Identity
Active Directory (LDAP)
Read-only, scheduled directory sync of users and groups from your own on-prem Active Directory or OpenLDAP over LDAP/LDAPS. Coexists with SCIM; never writes back to the directory.
InboundData residency: EU
Request a demoWhat it does
- Inbound-only in v1: no write-back to AD, no destructive actions
- inetOrgPerson entries → platform users (joined on email, with a userPrincipalName fallback for AD's often-unreliable mail attribute)
- groupOfNames / groupOfUniqueNames entries → platform groups, joined on name
- Account-disabled state read from userAccountControl (AD) or a lock-timestamp attribute (OpenLDAP)
- Attribute names are fully overridable for non-AD LDAP estates
- Coexists with SCIM per tenant for hybrid identity setups
Data residency
AD/LDAP is the tenant's own on-prem directory — its data is wherever the tenant already runs it. No third-party sub-processor is involved, so there's no non-EU acknowledgement to make.
Event mappings
| External event | Maps to | What happens |
|---|---|---|
| inetOrgPerson | user | LDAP user entry → platform user (joined on email, userPrincipalName fallback) |
| groupOfNames | group | LDAP group entry → platform group (joined on name) |
What you configure
- LDAP/LDAPS URL
- TLS required (default on)
- Bind DN — the service account (its password is stored as a secret)
- User base DN + filter (default: (objectClass=inetOrgPerson))
- Group base DN + filter (default: groupOfNames / groupOfUniqueNames)
- Attribute-name overrides for non-AD LDAP estates
- Page size (default 500, max 5000)
Setup overview
Bind with a read-only service account (the password is stored as a secret, never in config). Default sync cadence is hourly. Authenticates via LDAP simple bind, not OAuth.
Related features
See TENSOR running on your own estate.
30 minutes, screen-shared, no slides. Bring the process you are least sure we handle and we will start there.