Activating LDAPS

LDAP Protocol

The LDAP protocol is used to read and write data in Active Directory. By default, when synchronization is installed, the LDAP traffic is not secured. To activate LDAP over SSL (LDAPS), install the certificate of the Microsoft certification authority (CA) or a third-party certification authority certificate.

To establish an LDAPS connection, you need to complete preliminary configuration.

Certificate Requirements For Activating LDAPS

To activate LDAPS, install the certificate that complies with the following requirements:

1. A private key for the certificate is located in the local computer certificate store and matches this certificate. Strong private key protection should not be enabled;
2. The enhanced key extension includes the server authentication (1.3.6.1.5.5.7.3.1) object identifier (also known as OID);
3. The Active Directory full domain controller name (for example, DC01.DOMAIN.COM) must be displayed in one of the following places:
   • "Common name" (CN) in the Subject field;
   • DNS record in the "Subject alternative name" extension;
4. The certificate was issued by the certification authority trusted by the domain controllers and the LDAPS clients. Connections are built by configuring the client computer and the certification authority to trust the root certification authority to which the issuing certification authority is linked.

The certificate is saved on the local machine and uploaded to the system database. The certificate is uploaded via the web interface in the "Certificate" parameter on the synchronization page or with the use of a GraphQL query.