# Integrating SailPoint with Microsoft Lightweight Directory Services

*(formerly ADAM)*

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a Microsoft Lightweight Directory Services (LDS) source in SailPoint.

If you have user accounts in LDS that you want to load into SailPoint, you can create a direct connect source for LDS and load that data into your system. To manage that data, either [create an identity profile](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>) based on the source or verify that the accounts you load are correlated to an existing identity.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site.

The Microsoft Lightweight Directory connector supports the following features:

- Manage ( Aggregate and Provision ) `userProxyFull` type of users in AD LDS (ADAM)
- Load Active Lightweight Directory Services Accounts
- \*Provision Active Lightweight Directory Services Accounts
- \*Access Certifications (certification of entitlements connected to accounts)
- Delete Accounts
- Account Move and Rename
- \*Password Management
- Unlock Account: Add the `UNLOCK` attribute to the source XML file. Add the appropriate values for the lock/unlock attributes:

  ```text
  <entry key="lockAttr" value="Depend on LDAP type OR any custom attributes set in customer env for lock"/>
  <entry key="unlockAttr" value="Depend on LDAP type OR any custom attributes set in customer env for unlock">
  ```

Provisioning of account with objectClass `userProxyFull` requires updates of the account schema and the provisioning policies.

Following are the links to the pages that provide the details which should be added:

- [Profile Page](<https://documentation.sailpoint.com/connectors/microsoft/lightweight_directory_services/va/help/provisioning.html#profile-page>)
- [Account Attribute (Object Type - `userProxyFull`)](<https://documentation.sailpoint.com/connectors/microsoft/lightweight_directory_services/va/help/schema.html#account-attributes-object-type-userproxyfull>)

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- The administrator account acting as the service account for the Active Lightweight Directory source must have the read /write privileges over the directory information tree in order to manage the LDAP data.

## Required Permissions

- The Active Lightweight Directory Services administrator account acting as the service account must have read /write privileges over the directory information tree in order to manage the LDAP data.