# Configuring Advanced Microsoft Active Directory Parameters

Configure advanced connector behavior using cache settings and source configuration parameters.

## Group Managed Service Accounts (gMSA) Cache Settings

The connector caches gMSA account passwords for service accounts to optimize the password retrieval during operations like bulk provisioning. These settings are configurable in the connector and allow administrators to optimize password retrieval and caching behavior for gMSA accounts. The TTL value is validated in code, so only positive integers are accepted; invalid values are ignored and the connector uses the default setting.

### `gMSAPasswordCacheEnabled`

- **Type**: Boolean (true/false)
- **Default**: `true`
- **Description**: Enables or disables caching of gMSA (group Managed Service Account) passwords. When set to `true`, the connector caches retrieved gMSA passwords to improve performance and reduce repeated calls to IQService. By default, caching is enabled.

### `gMSAPasswordCacheTTLMinutes`

- **Type**: Integer
- **Default**: `15`
- **Description**: Specifies the time-to-live (TTL) for cached gMSA passwords in minutes.
- **Allowed Values**: Any positive integer (\> 0). If set to a value less than or equal to zero, the default of 15 minutes is used.
- **For example**: Setting this to `10` caches passwords for 10 minutes.

## Additional Configuration Parameters

This section contains information on additional parameters you can configure to modify connector behavior that are not available in the UI. Configure these parameters in the source configuration using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

This page contains the following sections:

- Additional Configuration Parameters
- Additional binary/SID/GUID Attributes
- Caching Ports

### Configuring Parameters

The following attributes can be added in the source configuration using the REST API:

#### `rollbackCreatedAccountOnError`

To roll back a created account when one or more requested attributes for that account fail during provisioning operations, set this attribute to `true` as follows:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/rollbackCreatedAccountOnError",
    "value": true
  }
]
```

#### `gmsaMsDSSupportedEncryptionTypesInNumeric`

By default, the `msDS-SupportedEncryptionTypes` attribute for gMSA accounts is returned as a text representation (for example, `AES128,AES256`). This can cause mismatches during provisioning verification, as the provisioned value is typically numeric (for example, `24`).

When `gmsaMsDSSupportedEncryptionTypesInNumeric` is set to `true` in the source configuration using the REST API, the connector returns the attribute in its numeric format, matching the behavior of regular service accounts:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/gmsaMsDSSupportedEncryptionTypesInNumeric",
    "value": true
  }
]
```

#### `reportPostScriptFailuresAsWarnings`

When set to `true`, native postscript errors are returned as warnings instead of errors for all update operations. The value for `reportPostScriptFailuresAsWarnings` must be passed as a string. This ensures that attributes are successfully provisioned to Active Directory and reflect in SailPoint.

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/reportPostScriptFailuresAsWarnings",
    "value": "true"
  }
]
```

#### `unlockOnChangePassword`

The default behavior of unlocking the account on change password can be turned off by setting the `unlockOnChangePassword` attribute to `false`. The value for `unlockOnChangePassword` must be passed as a string. Default: `true`.

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/unlockOnChangePassword",
    "value": "true"
  }
]
```

#### `setAttributeLevelResult`

Set it to `true` to enable attribute request level results. The value for `setAttributeLevelResult` must be passed as a string. Default: `false`.

Enabling this parameter marginally increases the time taken to process the request.

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/setAttributeLevelResult",
    "value": "true"
  }
]
```

#### `aggregationMaxRetries`

Count of maximum retry attempts for Active Directory aggregation in case of failures with retry-able errors. The value for `aggregationMaxRetries` must be passed as a string. Default: `5`.

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/aggregationMaxRetries",
    "value": "5"
  }
]
```

#### `aggregationRetryThreshold`

Delay in seconds between each retry attempt of aggregation. The value for `aggregationRetryThreshold` must be passed as a string. Default: `10` seconds.

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/aggregationRetryThreshold",
    "value": "10"
  }
]
```

#### `manageLync`

Microsoft Lync/Skype for Business Server to be managed by the connector.

Add the `manageLync` attribute in the source configuration using the REST API:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/manageLync",
    "value": true
  }
]
```

#### `authSearchAttributes`

List of attributes used to search for a user during Pass Through Authentication.

Configure the `authSearchAttributes` attribute in the source configuration using the REST API:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/authSearchAttributes",
    "value": ["sAMAccountName", "msDS-PrincipalName", "mail"]
  }
]
```

#### `memoryStoreSizeInElements`

Defines the number of cache elements to store in memory (RAM). The value for `memoryStoreSizeInElements` must be passed as a string. To store all elements in memory and nothing on disk, specify the value as `-2`:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/memoryStoreSizeInElements",
    "value": "-2"
  }
]
```

#### `disableComputePreloading`

Default: `false`

To disable auto detection of group membership pre-loading for forests, set the value to `true`. The value for `disableComputePreloading` must be passed as a boolean:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/disableComputePreloading",
    "value": true
  }
]
```

#### `useSingleThreadedCookieSearch`

During full aggregation, dirsync cookies are fetched per domain using concurrent threads. To fetch cookies sequentially on a single thread, set the value to `true`. The value for `useSingleThreadedCookieSearch` must be passed as a boolean:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/useSingleThreadedCookieSearch",
    "value": true
  }
]
```

#### `displayAttributeForContacts`

`CN` is used as the default display name for contact objects in SailPoint. To use another schema attribute, define the attribute name as the value of this parameter:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/displayAttributeForContacts",
    "value": "firstName"
  }
]
```

#### `disableFspAggregation`

Default: `false`

To disable aggregating foreign memberships of any user, set the value to `true`. The value for `disableFspAggregation` must be passed as a boolean:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/disableFspAggregation",
    "value": true
  }
]
```

#### Turning Chase Referrals Off

The LDAP extended control notifies the Active Directory Directory Services (AD DS) managed system not to generate any additional references (crossRef objects) in response to a search query.

With this control in a search request, the search operation is limited to the domain scope. You must validate if it is required to fetch any information from multiple domains. Adding configuration details to the required domain(s) in the source definition is mandatory. Active Directory search does not depend on referrals to fetch information from the managed system.

To aggregate the complete data, the Domain Setting configuration in Active Directory sources must be updated with required information.

To turn chase referrals off, complete the following:

1. Add the attribute `ldapExtendedControls` using the SailPoint REST API.

   > **Note**
   >
   > This attribute is generated with the LDAP extended control: 'LDAP\_SERVER\_DOMAIN\_SCOPE\_OID' (value = 1.2.840.113556.1.4.1339). Newly created Active Directory sources have this control by default, previous sources do not have any impact and continue to work as expected.

##### `ldapExtendedControls`

For an Active Directory managed system not to generate further references (crossRef objects) in response to the search query, add the following entry in the source configuration using the REST API:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/ldapExtendedControls",
    "value": ["1.2.840.113556.1.4.1339"]
  }
]
```

Active Directory connector search does not rely on referrals to fetch information from the managed system. To aggregate comprehensive data, Domain Settings configuration must be up to date with required information.

#### `skipDeletedObjScopeCheckInDelta`

Default: `false`

If set to `true` during account delta aggregation, the connector does not call Active Directory to check whether the deleted object was in scope of the source. The value for `skipDeletedObjScopeCheckInDelta` must be passed as a string.

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipDeletedObjScopeCheckInDelta",
    "value": "true"
  }
]
```

If the deleted object is present in the SailPoint database, it is deleted from the database. If the deleted object is not in the SailPoint database, no further action is performed.

#### `skipObjTypeCheckForMembersInDelta`

Default: `false`

If set to `true` during account delta aggregation, the connector does not call Active Directory to check if the objectType of a member is added or removed from a group. The value for `skipObjTypeCheckForMembersInDelta` must be passed as a string:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipObjTypeCheckForMembersInDelta",
    "value": "true"
  }
]
```

If the object is present in the SailPoint database, membership is updated.

#### `skipBindUsingDNS`

Default: `false`

If set to `true`, the DNS server is not used to find the Domain Controller for any given domain in serverless configuration. The value for `skipBindUsingDNS` must be passed as a string:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipBindUsingDNS",
    "value": "true"
  }
]
```

The connector always calls IQService to find the domain controller.

#### `skipGetObjInMembershipDelta`

Default: `false`

If set to `true`, the connector does not call Active Directory to get additional attributes of the changed object intercepted during delta aggregation:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipGetObjInMembershipDelta",
    "value": "true"
  }
]
```

The connector fetches these additional attributes if the user has entitlement changes along with attribute changes, or if the user has add, remove, or both entitlement changes.

When `skipGetObjInMembershipDelta` is set to `true`, the resource object sent to SailPoint contains only the attributes intercepted during delta aggregation.

#### `searchInContainers`

Default: `false`

By default, pass-through authentication (PTA) searches for users in the entire domain defined (when multiple searchDNs are configured), which can delay PTA.

To limit PTA to configured search DNs only, set the following entry to `true` in the source configuration using the REST API (applies to pass-through authentication only). The value for `searchInContainers` must be passed as a boolean:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/searchInContainers",
    "value": true
  }
]
```

#### `disableLDAPHostnameVerification`

To disable hostname verification during LDAP communication over TLS, configure the following attribute in the source configuration using the REST API. The value for `disableLDAPHostnameVerification` must be passed as a boolean:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/disableLDAPHostnameVerification",
    "value": true
  }
]
```

#### `skipIterateSearchFilterInPTA`

Default: `false`

If set to `true`, the connector does not consider the iterate search filter configured for a single search DN to authenticate the user in pass-through authentication (PTA). The value for `skipIterateSearchFilterInPTA` must be passed as a boolean:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipIterateSearchFilterInPTA",
    "value": true
  }
]
```

If the `searchInContainers` flag is set to `true`, it takes precedence over `skipIterateSearchFilterInPTA`.

#### `buildPartialROOnAuthentication`

Default: `false`

By default, when `buildPartialROOnAuthentication` is set to `false`, the connector builds a full resource object, which can take time and cause login delay.

When `buildPartialROOnAuthentication` is set to `true` in the source configuration using the REST API, the connector builds a partial resource object and sets identity, display, and other attributes used in correlation such as `samAccountName`, improving login performance. The value for `buildPartialROOnAuthentication` must be passed as a boolean:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/buildPartialROOnAuthentication",
    "value": true
  }
]
```

#### `domainIterateSearchFilter`

(Applicable only for User Delta Aggregation) Define this attribute in domain settings to override the iterate filter defined in Search Scope for Users.

#### `disableContainerFilterForDelta`

(Applicable only for Delta Aggregation) This attribute skips the iterate search filter when set to `true` while performing DirSync delta aggregation.

### Additional binary/SID/GUID Attributes

To display additional binary/SID/GUID attributes, use the following entries:

#### `attrsDisplayInBinaryFormat`

To display attribute values in binary format, which is also the default display format:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/attrsDisplayInBinaryFormat",
    "value": ["Attribute name1", "Attribute name2"]
  }
]
```

#### `attrsDisplayInSIDFormat`

To display attribute values in SID format:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/attrsDisplayInSIDFormat",
    "value": ["Attribute name1", "Attribute name2"]
  }
]
```

#### `attrsDisplayInGUIDFormat`

To display attribute values in GUID format:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/attrsDisplayInGUIDFormat",
    "value": ["Attribute name1", "Attribute name2"]
  }
]
```

### Caching Ports

Port numbers for the caching mechanism to replicate cached data across different task servers.

> [!NOTE]
>
> SailPoint recommends that the ports are open and not in use by another application.

#### `enableCache`

To enable cache, set the value to `true`:

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/enableCache",
    "value": true
  }
]
```

#### `cacheRmiPort`

The default value is `40001`.

#### `cacheRemoteObjectPort`

The default value is `40002`.

#### `cacheReplicationTimeout`

Maximum time in minutes to wait for membership cache replication on task server. Default: `10` minutes

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/cacheReplicationTimeout",
    "value": 20
  }
]
```

#### `cacheSocketTimeoutMillis`

Maximum time in milliseconds to wait for client sockets to send messages to a remote listener. Default: `2000` milliseconds.

```json
[
  {
    "op": "add",
    "path": "/connectorAttributes/cacheSocketTimeoutMillis",
    "value": 5000
  }
]
```