Active Directory and LDAP
Connect ExaVault to Active Directory or another LDAP directory to centralize authentication and directory data. The LDAP connection can validate passwords. Active Directory sync, configured on the same screen, can also provision users and groups.
How the LDAP Screen Works
The LDAP screen configures the connection to your LDAP or Active Directory server.
That same connection can serve two jobs.
LDAP authentication validates a user's password against the directory at sign-in time. You still create and maintain the ExaVault user.
Active Directory sync imports users and groups. Active Directory becomes the source of truth for the synced records.
If you only need centralized password validation, configure LDAP Authentication and stop there.
If you also need automatic user and group provisioning, configure Active Directory Sync, which requires more information.
How LDAP Authentication Works
LDAP authentication occurs when an ExaVault user configured for Active Directory & LDAP attempts to sign in.
ExaVault authenticates by binding to the LDAP server with the username and password supplied at sign-in.
ExaVault only attempts LDAP authentication for users that already exist in ExaVault and are configured to use LDAP authentication. If the user does not exist locally, ExaVault rejects the login attempt without contacting your LDAP server.
ExaVault supports multiple LDAP servers per site. When a user logs in who has their Authentication set to Active Directory & LDAP, ExaVault tries each configured LDAP server. When authentication fails against one server, ExaVault attempts the next server in order.
After a successful LDAP bind, ExaVault still enforces ExaVault account checks. An account that is valid in your LDAP but expired or disabled cannot log in to ExaVault.
How Active Directory Sync (AD Sync) Works
Active Directory sync adds automatic user and group provisioning to your LDAP configuration. Use this when you already need LDAP or Active Directory connectivity and you want Active Directory to control user lifecycle and group membership in ExaVault.
Active Directory sync manages user and group records. It does not validate user passwords at sign-in time.
Synchronization starts from the Active Directory security group you choose. ExaVault finds the group by matching its common name (CN) to the configured Group in the LDAP Server Configuration.
ExaVault imports all direct members of that group. ExaVault also imports nested groups by processing group membership recursively.
ExaVault treats Active Directory as the source of truth for synced objects.
ExaVault creates or updates groups it finds in Active Directory.
ExaVault creates or updates users it finds in Active Directory.
ExaVault disables previously synced users that do not appear in the current sync.
ExaVault deletes previously synced groups that do not appear in the current sync.
ExaVault treats synced groups as AD-managed groups. ExaVault removes non-synced users from AD-managed groups during sync.
ExaVault ignores machine accounts.
LDAP Configuration Screen
AD/LDAP Server Name
Human-readable name for the directory server
LDAP authentication and AD sync
AD/LDAP Server
Server address beginning with ldap:// or ldaps://
LDAP authentication and AD sync
Port
Directory-server port, commonly 389 for LDAP or 636 for LDAPS
LDAP authentication and AD sync
Security Level
Connection security: None, SSL, or TLS
LDAP authentication and AD sync
Group
CN of the Active Directory security group to import; defaults to ExaVault
AD sync
Service account username
Account used to search Active Directory during synchronization
AD sync
Service account password
Password for the synchronization service account
AD sync
Base DN
Starting point for directory searches, such as DC=corp,DC=example,DC=com
LDAP authentication and AD sync
User E-mail Field
Whether synced users map by UPN or email
AD sync
Certificate Name
Filename of a client certificate stored under /etc/ssl/
LDAP authentication and AD sync
Username Prefix and Username Suffix
The Username Prefix and Username Suffix fields are used to format the bind username when querying the LDAP server during authentication.
ExaVault concatenates them in the order Username Prefix + Username + Username Suffix to form the bind username used for the LDAP query.
ExaVault supports three bind-username formats:
NetBIOS domain format: set Username Prefix to
DOMAIN\and leave Username Suffix empty.UPN format: leave Username Prefix empty and set Username Suffix to a value such as
@example.com.Distinguished-name format: set Username Prefix and Username Suffix so the result is a full DN. For example, use
uid=and,ou=people,dc=example,dc=org.
Configuring LDAP Servers
To configure LDAP authentication, you will need:
Server address, port, and connection security
Whether the local email address or user ID supplies the UPN
Prefix and suffix used to construct the directory bind username
Add the information on the LDAP screen under Admin Settings. Complete the fields listed for LDAP authentication in the configuration table.
Configuring Active Directory Sync
Active Directory sync uses the LDAP server configuration for connectivity. Complete the LDAP connection fields on the LDAP screen under Admin Settings, then provide:
The service-account username and password used to search Active Directory
The CN of the Active Directory security group to synchronize
The service-account username also uses the configured Username Prefix and Username Suffix during the bind.
Set the Group name to the Common Name (CN) of the Active Directory security group that will be synced to ExaVault. Only users and sub-groups that are members of this group will be imported into ExaVault.
Configure a User to Use LDAP Authentication
Create the user in ExaVault and set Authentication to Active Directory & LDAP. Do not assign an ExaVault password; the directory validates the credentials supplied at sign-in.
Last updated