You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*[Two-way LDAP and Active Directory synchronization](enterprise/all-enteprise-features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md)
| URL | URL that points to your LDAP server. | empty |
@@ -21,3 +19,9 @@ description: List with description of settings for LDAP found in settings page.
21
19
| Group Member Attribute | Naming attribute for group membership. | uniqueMember |
22
20
| Group Search Base | Relative Distinguished Name (RDN) of your group entries. | ou=groups,dc=example,dc=org |
23
21
22
+
## Settings in depth
23
+
24
+
There are a few settings that may be not so obvious:
25
+
26
+
*`Additional User Object Classes`: User object classes that will be assigned to a user and will also define assigned attributes. For example, `simpleSecurityObject` will make users posses the `userPassword`attribute.
27
+
*`User Object Class`: The structural class of your users. Just like the additional user object classes it will define the added attributes but also will be used during user search. Defguard will only consider entries with this class as users.
Copy file name to clipboardExpand all lines: enterprise/all-enteprise-features/ldap-and-active-directory-integration/two-way-ldap-and-active-directory-synchronization.md
+32-9
Original file line number
Diff line number
Diff line change
@@ -2,14 +2,14 @@
2
2
icon: arrow-right-arrow-left
3
3
---
4
4
5
-
# LDAP two way synchronization
5
+
# Two-way LDAP and Active Directory synchronization
6
6
7
7
{% hint style="warning" %}
8
-
This is an alpha feature available in Defguard core v1.2.5 alpha builds and above
8
+
This is an alpha feature available in Defguard core v1.2.5 alpha builds and above. It may not be production ready yet and may have some bugs. Report any issues you find on our [GitHub](https://github.com/DefGuard/defguard/issues).
9
9
{% endhint %}
10
10
11
11
{% hint style="danger" %}
12
-
Make sure to be aware of the mechanisms described in [#authority-and-full-synchronization](ldap-two-way-synchronization.md#authority-and-full-synchronization"mention")and [#first-synchronization](ldap-two-way-synchronization.md#first-synchronization"mention") before enabling this feature, as improper use may cause loss of user data.
12
+
Make sure to be aware of the mechanisms described in [#authority-and-full-synchronization](two-way-ldap-and-active-directory-synchronization.md#authority-and-full-synchronization"mention")and [#first-synchronization](two-way-ldap-and-active-directory-synchronization.md#first-synchronization"mention") before enabling this feature, as improper use may cause loss of user data.
13
13
{% endhint %}
14
14
15
15
The LDAP synchronization allows for synchronizing users and groups between Defguard and your LDAP server.
@@ -49,7 +49,7 @@ The LDAP two way synchronization has the following options available:
***Enable LDAP two-way synchronization** - enables the two way synchronization. Check it if you want to pull changes from LDAP.
52
-
***Consider the following source as the authority** - makes the selected server the source of truth. See [#authority-and-full-synchronization](ldap-two-way-synchronization.md#authority-and-full-synchronization"mention") for more details.
52
+
***Consider the following source as the authority** - makes the selected server the source of truth. See [#authority-and-full-synchronization](two-way-ldap-and-active-directory-synchronization.md#authority-and-full-synchronization"mention") for more details.
53
53
***Synchronization interval** - how often (in seconds) to pull LDAP changes
54
54
55
55
If you enable the LDAP integration but not the two-way synchronization, your changes in Defguard will be propagated to LDAP but not the other way around.
@@ -60,11 +60,11 @@ The goal of the LDAP two-way synchronization is to make the two data sources (LD
60
60
61
61
#### Synchronous synchronization
62
62
63
-
Synchronous synchronization happens every time a change occurs in Defguard, e.g. when a user is modified, added or removed. In this case a respective change is immediately sent to the LDAP server. This synchronization always happens if you select "Enable LDAP integration".
63
+
Synchronous synchronization happens every time a change occurs in Defguard, e.g. when a user is modified, added or removed. In this case a respective change is immediately sent to the LDAP server. This synchronization always happens if you select "Enable LDAP integration". It's part of the so called "incremental synchronization".
64
64
65
65
#### Asynchronous synchronization
66
66
67
-
Asynchronous synchronization happens periodically in the background and it happens only when you enable the two-way synchronization. This synchronization pulls changes from your LDAP server to be applied in Defguard. The interval of this synchronization may be configured using the "Synchronization interval" setting in the LDAP settings.
67
+
Asynchronous synchronization happens periodically in the background and it happens only when you enable the two-way synchronization. This synchronization pulls changes from your LDAP server to be applied in Defguard. The interval of this synchronization may be configured using the "Synchronization interval" setting in the LDAP settings. It's part of the so called "incremental synchronization".
68
68
69
69
#### Authority and full synchronization
70
70
@@ -73,7 +73,7 @@ Authority is the setting allowing you to set which source will be considered as
73
73
* If you are most likely to manage your users in the LDAP server with occasional changes in Defguard, select the LDAP server as the authority.
74
74
* If you are most likely to manage users in Defguard, leave Defguard as the authority
75
75
76
-
Authority is used during a full synchronization. This type of synchronization may occur when Defguard assumes that the two sources may have diverged and regular synchronization won't be possible. This can happen in two scenarios:
76
+
The selected authority is used during a full synchronization. This type of synchronization may occur when Defguard assumes that the two sources may have diverged and regular synchronization won't be possible. This can happen in two scenarios:
77
77
78
78
* First synchronization after enabling two-way synchronization will always be a full synchronization, since Defguard can't gracefully merge changes that were made before.
79
79
* Some issue prevented Defguard from synchronously sending a change to the LDAP server
@@ -97,7 +97,7 @@ This can be summed up as: authority indicates the most likely place where a chan
97
97
98
98
### First synchronization
99
99
100
-
The first synchronization will replace all your records with the records of the other source, so it's important to select the direction correctly. This is done by setting the authority, discussed in [#authority-and-full-synchronization](ldap-two-way-synchronization.md#authority-and-full-synchronization"mention"). In short:
100
+
The first synchronization will replace all your records with the records of the other source, so it's important to select the direction correctly. This is done by setting the authority, discussed in [#authority-and-full-synchronization](two-way-ldap-and-active-directory-synchronization.md#authority-and-full-synchronization"mention"). In short:
101
101
102
102
* LDAP → Defguard: If you want to replace all Defguard users with LDAP users, set LDAP as the authority
103
103
* Defguard → LDAP: If you want to replace all LDAP users with Defguard users, set Defguard as the authority
@@ -118,12 +118,35 @@ Because some LDAP implementations will require password on user creation, Defgua
118
118
119
119
Defguard doesn't pull passwords from LDAP in any form. Instead, when user tries to login to Defguard, if the LDAP integration is enabled, test login attempt will be made to the LDAP server (bind) with the provided credentials. If the test login attempt succeeds, Defguard will authenticate the user just as during a regular login.
120
120
121
+
## Known issues
121
122
123
+
### General
122
124
123
-
## Known issues
125
+
#### Users are losing their groups (e.g. "admin" group)
126
+
127
+
Your LDAP server may have silently refused creating a Defguard group. A common cause may be a DN conflict, e.g. when the DN for your groups and users has the same structure (`cn=<NAME>,cn=users,dc=example,dc=com` both for users and groups). To solve this, create a new group with a name that won't conflict with any other DN.
128
+
129
+
Otherwise, report it on our GitHub along with any appropriate logs.
130
+
131
+
#### Can't edit Defguard user because of invalid username
132
+
133
+
Your LDAP server may allow for usernames that Defguard doesn't accept, e.g. with spaces. Currently the only way to prevent this from happening is not using such usernames in LDAP if you need the ability to update them in Defguard.
134
+
135
+
#### Can't login with my LDAP username
136
+
137
+
If Defguard doesn't accept your LDAP username because it has some invalid characters, try logging in through your email address.
138
+
139
+
#### Something wasn't updated in LDAP
140
+
141
+
If you notice that your Defguard change isn't propagated properly to LDAP, run Defguard with debug logs enabled (`DEFGUARD_LOG_LEVEL=debug` environment variable). Some LDAP errors may be not reported as errors by the LDAP server but most of the operations outputs are logged in the debug logs to help you narrow down the issue.
142
+
143
+
#### Defguard logs suggest that it uses LDAP authority during synchronization despite setting something different in the settings
144
+
145
+
Incremental synchronization (as opposed to the full synchronization) internally uses LDAP as the authority. This is only an implementation detail to pull and apply changes from LDAP. The authoritative source you picked in settings is only used during full synchronization.
124
146
125
147
### Active Directory
126
148
127
149
#### SysErr: DSID-031A1262, problem 22 (Invalid argument)
128
150
129
151
You are trying to synchronize a Defguard user with username longer than 20 characters, which [AD doesn't support](https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccountname?redirectedfrom=MSDN).
0 commit comments