5.3Creating a connection

You need the adconnections:create permission.

To create a connection:

1. 1Go to Directory › Connections and select + Create Connection. The New AD connection form opens.
2. 2In the Server group, enter the Domain controller (host or IP) and check the Port.
3. 3Switch Use SSL (LDAPS) on for an encrypted connection. The port changes from 389 to 636 automatically.
4. 4In the Sign-in group, check the Domain, then enter the Bind username and Bind password. Select Show inside the password field if you want to check what you typed.
5. 5Optionally, in the Details group, enter a Base DN, a Description and Tags.
6. 6Select Test connection to check that the platform can sign in with these values. The result appears in the bar at the bottom of the form.
7. 7Select Create connection.

The bar at the bottom of the form tells you what is still missing — for example "Still needed: domain controller, bind password" — until every required field is filled in. Test connection and Create connection stay disabled until then.

After the connection is created you see "Connection created successfully", and the platform opens the new connection's edit screen (or returns to the list if you cannot edit connections). From the edit screen you can go on to protect sensitive containers (see 5.8 Agent safeguards: protected containers).

Field reference

How the form helps you

• Domain from the host. When you type a fully qualified domain controller name of at least three parts, the form fills in Domain with everything after the first label: dc1.corp.local gives corp.local. The hint "from the host — edit if different" shows while the value is derived. As soon as you type your own domain, the form stops changing it. Nothing is derived from an IP address.
• Placeholders that match your domain. Once the domain is known, the Bind username placeholder suggests admin@<domain> and the Base DN placeholder shows the domain root, for example DC=corp,DC=local.
• Port follows SSL. Switching Use SSL (LDAPS) on changes port 389 to 636, and switching it off changes 636 back to 389. If you typed a different port on purpose — for example 3269 for the Global Catalog over SSL — the switch leaves it alone.

Port and SSL must agree

The platform refuses two combinations that can never work and tells you so with the message "Use SSL does not match the port: 389 and 3268 are plain LDAP, 636 and 3269 are LDAP over SSL."

Any other port is accepted with either setting, so a domain controller or an Active Directory Lightweight Directory Services instance on a custom port works.

The base DN

The base DN sets where the platform starts when it works in the directory. Leave it empty to manage the whole domain. Enter a container such as OU=Corp,DC=corp,DC=local to keep the platform's view to that part of the directory.

Note: The base DN scopes what is managed, not who may sign in. Windows sign-in looks accounts up from the root of the domain regardless of the base DN (see 5.9 Connections trusted for Windows sign-in).

Tags

Tags describe what a directory is for — for example production, standby, lab or hr. They are shown wherever a connection is chosen: the workspace picker, the scope bars on the policy and notification screens, and the directory list on the role form. Where two connections have similar domain names, the tags are often the only way to tell a production forest from its stand-by copy.

To add a tag, type it in the Tags field and press Enter or type a comma. A tag you typed but did not confirm is also added when you leave the field. Press Backspace in the empty field to remove the last tag, or select the cross on a tag to remove it. Tags are compared without regard to case, so HR and hr count as the same tag. A tag cannot contain a semicolon (;), which the platform uses to store tags; if you use one, the save is refused. The counter beside the label shows how many of the 12 tags are used.