Integration profile
Directory source · Active Directory · LDAPS
Configure a read-only source and preview identity matching before apply.
Demo baseline · November 13, 2026Connection and scope
Use a dedicated read-only bind account. Secret JSON: bindDn, password; optional ca PEM. Only ldaps:// on 636 or 3269 with certificate verification is accepted. For private AD, establish a VPC/VPN route and explicitly allow its CIDRs. objectGUID is converted from AD byte order to a stable UUID.
- Transport
ldap- External ID
objectGUID- Default coalescing path
mail
Provider fields
| Key | Label | Example |
|---|---|---|
baseDn | Search base DN | DC=example,DC=com |
filter | LDAP user filter | (&(objectCategory=person)(objectClass=user)) |
privateCidrs | Approved private network CIDRs | 10.20.0.0/16 |
caAlias | Optional private CA credential alias | directory-ca |
Default mapping
| Source | Target | Transform |
|---|---|---|
givenName | firstName | text |
sn | lastName | text |
mail | email | lower |
sAMAccountName | username | lower |
employeeID | employeeNumber | text |
objectGUID | ldapCorrelationId | text |
Verify and troubleshoot
Preview, apply, and diagnose a directory import. Verify the immutable key, existing-account match, complete pagination and disable thresholds before applying.