The following placeholders will be used:
ad.companyis the Name of the Active Directory domain.
authentik.companyis the FQDN of the authentik install.
Active Directory setup
Open Active Directory Users and Computers
Create a user in Active Directory, matching your naming scheme
Give the User a password, generated using for example
pwgen 64 1or
openssl rand -base64 36.
Open the Delegation of Control Wizard by right-clicking the domain and selecting "All Tasks".
Select the authentik service user you've just created.
Ensure the "Reset user password and force password change at next logon" Option is checked.
Grant these additional permissions (only required when Sync users' password is enabled, and dependent on your AD Domain)
Additional info: https://support.microfocus.com/kb/doc.php?id=7023371
In authentik, create a new LDAP Source in Directory -> Federation & Social login.
Use these settings:
For authentik to be able to write passwords back to Active Directory, make sure to use
ldaps://. You can test to verify LDAPS is working using
You can specify multiple servers by separating URIs with a comma, like
When using a DNS entry with multiple Records, authentik will select a random entry when first connecting.
<name of your service user>@ad.company
Bind Password: The password you've given the user above
Base DN: The base DN which you want authentik to sync
Property mappings: Control/Command-select all Mappings which start with "authentik default LDAP" and "authentik default Active Directory"
Group property mappings: Select "authentik default LDAP Mapping: Name"
Additional settings that might need to be adjusted based on the setup of your domain:
- Group: If enabled, all synchronized groups will be given this group as a parent.
- Addition User/Group DN: Additional DN which is prepended to your Base DN configured above to limit the scope of synchronization for Users and Groups
- User object filter: Which objects should be considered users. For Active Directory set it to
(&(objectClass=user)(!(objectClass=computer)))to exclude Computer accounts.
- Group object filter: Which objects should be considered groups.
- Group membership field: Which user field saves the group membership
- Object uniqueness field: A user field which contains a unique Identifier
After you save the source, a synchronization will start in the background. When its done, you can see the summary under Dashboards -> System Tasks.
To finalise the Active Directory setup, you need to enable the backend "authentik LDAP" in the Password Stage.