Sync with Active Directory or LDAP

Server Hostname

Hostname of your directory server.

ad.example.com, ldap.company.org

Server Port

Port on which your directory server is listening.

389 or 10389

Root Path

Root path at which Directory Connector should start all queries.

cn=users, dc=ad, dc=example, dc=com, dc=ldap, dc=company, dc=org

This server uses active directory

Check this box if the server is an Active Directory server.

This server pages search results

Check this box if the server paginates search results (LDAP only).

This server uses an encrypted connection

Checking this box will prompt you to select one of the following options:

Use SSL (LDAPS) If your LDAPS server uses an untrusted certificate, you can configure certificate options on this screen.

Use TSL (STARTTLS) If your LDAP server uses a self-signed certificate for STARTTLS, you can configure certification options on this screen.

Username

The distinguished name of an administrative user that the application will use when connecting to the directory server. For Active Directory, if synchronizing the status of users removed from the directory is desired, the user should be a member of the built-in administrator group.

Password

The password of the user specified above. The password is safely stored in the operating system's native credential manager.

Interval

Time between automatic sync check (in minutes).

Remove disabled users during sync (Not available for LDAP)

Check this box to remove users from the Bitwarden organization that have been disabled in your organization.

Overwrite existing organization users based on current sync settings

Check this box to fully overwrite the user set on each sync, including removing users from your organization when they are absent from the directory user set.

If for any reason an empty sync is run when this options is enabled, Directory Connector will remove all users.

 Always run a test sync prior to syncing after enabling this option.

More than 2000 users or groups are expected to sync

Check this box if you expect to sync 2000+ users or groups. If you don't check this box, Directory Connector will limit a sync at 2000 users or groups.

Member Attribute

Name of the attribute used by the directory to define a group's membership (for example, uniqueMember).

Creation Data Attribute

Name of the attribute used by the directory to specify when an entry was created (for example, whenCreated).

Revision Date Attribute

Name of the attribute used by the directory to specify when an entry was last changed (for example, whenChanged).

If a user has no email address, combine a username prefix with a suffix value to form an email

Check this box to form valid email options for users that do not have an email address.

Users without real or formed email addresses will be skipped by Directory Connector.

Formed Email = Email Prefix Attribute + Email Suffix

Email Prefix Attribute

Attribute used to create a prefix for formed email addresses.

Email Suffix

A string (@example.com) used to create a suffix for formed email addresses.

Sync users

Check this box to sync users to your organization.

Checking this box will allow you to specify a User Filter, User Path, User Object Class, and User Email Attribute.

User Filter

See Specify sync filters.

User Path

Attribute used with the specified Root Path to search for users (for example, ou=users). If no value is supplied, the subtree search will start from the root path.

User Object Class

Name of the class used for the LDAP user object (for example, user).

User Email Attribute

Attribute to be used to load a user's stored email address.

Sync groups

Check this box to sync groups to your organization.

Checking this box will allow you to specify a Group Filter, Group Path, Group Object Class, Group Name Attribute.

Group Filter

See Specify sync filters.

Group Path

Attribute used with the specified Root Path to search for groups (for example, ou=groups). If no value is supplied, the subtree search will start from the root path.

Group Object Class

Name of the class used for the LDAP group object (for example, groupOfUniqueNames).

Group Name Attribute

Name of the attribute used by the directory to define the name of a group (for example, name).