Active Directory syncer
The Active Directory syncer pulls users from Microsoft Active Directory into Casdoor over LDAP or LDAPS and keeps the directory in sync.
Необхідні умови
You need:
- An Active Directory domain controller accessible via network
- A service account with read permissions to the user directory
- The Base DN (search base) for your user directory
- Network connectivity on LDAP port 389 (or LDAPS port 636 for secure connection)
Конфігурація
To create an Active Directory syncer in Casdoor:
- Navigate to the Syncers tab
- Click Add to create a new syncer
- Fill in the following required fields:
| Поле | Опис | Приклад |
|---|---|---|
| Організація | The Casdoor organization where users will be imported | my-org |
| Ім'я | A unique identifier for this syncer | ad-syncer |
| Тип - підказка | Select "Active Directory" | Active Directory |
| Сервер | Hostname or IP address of your AD domain controller | dc.example.com |
| LDAP Port | LDAP port (389 for LDAP, 636 for LDAPS) | 389 |
| DN прив'язки | Distinguished name of the service account | CN=Service Account,CN=Users,DC=example,DC=com |
| Пароль | Password for the service account | your-password |
| Базовий DN | Search base for users | DC=example,DC=com |
Leave database-related fields (Database type, Database, Table) empty for the Active Directory syncer.
порада
For production environments, it's recommended to use LDAPS (port 636) for secure communication with Active Directory.
Field Mappings
The syncer automatically maps Active Directory user attributes to Casdoor user fields:
| Active Directory Field | Casdoor Field | Опис |
|---|---|---|
| objectGUID | Id | User's unique identifier (GUID) |
| sAMAccountName | Ім'я | Username (login name) |
| displayName | Відображуване ім'я | Відображуване ім'я |
| givenName | FirstName | Ім'я |
| sn | LastName | Прізвище |
| Електронна пошта | Email address | |
| мобільний | Телефон | Mobile phone number |
| заголовок | Заголовок | Job title |
| department | Приналежність | Department |
| userAccountControl | IsForbidden | Account status |
інформація
userAccountControl bit 2 indicates a disabled account; those users are marked as forbidden in Casdoor.
Running the syncer
- Click Test Connection to verify connectivity and credentials.
- Toggle Is enabled and click Sync for an immediate run.
- The syncer fetches all user accounts under the Base DN using the filter
(&(objectClass=user)(objectCategory=person))(computers and other AD objects are excluded).
Усунення несправностей
If the syncer fails to connect or retrieve users, check the following:
- Verify network connectivity to the AD domain controller on the LDAP port
- Ensure the Bind DN and password are correct
- Confirm the service account has read permissions on the Base DN
- Check that the Base DN is correctly formatted (e.g.,
DC=example,DC=com) - Verify firewall rules allow LDAP traffic from Casdoor to the domain controller