LDAP / Active Directory
On-premises employee accounts are read and matched with leak records.
How it works
The connection runs over LDAPS; an unencrypted connection is not accepted. It binds with an account that has read permission; no write permission is required.
The search filter is fixed and returns user accounts only. The fields read are: the permanent identifier (entryUUID or objectGUID), the email, and on Active Directory whether the account is enabled.
The bind password is stored encrypted; it never appears in clear text in logs or panel responses.
Limits
There is no session termination: LDAP has no such operation, and in Active Directory session lifetime is governed server-side by Kerberos ticket lifetimes.
Password, group membership, phone and address are not read.
No record in the directory is created, changed or deleted.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.