Microsoft Active Directory

Connector

The directory connector to use when communicating with the directory server.

URL

The connection URL to use when connecting to the directory server. The URL for Microsoft Active Directory should be in the following format: ldap://domainname:port. Examples:
Plain connection: ldap://localhost:389
SSL connection: ldaps://localhost:636

Secure SSL

Specifies whether the connection to the directory server is an SSL connection. Please ensure that you have followed the instructions to configure an SSL Certificate before enabling this setting.

Use Node Referrals

Use the JNDI lookup java.naming.referral option. Generally needed for Active Directory servers configured without proper DNS, to prevent a 'javax.naming.PartialResultException: Unprocessed Continuation Reference(s)' error.

Use Nested Groups

Enable or disable support for nested groups on the LDAP user directory.

Use the User Membership Attribute

Put a tick in the checkbox if your Active Directory supports the group membership attribute on the user. (By default, this is the 'memberOf' attribute.)

• If this checkbox is ticked, Crowd will use the group membership attribute on the user when retrieving the members of a given group. This will result in a more efficient retrieval.
• If this checkbox is not ticked, Crowd will use the members attribute on the group ('member' by default) for the search.
• If the 'Use Nested Groups' checkbox is ticked, Crowd will ignore the 'Use the User Membership Attribute' option and will use the members attribute on the group for the search.

Use 'memberOf' for Group Membership

Put a tick in the checkbox if your Active Directory supports the 'memberOf' attribute on the user.

• If this checkbox is ticked, Crowd will use the 'memberOf' attribute when retrieving the list of groups to which a given user belongs. This will result in a more efficient search.
• If this checkbox is not ticked, Crowd will use the members attribute on the group ('member' by default) for the search.

Use Paged Results

Use the LDAP control extension for simple paging of search results. Retrieves chunks of data rather than all of the search results at once. This feature may be necessary when using Microsoft Active Directory if more than 999 results are returned for any given search.

Paged Results Size

Enter the desired page size i.e. the maximum number of search results to be returned per page, when paged results are enabled. Defaults to 999 results.

Use Naive DN Matching

This setting determines how Crowd will compare DNs to determine if they are equal. See Using Naive DN Matching.

• If this checkbox is ticked, Crowd will do a direct, case-insensitive, string comparison. This is the default and recommended setting for Active Directory, because Active Directory guarantees the format of DNs. Using naive DN matching will result in a significant performance improvement.
• If this checkbox is not ticked, Crowd will parse the DN and then check the parsed version.

Enable Incremental Sync

Crowd supports retrieving only changes made after last synchronisation when connecting to Active Directory.

• If this checkbox is ticked, Crowd will, when possible, only retrieve changes made after the last synchronisation. This is the default and recommended setting for Active Directory.
• If this checkbox is not ticked, Crowd will retrieve the whole dataset on every synchronisation round.

Polling Interval

Crowd will send a request to Active Directory every x minutes, where 'x' is the number specified here. Please read the full instructions: Configuring Caching for an LDAP Directory.

Read Timeout

The time, in seconds, to wait for a response to be received. If there is no response within the specified time period, the read attempt will be aborted. A value of 0 (zero) means there is no limit.

Search Timeout

The time, in seconds, to wait for a response from a search operation. A value of 0 (zero) means there is no limit.

Connection Timeout

The time, in seconds, to wait when opening new server connections. If not specified, the TCP network timeout will be used, which may be several minutes.

Base DN

Enter the root distinguished name to use when running queries versus the directory server. Examples:
o=acmecorp,c=com
cn=users,dc=ad,dc=acmecorp,dc=com
For Microsoft Active Directory, specify the Base DN in the following format: dc=domain1,dc=local. You will need to replace the domain1 and local for your specific configuration. Microsoft Server provides a tool called ldp.exe which is useful for finding out and configuring the the LDAP structure of your server.

User DN

Distinguished name of the user that Crowd will use when connecting to the directory server. For example: cn=administrator,cn=users,dc=ad,dc=acmecorp,dc=com

Password

The password of the user specified above.