-provisioning/manage-directories/manage-directory-synchronization.md#delta-sync-and-full-sync-for-active-directory). ### Save the directory Click **Add**. When synchronization completes, the new directory appears on the **Directories** **List** page.