📁 LDAP / Active Directory
Directory via LDAPv3 — Active Directory, OpenLDAP, 389-DS. Authentication via simple-bind or GSSAPI.
Identification
- vendor key:
ldap - engine:
ldap - default role:
bidirectional - type: Generic protocol
Supported auth methods
basic
Importable objects (2)
Object types the wizard offers to import out of the box.
Users (inetOrgPerson)
- name:
users - iga_target:
identity - path:
ou=Users,dc=example,dc=local
LDAP user search base. The filter is set in engine_config.extra (e.g. (objectClass=user)).
Default field mappings:
| IGA field | Expression | Required |
|---|---|---|
business_id |
{{ distinguishedName }} |
✓ |
identity_id |
{{ sAMAccountName|if_null(uid) }} |
✓ |
email |
{{ mail }} |
|
first_name |
{{ givenName }} |
|
last_name |
{{ sn }} |
|
display_name |
{{ displayName|if_null(cn) }} |
|
department |
{{ department }} |
|
function |
{{ title }} |
|
manager_id |
{{ manager }} |
|
employee_id |
{{ employeeID|if_null(employeeNumber) }} |
|
native_account_name |
{{ sAMAccountName|if_null(uid) }} |
✓ |
identity_business_id |
{{ mail|if_null(userPrincipalName)|lower }} |
|
status |
{{ 'active' if (userAccountControl|int & 2) == 0 else 'suspended' }} |
|
is_privileged |
{{ false }} |
Groups
- name:
groups - iga_target:
entitlement - path:
ou=Groups,dc=example,dc=local
LDAP group search base. Filter e.g. (objectClass=group).
Default field mappings:
| IGA field | Expression | Required |
|---|---|---|
business_id |
{{ distinguishedName }} |
✓ |
name |
{{ cn }} |
✓ |
description |
{{ description }} |
|
native_identifier |
{{ distinguishedName }} |
|
risk_level |
{{ 'high' if ('Admin' in (cn or '') or 'Domain' in (cn or '')) else 'low' }} |
|
owner_identity_id |
{{ managedBy|if_null('') }} |
Onboarding setup checklist
Create a dedicated service account in LDAP/AD with read (and optionally write) permissions on the relevant organizational units (OUs), and give IGA access via ldaps:// over port 636. ~10 minutes on a new directory.
Estimated time: ~10 min. The wizard exposes this checklist as a drawer (📋 button) during onboarding. See the Onboarding wizard walkthrough for context.