Skip to main content

LDAP Directory Synchronisation

An on-premises directory (Active Directory, or any LDAP server) knows who your users are, which groups they belong to, and which computers are joined to the domain. The platform uses that to resolve the account names and hosts that appear in events. But the directory is inside your network, and the platform cannot query it from the cloud. So the query runs from a Fluency Collector on the same network, which reads the directory on a schedule and sends what it finds to the platform.

This is the one form of API polling that runs from your network rather than from the cloud. Its output is not an event feed: the results land as records on the Resources page (v1: SIEM → Resources), which is where detections and investigations look names up.

Before You Begin​

  • A registered, connected collector with a network path to a directory server on the LDAP port: see Fluency Collector. Note the collector's name as it appears on Configuration → Collectors (v1: Platform → Administration → Collectors).
  • A bind account in the directory with read access to the objects you want synchronised. A dedicated, non-privileged service account is right: reading users and groups needs no administrative rights, and the password is stored on the platform.
  • The base DN to search under, typically the domain's root, written like DC=corp,DC=example,DC=com, or an organisational unit below it to narrow the scope.

Install the Application​

In the navigation rail, open Applications and click Install Application, then choose LDAP Connector from the Endpoint Management category of the Application Catalog. The parameters are in the form's Configuration section.

Every parameter is required:

ParameterNotes
Local Fluency Collector NameThe collector that will reach the directory server, exactly as named on the Collectors page.
AD/LDAP Server IPThe directory server's address, as the collector reaches it.
AD/LDAP Server PortPre-filled 389, the standard LDAP port.
BaseDN StringThe search base for the directory queries.
UsernameThe bind account.
PasswordThe bind account's password. Masked as you type, and masked in the application's details after installing.

Install LDAP Connector form with the Application section's Instance name and Display name fields, and the Configuration section's Local Fluency Collector Name, AD/LDAP Server IP, AD/LDAP Server Port, BaseDN String, Username and Password fields, above Cancel, Dry run and Install Application

Click Install Application. The Applications page opens with the notice Default is launching., and the new application is listed with a green Running badge once the pipeline is up.

Unlike most templates, LDAP Connector has no datalake or datalake index name parameter: its results are resource records rather than events, so there is no index to name and nothing to collide with another application.

Confirming It Works​

A Running badge means the application was created. Whether the collector could bind to the directory shows up only in the records:

  1. Open Resources from the navigation rail. The page lists the record sets that have been collected, by table name, under a heading for each vendor, with sets from vendors outside its fixed list under Other; until an application has collected any, it reads No resources to show yet.
  2. Open the record sets the directory synchronisation has produced to see their records. A set whose synchronisation ran and found nothing reads No data found.
  3. A record set that has never been loaded is simply absent. Allow time for the first synchronisation; if the directory's record sets stay absent, the collector could not reach or bind to the directory.

See Resources for the page reference.

When It Does Not Work​

SymptomUsual causes
Records never appearThe collector name does not match a registered collector; the collector is offline (No Connection on the Collectors page; v1: a grey dot); no route from the collector to the directory server on the port; a firewall on the directory server.
The collector is online, still no recordsThe bind account's username or password is wrong, or the account is locked or expired; the base DN does not exist or is mistyped.
Records appear, but some users or groups are missingThe base DN is narrower than intended, or the bind account cannot read part of the tree.
Worked, then stoppedThe bind account's password changed or expired; the collector was replaced or deleted.

Changing the Settings​

Parameters are read-only once installed. To change the password, the server or the base DN, uninstall the application and install it again with the new values. To uninstall, click Uninstall at the top right of the application's details page (v1: the red Uninstall button at the foot of its details panel on Platform → Applications). The same applies when the collector is replaced: a new collector has a new name, and the application has to be reinstalled to name it.

Last updated on