> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/authentication-and-identity/active-directory-and-ldap.md).

# Active Directory and LDAP

Connect ExaVault to Active Directory or another LDAP directory to centralize authentication and directory data. The LDAP connection can validate passwords. Active Directory sync, configured on the same screen, can also provision users and groups.

## How the LDAP Screen Works

The LDAP screen configures the connection to your LDAP or Active Directory server.

That same connection can serve two jobs.

* LDAP authentication validates a user's password against the directory at sign-in time. You still create and maintain the ExaVault user.
* Active Directory sync imports users and groups. Active Directory becomes the source of truth for the synced records.

If you only need centralized password validation, [configure LDAP Authentication](#configuring-ldap-servers) and stop there.

If you also need automatic user and group provisioning, [configure Active Directory Sync](#configuring-active-directory-sync), which requires more information.

## How LDAP Authentication Works

LDAP authentication occurs when an [ExaVault user configured for *Active Directory & LDAP*](#configure-a-user-to-use-ldap-authentication) attempts to sign in.

ExaVault authenticates by binding to the LDAP server with the username and password supplied at sign-in.

ExaVault only attempts LDAP authentication for users that already exist in ExaVault and are configured to use LDAP authentication. If the user does not exist locally, ExaVault rejects the login attempt without contacting your LDAP server.

ExaVault supports multiple LDAP servers per site. When a user logs in who has their *Authentication* set to *Active Directory & LDAP*, ExaVault tries each [configured LDAP server](#configuring-ldap-servers). When authentication fails against one server, ExaVault attempts the next server in order.

After a successful LDAP bind, ExaVault still enforces ExaVault account checks. An account that is valid in your LDAP but expired or disabled cannot log in to ExaVault.

## How Active Directory Sync (AD Sync) Works

Active Directory sync adds automatic user and group provisioning to your LDAP configuration. Use this when you already need LDAP or Active Directory connectivity and you want Active Directory to control user lifecycle and group membership in ExaVault.

Active Directory sync manages user and group records. It does not validate user passwords at sign-in time.

Synchronization starts from the Active Directory security group you choose. ExaVault finds the group by matching its common name (CN) to the configured *Group* in the [LDAP Server Configuration](#ldap-configuration-screen).

ExaVault imports all direct members of that group. ExaVault also imports nested groups by processing group membership recursively.

ExaVault treats Active Directory as the source of truth for synced objects.

* ExaVault creates or updates groups it finds in Active Directory.
* ExaVault creates or updates users it finds in Active Directory.
* ExaVault disables previously synced users that do not appear in the current sync.
* ExaVault deletes previously synced groups that do not appear in the current sync.

ExaVault treats synced groups as AD-managed groups. ExaVault removes non-synced users from AD-managed groups during sync.

ExaVault ignores machine accounts.

## LDAP Configuration Screen

| Field                                                     | Details                                                                     | Used For                        |
| --------------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------- |
| *AD/LDAP Server Name*                                     | Human-readable name for the directory server                                | LDAP authentication and AD sync |
| *AD/LDAP Server*                                          | Server address beginning with `ldap://` or `ldaps://`                       | LDAP authentication and AD sync |
| *Port*                                                    | Directory-server port, commonly `389` for LDAP or `636` for LDAPS           | LDAP authentication and AD sync |
| *Security Level*                                          | Connection security: *None*, *SSL*, or *TLS*                                | LDAP authentication and AD sync |
| [*Username Prefix*](#username-prefix-and-username-suffix) | Text added before the username when binding                                 | LDAP authentication and AD sync |
| [*Username Suffix*](#username-prefix-and-username-suffix) | Text added after the username when binding                                  | LDAP authentication and AD sync |
| *Group*                                                   | CN of the Active Directory security group to import; defaults to `ExaVault` | AD sync                         |
| *Service account username*                                | Account used to search Active Directory during synchronization              | AD sync                         |
| *Service account password*                                | Password for the synchronization service account                            | AD sync                         |
| *Base DN*                                                 | Starting point for directory searches, such as `DC=corp,DC=example,DC=com`  | LDAP authentication and AD sync |
| *User E-mail Field*                                       | Whether synced users map by UPN or email                                    | AD sync                         |
| *Certificate Name*                                        | Filename of a client certificate stored under `/etc/ssl/`                   | LDAP authentication and AD sync |

### Username Prefix and Username Suffix

The Username Prefix and Username Suffix fields are used to format the bind username when querying the LDAP server during authentication.

ExaVault concatenates them in the order `Username Prefix` + `Username` + `Username Suffix` to form the bind username used for the LDAP query.

ExaVault supports three bind-username formats:

* NetBIOS domain format: set *Username Prefix* to `DOMAIN\` and leave *Username Suffix* empty.
* UPN format: leave *Username Prefix* empty and set *Username Suffix* to a value such as `@example.com`.
* Distinguished-name format: set *Username Prefix* and *Username Suffix* so the result is a full DN. For example, use `uid=` and `,ou=people,dc=example,dc=org`.

## Configuring LDAP Servers

To configure LDAP authentication, you will need:

* Server address, port, and connection security
* Whether the local email address or user ID supplies the UPN
* Prefix and suffix used to construct the directory bind username

Add the information on the *LDAP* screen under *Admin Settings*. Complete the fields listed for LDAP authentication in the [configuration table](#ldap-configuration-screen).

## Configuring Active Directory Sync

Active Directory sync uses the LDAP server configuration for connectivity. Complete the LDAP connection fields on the *LDAP* screen under *Admin Settings*, then provide:

* The service-account username and password used to search Active Directory
* The CN of the Active Directory security group to synchronize

The service-account username also uses the configured [*Username Prefix* and *Username Suffix*](#username-prefix-and-username-suffix) during the bind.

Set the *Group* name to the Common Name (CN) of the Active Directory security group that will be synced to ExaVault. Only users and sub-groups that are members of this group will be imported into ExaVault.

## Configure a User to Use LDAP Authentication

Create the user in ExaVault and set *Authentication* to *Active Directory & LDAP*. Do not assign an ExaVault password; the directory validates the credentials supplied at sign-in.