Active Directory syncer
The Active Directory syncer pulls users from Microsoft Active Directory into Casdoor over LDAP or LDAPS and keeps the directory in sync.
前提条件
You need:
- An Active Directory domain controller accessible via network
- A service account with read permissions to the user directory
- The Base DN (search base) for your user directory
- Network connectivity on LDAP port 389 (or LDAPS port 636 for secure connection)
設定
To create an Active Directory syncer in Casdoor:
- Navigate to the Syncers tab
- Click Add to create a new syncer
- Fill in the following required fields:
| フィールド | 説明 | 例 |
|---|---|---|
| 組織 | The Casdoor organization where users will be imported | my-org |
| 名前 | A unique identifier for this syncer | ad-syncer |
| タイプ - ツールチップ | Select "Active Directory" | Active Directory |
| サーバー | Hostname or IP address of your AD domain controller | dc.example.com |
| LDAP Port | LDAP port (389 for LDAP, 636 for LDAPS) | 389 |
| バインドDN | Distinguished name of the service account | CN=Service Account,CN=Users,DC=example,DC=com |
| パスワード | Password for the service account | your-password |
| Base DN | Search base for users | DC=example,DC=com |
Leave database-related fields (Database type, Database, Table) empty for the Active Directory syncer.
ヒント
For production environments, it's recommended to use LDAPS (port 636) for secure communication with Active Directory.
Field Mappings
The syncer automatically maps Active Directory user attributes to Casdoor user fields:
| Active Directory Field | Casdoor Field | 説明 |
|---|---|---|
| objectGUID | Id | User's unique identifier (GUID) |
| sAMAccountName | 名前 | Username (login name) |
| displayName | 表示名 | 表示名 |
| givenName | FirstName | 名前 |
| sn | LastName | 苗字 |
| メールアドレス | ||
| モバイル | 電話 | Mobile phone number |
| タイトル | タイトル | Job title |
| department | 所属 | Department |
| userAccountControl | IsForbidden | Account status |
情報
userAccountControl bit 2 indicates a disabled account; those users are marked as forbidden in Casdoor.
Running the syncer
- Click Test Connection to verify connectivity and credentials.
- Toggle Is enabled and click Sync for an immediate run.
- The syncer fetches all user accounts under the Base DN using the filter
(&(objectClass=user)(objectCategory=person))(computers and other AD objects are excluded).
トラブルシューティング
If the syncer fails to connect or retrieve users, check the following:
- Verify network connectivity to the AD domain controller on the LDAP port
- Ensure the Bind DN and password are correct
- Confirm the service account has read permissions on the Base DN
- Check that the Base DN is correctly formatted (e.g.,
DC=example,DC=com) - Verify firewall rules allow LDAP traffic from Casdoor to the domain controller