5.1Concepts

What a connection holds

A connection is a record stored in the platform's own database. It contains:

• The address of a domain controller — a host name or IP address, and a port.
• The transport — plain LDAP or LDAP over SSL (LDAPS).
• The domain the controller belongs to, for example corp.local.
• A bind account — the service account the platform signs in to Active Directory with, and its password.
• An optional base DN that limits which part of the directory the platform manages.
• An optional description and tags that help people tell connections apart.

The bind password is encrypted before it is stored. It is never shown again after you save it, not even to administrators: the edit screen shows only a masked placeholder and the text "stored encrypted · never shown".

Operations run as the service account

When a person, an agent or an integration changes something in Active Directory through the platform, the change is made by the connection's bind account, not by the person's own Windows account. The platform's own permissions and policies decide whether a request may run; the bind account's rights in Active Directory decide whether the domain controller accepts it.

This has two consequences:

• Give the bind account exactly the Active Directory rights your administrators need through the platform, and no more. Delegate rights on the organizational units the platform should manage rather than making the account a Domain Admin.
• Which roles may use a connection is a security decision, because a role that can use a connection can act with that service account's rights. See 5.10 Which roles may use a connection.

The workspace directory

If your installation has more than one connection, the console asks you to work in one directory at a time. The connection picker at the top of the navigation panel (captioned Directory) lists only the connections your active role may use. Every Active Directory screen — the Directory Browser, the Recycle Bin, Directory Policies and so on — reads through the directory selected there. Switching to another directory reloads the console so that no data from the previous directory remains on screen.

If only one connection is available to your role, the picker shows it as a label rather than a list. If none is available, it reads "No directory available to your role". The picker itself is described in Chapter 4, Working in the console.

Who can do what

Connection management is controlled by five permissions. Assign them through roles (see Chapter 11, Users, roles and permissions).

Important: Holding adconnections:delete is not enough on its own. A connection can be deleted only when your active role is the System Admin role. Any other caller is refused, even with the permission.

The change history panel on the edit screen is a view onto the operations log, so it appears only if you also hold audit:list.

Connection management is not licence-gated. You can create and test connections on an installation that has no active licence yet, which is how an installation is normally set up before it is licensed. Working in the directory through those connections (browsing, editing objects) does require a licence; see Chapter 19, Licence, updates and backups.