> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-google-workspace-action-examples.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Set up an Active Directory connector
> C1 provides identity governance and just-in-time provisioning for Active Directory. Integrate your on-prem Active Directory server with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.
## Availability
The Active Directory connector supports Windows and Linux.
## Capabilities
| Resource | Sync | Provision |
| :------- | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Accounts | | |
| Groups | | |
The Active Directory connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning).
When a new account is created by C1, the account's password will be sent to a [vault](/product/admin/vaults).
### Resources
* [Official download center](https://dist.conductorone.com/ConductorOne/baton-active-directory): For stable binaries (Windows/Linux/macOS) and container images.
## Integrate your Active Directory domain
This process uses the Active Directory connector, hosted and run in your own environment. [Contact C1's support team](/baton/active-directory/) to download the latest version of the connector.
Once `baton-active-directory` is installed and the integration is set up, Baton runs as a service in your environment. The service maintains contact with C1, syncs and uploads data at regular intervals, and passes that data to the C1 UI, where you and your colleagues can use it to run access reviews and manage access requests for the application.
### Requirements
* A Windows server to host `baton-active-directory` This server needs minimum requirements to run in most environment. It doesn't need a dedicated server
* Two to four core vCPU
* Four to eight gigabytes of RAM
* Windows minimum required storage
* Outbound network connectivity to port `443` to your C1 tenant
* An Active Directory service account
* For syncing only, the AD account needs read access only
* For entitlement provisioning, the account needs permissions to modify group membership. See [Entitlement provisioning permissions](#entitlement-provisioning-permissions) below.
* For account provisioning, the account needs delegated rights to create, delete, and manage user accounts. See [Account provisioning permissions](#account-provisioning-permissions) below.
* **Log on as a service** permission. You may need to grant this via local or domain group policy, depending on your environment.
* `Modify` access to the `C:\ProgramData\ConductorOne` directory so the service can write to the log file
* The **Connector Administrator** or **Super Administrator** role in C1
In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
Search for **Baton** and click **Add**.
Choose how to set up the new Baton connector:
* Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
* Add the connector to a managed app (select from the list of existing managed apps)
* Create a new managed app
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.
If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
Click **Next**.
Find the **Settings** section of the page and click **Edit**.
Click on Rotate to generate a new `client-id` and a `client-secret` for the connector. Make sure you copy both as the `client-secret` will not be visible once you click Ok.
Click Ok
Next to the `Not Connected` label, click on the word **Baton**. This will take you to the application page.
* Click on pencil icon next at the top of the page to update the application name and type `Active Directory`
* This will update the application name and the connector name, and the application icon will also resemble Active Directory once connected.
## Configure the `baton-active-directory`
### Step 1: Create an Active Directory service account
The Active Directory Connector needs a service accounts to connect to Active Directory. The account needs read permissions to AD and Logon As a Service rights. The latter can be configured via GPO, or if using a privileged account to setup the connector, that step will happen automatically.
#### Entitlement provisioning permissions
For entitlement provisioning support, the service account needs to have delegated rights on your AD forest to manage groups membership
Open ADUC or run the command `dsa.msc` from the command line
Right click on your forest root, or if you only want to provision into groups in a particular OU right click on that OU
Select Delegate Control
Add the service account running the `baton-active-directory` service
From the Task to Delegate check the box for `Modify the membership of a group`
Click Next, then Finish
This delegation will grant the service account the ability to provision and deprovision access from Active Directory groups, but it excludes special built-in groups like:
* Administrators
* Domain Admins
* Enterprise Admins
* Schema Admins
If you wish to manage those, you must perform the following operation:
For each group you want the service account to Control:
Right Click on the group
Click on the Security tab
Click Advanced
Click Add
Click on Select a principal, and choose the `baton-active-directory` service account
Grant the account `Write Members` permissions
Run the following powershell script **from a domain controller with a domain admin credential** to ensure AdminSDHolder doesn't remove the permission after 60 minutes:
```powershell theme={null}
$domain = "REPLACE_WITH_YOUR_DOMAIN"
$samAccountName = "REPLACE_WITH_YOUR_SERVICE_ACCOUNT"
$adminSDHolderPath = "CN=AdminSDHolder,CN=System," + (Get-ADDomain).DistinguishedName
$acl = Get-Acl "AD:\$adminSDHolderPath"
$identity = New-Object System.Security.Principal.NTAccount("$domain\$samAccountName")
$rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
$identity,
[System.DirectoryServices.ActiveDirectoryRights]::WriteProperty,
[System.Security.AccessControl.AccessControlType]::Allow,
[Guid]"bf967a9c-0de6-11d0-a285-00aa003049e2", # GUID for 'member' attribute, don't change
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::None
)
$acl.AddAccessRule($rule)
Set-Acl -Path "AD:\$adminSDHolderPath" -AclObject $acl
Write-Host "Successfully granted '$identity' permission to modify group memberships in AdminSDHolder." -ForegroundColor Green
```
#### Account provisioning permissions
User account provisioning requires `ldaps: true` in your config.
Open ADUC or run the command `dsa.msc` from the command line
Right click on your forest root, or if you only want to provision accounts in a particular OU right click on that OU
Select Delegate Control
Add the service account running the `baton-active-directory` service
From the Task to Delegate check the box for `Create, delete, and manager user accounts`
Click Next, then Finish
### Step 2: Install `baton-active-directory`
#### Connector modes
The Active Directory connector can be run in either LDAP mode (default) or WinLDAP mode.
Both modes can sync and provision the same resources, but WinLDAP mode supports additional authentication methods. LDAP mode uses a Golang LDAP library to connect to the Active Directory server. WinLDAP mode uses Windows system calls. If LDAP mode does not connect (usually because your AD server requires more secure authentication methods), then try running the connector with `--mode=winldap`.
[Contact C1's support team](/baton/active-directory/) to download the latest version of the connector.
On the host designated to run the connector, create a folder in `C:\Program Files` called `ConductorOne`
Extract the `baton-active-directory.exe` from the zip archive, and copy it to the `ConductorOne` folder
Install and set up the connector by running:
```console theme={null}
baton-active-directory.exe setup
```
**To use C1 to provision Accounts and into Active Directory groups:**
Be sure to edit the YAML config by adding `provisioning: true` property to the config file. The setup command will not prompt you for it.
You'll be prompted to provide:
```console theme={null}
domain (string) required: The fully-qualified Windows domain to connect with. Example: "baton.example.com"
sitename (string) Optional: The sitename to connect to, if not set conects to all DCs. Example: "US-DC-01"
base-dn (string) required: The base DN to search from. Example: "DC=baton,DC=example,DC=com"
ldaps-port (int) Optional: If you are using LDAPS, this is the port for the server to connect to. By default we try to connect to '636'. (default 636)
ldaps (boolean) Optional: Indicates if you are using LDAPS. Required for user account provisioning.
mode (string) Optional: The connection mode to talk to the domain. Must be ldap or winldap. (default "winldap")
user-search-dn (string) Optional: The DN to search for users. Example: "OU=Users,DC=baton,DC=example,DC=com". Defaults to the Base DN. ($BATON_USER_SEARCH_DN)
user-search-filter (string) Optional: The filter to search for users. Example: "(&(objectCategory=person)(objectClass=user))" (default "(&(objectCategory=person)(objectClass=user))")
group-search-dn (string) Optional: The DN to search for groups. Example: "OU=Groups,DC=baton,DC=example,DC=com. Defaults to the Base DN."
group-search-filter (string) Optional: The filter to search for groups. Example: "(objectCategory=group)" (default "(objectCategory=group)")
skip-ous (strings) Optional: A list of DNs for OUs to skip when searching for users and groups. Example: "OU=Test Groups,OU=baton-dev,DC=baton-dev,DC=d2,DC=ductone,DC=com"
only-ous (strings) Optional: A list of DNs for OUs to sync when searching for users and groups. Example: "OU=Test Groups,OU=baton-dev,DC=baton-dev,DC=d2,DC=ductone,DC=com"
custom-user-attributes (strings) Optional: A list of custom LDAP attribute names to include in the user profile. Example: "githubUserName,customField1"
```
Run `baton-active-directory --help` to see the list of flags to be used when passing your credentials to the connector.
#### Custom user attributes
By default, the connector syncs a standard set of AD user attributes (department, company, email, UPN, SAM account name, etc.). If you need additional attributes — for example, to correlate AD users with accounts in another system — use the `custom-user-attributes` flag.
Each attribute name you specify will be fetched from AD and added to the user profile in C1, where it can be used as a profile attribute for account correlation.
**Example:** To pull a custom `githubUserName` field from AD so C1 can link GitHub accounts to AD users:
```yaml theme={null}
custom-user-attributes:
- githubUserName
```
Once synced, `githubUserName` will appear as a profile attribute on the user in C1 and can be configured as an additional username for account correlation with GitHub.
The config file is written to `C:\ProgramData\ConductorOne\baton-active-directory\config.yaml`, and is formed like the following:
If you make changes to the config file then a service restart is required for the changes to take effect
```yaml theme={null}
base-dn: dc=baton-dev,dc=d2,dc=ductone,dc=com
domain: baton-dev.d2.ductone.com
mode: winldap
client-id: clean-ogre-26349@insulator.conductor.one/ccc
client-secret: secret-token:conductorone.com:v1:...
# Include this line if you want to use this connector to provision into groups and account creation
provisioning: true
```
The log file is written to `C:\ProgramData\ConductorOne\baton-active-directory\baton.log`.
Grant the service account `Modify` folder permissions to `C:\ProgramData\ConductorOne` so it can write to the `baton.log` file
* **failing to do step 5 will result in a service start error**
Launch the Services console and locate the service named `baton-active-directory`
Double click to open properties
Change the Startup type to `Automatic`
Navigate to the `Log On` tab and click on `This account`
Click `Browse` and type your service account name (samAccountName) in the input field
Click `Check Names`, and ensure it validated the right account. If you're presented with an account selection screen, carefully choose the account you created in the previous steps
Enter the service account's password and confirm it.
Click Apply
Navigate back to the `General` Tab, and click `Start` to start the `baton-active-directory` service
### Step 3: Manage the `baton-active-directory` Windows service
Once you have provided this information, a new Windows service named `baton-active-directory` will be created in the Stopped state. You can now use the `.\baton-active-directory` command to manage the service.
* To start the service, run `.\baton-active-directory start`.
* To stop the service, run `.\baton-active-directory stop`.
* To check the status of the service, run `.\baton-active-directory status`.
* To remove the service, run `.\baton-active-directory remove`.
The connector syncs current data, uploads it to C1, and prints a `Task complete!` message when finished.
Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Active Directory connector to. Active Directory data should be found on the **Entitlements** and **Accounts** tabs.