Skip to main content

Active Directory integration

You can add an Active Directory data store to assert or manage user identity information.


  • SecureAuth IdP version 9.3 and later

  • Active Directory data store


There are two parts to adding a data store in SecureAuth IdP — (1) adding the data store and (2) mapping the data store properties.

Step 1 of 2: Add an Active Directory data store

The first part of adding an Active Directory data store is configuring the data store name, connections, credentials, and search attributes.

  1. On the left side of the SecureAuth IdP page using the New Experience Web Admin, select User Data Stores.

  2. Click Add a Data Store.

  3. Set the Data Store Name.

  4. Select the Connection Type as Active Directory.

  5. For the Use this directory for user membership validation slider, use one of the following options.


    Enable membership validation; use the directory to search for the user's membership in a user group.

    This means the directory is a Membership Store, containing the password to validate with the username.


    Disable membership validation; use the directory to search only for the user profile information.

    This means the directory is only used to find the username and profile information (such as phone number, email address, device recognition profiles, OATH tokens, and so on).

    After the data store is saved, this field is the Membership Store label shown on the View Summary.


    A common use case for a Membership Store would be to have a directory with username and password information (and maybe some profile information), and then have a second directory or database used to store and access data that SecureAuth IdP writes to the directory (such as device recognition, device enrollment, push notification tokens, and so on).

  6. In the Connection String section, set the connection string for the domain to the Active Directory.


    For information about how to identify the corporate connection string, see the external article How can I figure out my LDAP connection string?

    Source Domain

    The domain for your directory to build the connection string in the next field.

    For example: initech.local

    Connection String

    The value in this field is the connection string auto-populated by the Source Domain field and contains domain and generic values for DC=directory, DC=domain (unless a custom connection string is manually entered).

    For example, the result would be: LDAP://initech.local/DC=initech,DC=local

    advanced mode

    To manually enter the connection string, click the advanced mode link.

  7. In the Credentials section, provide the log in credentials to access the Active Directory data store.

    Enter Service Account Credentials

    With this option, enter the following fields:

    • Service Account Login – Email address for the service account login

    • Password – Password for the service account login


    Use CyberArk Vault for Credentials

    With this option, enter at least one field for the service account login:

    • Username – User name of machine to be scanned by CyberArk Application Identity Manger (AIM). This information appears on the Account Details page of the CyberArk Password Vault Web Access (PVWA) Admin Console

    • Address – Address of machine to be scanned by AIM

    • Safe – Name of Access Control Safe where credentials are stored

    • Folder – Name of folder where account resides (by default, it its the root folder)

    • Object – Unique identifier Object name for the account

  8. In the Search Filter section, define the search attribute to find a user account.

    Username Attribute

    Set the search attribute for the search filter. For example, sAMAccountName or userPrincipalName (UPN).

    Search Filter

    Value is auto-populated in this field.

    Example search filter for sAMAccountName: (&(sAMAccountName=%v)((objectclass=*)))

    Example of search filter for userPrincipalName (UPN): (&(userPrincipalName=%v)((objectclass=user)(objectcategory=person)))

    advanced mode

    To enter a custom search filter, click the advanced mode link.

  9. In the Advanced Settings section, define the attribute to encrypt user profile data.

    Encryption Attribute

    The unique directory value inherits the default value from the Username attribute field to encrypt user profile data.

    For example: samAccountName

    Validate User Type

    Choose how to validate usernames and passwords in Active Directory:

    • Bind – Make a direct call to the directory to validate the username and password (faster search)

    • Search – Use the search function to find and validate a username and password (slower search)

    Connection Mode

    Select how SecureAuth IdP and the directory connect:

    • Secure – Use a secure LDAP connection on Port 389, using NTLMv2

    • SSL – Use a secure connection on Port 636, but uses Secure Socket Layer technology, which relies on certificates

    • Standard – Use a standard LDAP connection on Port 389 that uses basic authentication (plain text)

    Allow Anonymous Queries

    Move the slider to indicate whether non-authenticated users should also be granted access to browse the protected resource.

    In most cases, this setting should be off; unless using a generic LDAP directory.

    Allow Advanced User Checks

    Move the slider to indicate whether to allow SecureAuth IdP to search this directory for more user information. This is useful in a scenario in which a user account is locked.

  10. Click Continue.

    The Map Data Store Properties page opens.


Step 2 of 2: Map the Active Directory data store properties

The second part of adding an Active Directory data store is mapping the data store properties.

Each user is uniquely identified by profile data that is read from or stored in your directories and databases.

SecureAuth IdP does not store user profiles, so your organizational directory attributes must be mapped to SecureAuth IdP profile properties to be read and updated in the directory by SecureAuth IdP. The directory attribute mapped to the property is retrieved only when required for authentication or assertion purposes.


Each mapped profile property should have its own directory attribute. It is not recommended to map the same directory attribute to more than one property.

For example, the mobile attribute is mapped to Phone 2, so you would use a different attribute for Phone 3.

  1. On the Map Data Stores Properties page, define the required attributes in the Active Directory Field that corresponds to each Active Directory property required by your environment and SecureAuth IdP. The required attributes are:

    • First Name

    • Last Name

    • Groups

    • Email 1 (Work)

  2. Define the recommended attributes in the Active Directory Field that corresponds to each Active Directory property. The recommended attributes are:

    • Phone 1 (Work)

    • Phone 2 (Mobile)

  3. Where applicable, specify the Data Format to define how data is encrypted and stored in the directory. The selection options are:

    • Plain Text – store data as regular, readable text (default)

    • Standard Encryption – store and encrypt data using RSA encryption

    • Advanced Encryption – store and encrypt data using AES encryption

    • Standard Hash – store and encrypt data using SHA-256 hash

    • Plain Binary – store data in a binary format (uses a .NET library to make it binary – may not be readable by all applications)

    • JSON – store data in a universal format, readable by all applications (similar to Plain Text)

    • Encrypted JSON – store data in JSON format, with values encrypted using AES encryption

  4. Save the data store configuration.

    The Active Directory data store you just added appears in the User Data Stores list.