Configuring Advanced Microsoft Active Directory Parameters
Configure advanced connector behavior using cache settings and source configuration parameters.
Group Managed Service Accounts (gMSA) Cache Settings
The connector caches gMSA account passwords for service accounts to optimize the password retrieval during operations like bulk provisioning. These settings are configurable in the connector and allow administrators to optimize password retrieval and caching behavior for gMSA accounts. The TTL value is validated in code, so only positive integers are accepted; invalid values are ignored and the connector uses the default setting.
gMSAPasswordCacheEnabled
- Type: Boolean (true/false)
- Default:
true - Description: Enables or disables caching of gMSA (group Managed Service Account) passwords. When set to
true, the connector caches retrieved gMSA passwords to improve performance and reduce repeated calls to IQService. By default, caching is enabled.
gMSAPasswordCacheTTLMinutes
- Type: Integer
- Default:
15 - Description: Specifies the time-to-live (TTL) for cached gMSA passwords in minutes.
- Allowed Values: Any positive integer (> 0). If set to a value less than or equal to zero, the default of 15 minutes is used.
- For example: Setting this to
10caches passwords for 10 minutes.
Additional Configuration Parameters
This section contains information on additional parameters you can configure to modify connector behavior that are not available in the UI. Configure these parameters in the source configuration using the SailPoint REST API.
Note
For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.
This page contains the following sections:
- Additional Configuration Parameters
- Additional binary/SID/GUID Attributes
- Caching Ports
Configuring Parameters
The following attributes can be added in the source configuration using the REST API:
rollbackCreatedAccountOnError
To roll back a created account when one or more requested attributes for that account fail during provisioning operations, set this attribute to true as follows:
gmsaMsDSSupportedEncryptionTypesInNumeric
By default, the msDS-SupportedEncryptionTypes attribute for gMSA accounts is returned as a text representation (for example, AES128,AES256). This can cause mismatches during provisioning verification, as the provisioned value is typically numeric (for example, 24).
When gmsaMsDSSupportedEncryptionTypesInNumeric is set to true in the source configuration using the REST API, the connector returns the attribute in its numeric format, matching the behavior of regular service accounts:
[
{
"op": "add",
"path": "/connectorAttributes/gmsaMsDSSupportedEncryptionTypesInNumeric",
"value": true
}
]
reportPostScriptFailuresAsWarnings
When set to true, native postscript errors are returned as warnings instead of errors for all update operations. The value for reportPostScriptFailuresAsWarnings must be passed as a string. This ensures that attributes are successfully provisioned to Active Directory and reflect in SailPoint.
[
{
"op": "add",
"path": "/connectorAttributes/reportPostScriptFailuresAsWarnings",
"value": "true"
}
]
unlockOnChangePassword
The default behavior of unlocking the account on change password can be turned off by setting the unlockOnChangePassword attribute to false. The value for unlockOnChangePassword must be passed as a string. Default: true.
setAttributeLevelResult
Set it to true to enable attribute request level results. The value for setAttributeLevelResult must be passed as a string. Default: false.
Enabling this parameter marginally increases the time taken to process the request.
aggregationMaxRetries
Count of maximum retry attempts for Active Directory aggregation in case of failures with retry-able errors. The value for aggregationMaxRetries must be passed as a string. Default: 5.
aggregationRetryThreshold
Delay in seconds between each retry attempt of aggregation. The value for aggregationRetryThreshold must be passed as a string. Default: 10 seconds.
manageLync
Microsoft Lync/Skype for Business Server to be managed by the connector.
Add the manageLync attribute in the source configuration using the REST API:
authSearchAttributes
List of attributes used to search for a user during Pass Through Authentication.
Configure the authSearchAttributes attribute in the source configuration using the REST API:
[
{
"op": "add",
"path": "/connectorAttributes/authSearchAttributes",
"value": ["sAMAccountName", "msDS-PrincipalName", "mail"]
}
]
memoryStoreSizeInElements
Defines the number of cache elements to store in memory (RAM). The value for memoryStoreSizeInElements must be passed as a string. To store all elements in memory and nothing on disk, specify the value as -2:
disableComputePreloading
Default: false
To disable auto detection of group membership pre-loading for forests, set the value to true. The value for disableComputePreloading must be passed as a boolean:
useSingleThreadedCookieSearch
During full aggregation, dirsync cookies are fetched per domain using concurrent threads. To fetch cookies sequentially on a single thread, set the value to true. The value for useSingleThreadedCookieSearch must be passed as a boolean:
displayAttributeForContacts
CN is used as the default display name for contact objects in SailPoint. To use another schema attribute, define the attribute name as the value of this parameter:
[
{
"op": "add",
"path": "/connectorAttributes/displayAttributeForContacts",
"value": "firstName"
}
]
disableFspAggregation
Default: false
To disable aggregating foreign memberships of any user, set the value to true. The value for disableFspAggregation must be passed as a boolean:
Turning Chase Referrals Off
The LDAP extended control notifies the Active Directory Directory Services (AD DS) managed system not to generate any additional references (crossRef objects) in response to a search query.
With this control in a search request, the search operation is limited to the domain scope. You must validate if it is required to fetch any information from multiple domains. Adding configuration details to the required domain(s) in the source definition is mandatory. Active Directory search does not depend on referrals to fetch information from the managed system.
To aggregate the complete data, the Domain Setting configuration in Active Directory sources must be updated with required information.
To turn chase referrals off, complete the following:
-
Add the attribute
ldapExtendedControlsusing the SailPoint REST API.Note
This attribute is generated with the LDAP extended control: 'LDAP_SERVER_DOMAIN_SCOPE_OID' (value = 1.2.840.113556.1.4.1339). Newly created Active Directory sources have this control by default, previous sources do not have any impact and continue to work as expected.
ldapExtendedControls
For an Active Directory managed system not to generate further references (crossRef objects) in response to the search query, add the following entry in the source configuration using the REST API:
[
{
"op": "add",
"path": "/connectorAttributes/ldapExtendedControls",
"value": ["1.2.840.113556.1.4.1339"]
}
]
Active Directory connector search does not rely on referrals to fetch information from the managed system. To aggregate comprehensive data, Domain Settings configuration must be up to date with required information.
skipDeletedObjScopeCheckInDelta
Default: false
If set to true during account delta aggregation, the connector does not call Active Directory to check whether the deleted object was in scope of the source. The value for skipDeletedObjScopeCheckInDelta must be passed as a string.
[
{
"op": "add",
"path": "/connectorAttributes/skipDeletedObjScopeCheckInDelta",
"value": "true"
}
]
If the deleted object is present in the SailPoint database, it is deleted from the database. If the deleted object is not in the SailPoint database, no further action is performed.
skipObjTypeCheckForMembersInDelta
Default: false
If set to true during account delta aggregation, the connector does not call Active Directory to check if the objectType of a member is added or removed from a group. The value for skipObjTypeCheckForMembersInDelta must be passed as a string:
[
{
"op": "add",
"path": "/connectorAttributes/skipObjTypeCheckForMembersInDelta",
"value": "true"
}
]
If the object is present in the SailPoint database, membership is updated.
skipBindUsingDNS
Default: false
If set to true, the DNS server is not used to find the Domain Controller for any given domain in serverless configuration. The value for skipBindUsingDNS must be passed as a string:
The connector always calls IQService to find the domain controller.
skipGetObjInMembershipDelta
Default: false
If set to true, the connector does not call Active Directory to get additional attributes of the changed object intercepted during delta aggregation:
The connector fetches these additional attributes if the user has entitlement changes along with attribute changes, or if the user has add, remove, or both entitlement changes.
When skipGetObjInMembershipDelta is set to true, the resource object sent to SailPoint contains only the attributes intercepted during delta aggregation.
searchInContainers
Default: false
By default, pass-through authentication (PTA) searches for users in the entire domain defined (when multiple searchDNs are configured), which can delay PTA.
To limit PTA to configured search DNs only, set the following entry to true in the source configuration using the REST API (applies to pass-through authentication only). The value for searchInContainers must be passed as a boolean:
disableLDAPHostnameVerification
To disable hostname verification during LDAP communication over TLS, configure the following attribute in the source configuration using the REST API. The value for disableLDAPHostnameVerification must be passed as a boolean:
skipIterateSearchFilterInPTA
Default: false
If set to true, the connector does not consider the iterate search filter configured for a single search DN to authenticate the user in pass-through authentication (PTA). The value for skipIterateSearchFilterInPTA must be passed as a boolean:
If the searchInContainers flag is set to true, it takes precedence over skipIterateSearchFilterInPTA.
buildPartialROOnAuthentication
Default: false
By default, when buildPartialROOnAuthentication is set to false, the connector builds a full resource object, which can take time and cause login delay.
When buildPartialROOnAuthentication is set to true in the source configuration using the REST API, the connector builds a partial resource object and sets identity, display, and other attributes used in correlation such as samAccountName, improving login performance. The value for buildPartialROOnAuthentication must be passed as a boolean:
domainIterateSearchFilter
(Applicable only for User Delta Aggregation) Define this attribute in domain settings to override the iterate filter defined in Search Scope for Users.
disableContainerFilterForDelta
(Applicable only for Delta Aggregation) This attribute skips the iterate search filter when set to true while performing DirSync delta aggregation.
Additional binary/SID/GUID Attributes
To display additional binary/SID/GUID attributes, use the following entries:
attrsDisplayInBinaryFormat
To display attribute values in binary format, which is also the default display format:
[
{
"op": "add",
"path": "/connectorAttributes/attrsDisplayInBinaryFormat",
"value": ["Attribute name1", "Attribute name2"]
}
]
attrsDisplayInSIDFormat
To display attribute values in SID format:
[
{
"op": "add",
"path": "/connectorAttributes/attrsDisplayInSIDFormat",
"value": ["Attribute name1", "Attribute name2"]
}
]
attrsDisplayInGUIDFormat
To display attribute values in GUID format:
[
{
"op": "add",
"path": "/connectorAttributes/attrsDisplayInGUIDFormat",
"value": ["Attribute name1", "Attribute name2"]
}
]
Caching Ports
Port numbers for the caching mechanism to replicate cached data across different task servers.
Note
SailPoint recommends that the ports are open and not in use by another application.
enableCache
To enable cache, set the value to true:
cacheRmiPort
The default value is 40001.
cacheRemoteObjectPort
The default value is 40002.
cacheReplicationTimeout
Maximum time in minutes to wait for membership cache replication on task server. Default: 10 minutes
cacheSocketTimeoutMillis
Maximum time in milliseconds to wait for client sockets to send messages to a remote listener. Default: 2000 milliseconds.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.