Skip to content

Integrating SailPoint with Microsoft Lightweight Directory Services

(formerly ADAM)

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a Microsoft Lightweight Directory Services (LDS) source in SailPoint.

If you have user accounts in LDS that you want to load into SailPoint, you can create a direct connect source for LDS and load that data into your system. To manage that data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site.

The Microsoft Lightweight Directory connector supports the following features:

  • Manage ( Aggregate and Provision ) userProxyFull type of users in AD LDS (ADAM)
  • Load Active Lightweight Directory Services Accounts
  • *Provision Active Lightweight Directory Services Accounts
  • *Access Certifications (certification of entitlements connected to accounts)
  • Delete Accounts
  • Account Move and Rename
  • *Password Management

  • Unlock Account: Add the UNLOCK attribute to the source XML file. Add the appropriate values for the lock/unlock attributes:

    <entry key="lockAttr" value="Depend on LDAP type OR any custom attributes set in customer env for lock"/>
<entry key="unlockAttr" value="Depend on LDAP type OR any custom attributes set in customer env for unlock">

Provisioning of account with objectClass userProxyFull requires updates of the account schema and the provisioning policies.

Following are the links to the pages that provide the details which should be added:

For more information on features, refer to Source Features.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

  • The password policy defined in SailPoint applies to accounts on this source.
  • If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Prerequisites

  • Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
  • The administrator account acting as the service account for the Active Lightweight Directory source must have the read /write privileges over the directory information tree in order to manage the LDAP data.

Required Permissions

  • The Active Lightweight Directory Services administrator account acting as the service account must have read /write privileges over the directory information tree in order to manage the LDAP data.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.