> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Add LDAP Targets Manually
> Connect Syteca to Active Directory by adding LDAP targets. Two options: a single AD domain via LDAP or LDAPS, or an entire AD forest via an AD Global Catalog. Both configured manually on the LDAP Targets tab of the Configuration page.
## Reach Active Directory once, use its accounts everywhere in Syteca
Syteca uses Active Directory in three places that all depend on LDAP target configuration. Adding AD users to Syteca and giving them Management Tool access. Storing AD account credentials as secrets that the Password Management feature can rotate. Configuring LDAP-backed Syteca user groups whose members are synchronized from AD groups. All three need a working LDAP target pointing at the right directory server.
**Configure an LDAP target when your Syteca deployment needs to:**
1. Provision Active Directory users into Syteca as Management Tool users, without recreating accounts manually.
2. Use AD credentials for admin login instead of local Syteca accounts.
3. Rotate the passwords of AD service accounts through Syteca's Password Management feature.
4. Populate Syteca user groups from AD group memberships kept in sync with the source of truth.
## Two target types
Syteca supports two LDAP target types, matched to two different AD reach patterns.
| Target type | LDAP path prefix | Reaches |
| --------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Single domain** | `LDAP://` or `LDAPS://` | One Active Directory domain, or one Organizational Unit within it. Bind to a specific domain controller. |
| **AD Global Catalog** | `GC://` | Every domain and subdomain in an Active Directory forest, through a single target that queries the Global Catalog. |
For deployments with a single AD domain, add a single-domain LDAP target. For deployments spanning multiple domains in an AD forest, add one Global Catalog LDAP target instead of one target per domain. Editing user provisioning later is far simpler with the Global Catalog approach.
## Prerequisites
The Management Tool user performing the LDAP target configuration must:
1. Log in to the Management Tool as a user with the [administrative Database Management permission](/docs/administration/users/administrative-permissions).
2. Have access to the domain controller from the Syteca Application Server (network reachability and, for LDAPS, valid trust to the domain controller's certificate).
Additional requirements for LDAPS (LDAP over SSL) targets:
3. The domain controller certificate must be signed by a Certificate Authority (CA) trusted by the Application Server.
4. The domain controller's fully qualified name must be resolvable from the Application Server (not just its short name).
## Open the LDAP Targets tab
Both target types are added on the same tab.
1. Click the **Configuration** button at the top of the Management Tool interface.
2. On the **Configuration** page, select the **LDAP Targets** tab.
3. Click the **Add** button at the top of the page. The **Add LDAP Target** page opens.
## Add a single domain LDAP target
Use this option when Syteca needs to reach one specific AD domain, or a specific Organizational Unit within a domain.
### The LDAP Path format
Enter the LDAP path in the **LDAP Path** field. The exact format depends on whether you want the whole domain, a specific OU, or an LDAPS connection.
Basic format for a whole domain, unencrypted:
```text theme={"system"}
LDAP:///DC=,DC=
```
Example. To connect to the `test.app.local` domain via the `SYTECAAPP` domain controller:
```text theme={"system"}
LDAP://SYTECAAPP/DC=test,DC=app,DC=local
```
To limit the target to a specific Organizational Unit within the domain, add the OU (and any parent OUs) before the domain components:
```text theme={"system"}
LDAP:///OU=,OU=,DC=,DC=
```
Example:
```text theme={"system"}
LDAP://SYTECAAPP/OU=subOU,OU=mainOU,DC=test,DC=app,DC=local
```
Use `LDAPS://` and the fully qualified domain controller name plus the port. Default LDAPS port is 636.
```text theme={"system"}
LDAPS://:/DC=,DC=
```
Example:
```text theme={"system"}
LDAPS://dc.ldaps.test:636/DC=ldaps,DC=test
```
LDAPS requires that the domain controller certificate is signed by a Certificate Authority that the Syteca Application Server trusts. Self-signed domain controller certificates will fail to connect. Verify certificate trust before entering an LDAPS path in the wizard.
### Fill in the remaining fields
In the **Domain NetBIOS Name** field, enter the NetBIOS name of the domain the target reaches.
In the **User** field, enter the username of an existing account belonging to the target domain.
In the **Password** field, enter the password for that account.
The credentials of a domain user are also required to use the [Password Management](/docs/pam/secrets/view-manage-secrets) feature against accounts in this domain. If Password Management is planned, provide credentials with the appropriate permissions to change AD passwords.
Click **Test Connection** to verify the values entered can establish a connection to the Active Directory domain controller.
The LDAP target cannot be saved until the connection test succeeds. If the test fails, verify the LDAP path syntax, network reachability, credentials, and (for LDAPS) certificate trust.
Select the **Create secret** checkbox to have Syteca automatically create a new secret storing the connection credentials. Useful when you plan to rotate the domain user's password later.
The auto-created secret uses the following values:
| Field | Value |
| --------------- | --------------------------------------------------------------------------------- |
| **Secret Name** | `\` |
| **Secret Type** | Active Directory account |
| **Domain** | `` |
| **Login** | `` |
| **Password** | `` |
| **Permissions** | The user who created the LDAP target becomes the creator and Owner of the secret. |
All other settings on the secret are set to the defaults. The credentials on a different secret can be used later by [editing the LDAP target](/docs/administration/integrations/ldap-targets#edit-an-ldap-target) and selecting any secret in the **Use secret** drop-down list that the user has Owner permission on.
Click **Save** in the bottom right of the page. The new LDAP target appears in the list on the **LDAP Targets** tab.
## Add an AD Global Catalog LDAP target
Use this option when Syteca needs to reach every domain and subdomain within an Active Directory forest through a single target, instead of adding one target per domain.
### The LDAP Path format for a Global Catalog
Enter the LDAP path in the **LDAP Path** field, using the `GC://` prefix:
```text theme={"system"}
GC://
```
Example. To connect to the `root.com` domain on the `DC-ROOT` domain controller that holds the Global Catalog role:
```text theme={"system"}
GC://DC=ROOT.KEN.LOCAL
```
The default port for Global Catalog LDAP connections is **3268**. A different port can be specified by adding it at the end of the LDAP Path, separated by a colon.
### Fill in the remaining fields
In the **Domain NetBIOS Name** field, click **Try to Resolve** to the right of the field. Syteca queries the domain controller for the NetBIOS name of the Global Catalog domain.
If the automatic resolution does not return a name, enter the NetBIOS name manually. Example value: `ROOT`.
In the **User** field, enter the username of an existing AD account belonging to the domain controller with the Global Catalog role.
In the **Password** field, enter the password for that account.
Click **Test Connection** to verify the values entered can establish a connection to the Active Directory domain controller.
The LDAP target cannot be saved until the connection test succeeds.
Select the **Create secret** checkbox to have Syteca automatically create a new secret storing the connection credentials, useful for remote password rotation of the account. Same behavior as the equivalent option for a single-domain target above.
Click **Save**. The new Global Catalog LDAP target appears in the list on the **LDAP Targets** tab.
### Using Global Catalog users elsewhere in Syteca
Once a Global Catalog LDAP target is saved, AD users from the entire forest can be searched for and selected when [adding an AD user](/docs/administration/users/users#add-a-user) on the Users page.
## Automatic LDAP targets
If the Syteca Application Server is installed on a computer that already belongs to an Active Directory domain, that domain is added as an LDAP target automatically during Application Server installation. No manual configuration is required.
Automatic LDAP targets appear in the grid on the **LDAP Targets** tab, marked as **Automatic** in the **Type** column.
**Global Catalog LDAP targets cannot be added automatically.** When using an AD Global Catalog to reach an entire AD forest, always add it manually using the procedure in [Add an AD Global Catalog LDAP target](#add-an-ad-global-catalog-ldap-target) above.
### Refresh an automatic LDAP target
If the computer running the Application Server has been added to a domain **after** the Application Server was installed, or has been moved to a different domain, the automatic LDAP target must be refreshed to pick up the new domain. The same procedure also creates the automatic target if it does not yet exist.
Log in to the Management Tool as a user with the administrative Database Management permission.
Click the **Configuration** button at the top of the Management Tool. On the Configuration page, select the **LDAP Targets** tab.
Click the **Refresh Automatic LDAP Target** button at the top of the page. If no automatic LDAP target exists yet, one is added. If an automatic LDAP target already exists, it is updated.
To change the credentials stored for an automatic LDAP target (for example, when the password of the domain user has changed), click the **Edit** icon next to the target and enter the new credentials on the **Edit LDAP Target** page.
## Edit an LDAP target
Log in to the Management Tool as a user with the [administrative Database Management permission](/docs/administration/users/administrative-permissions), click **Configuration**, and select the **LDAP Targets** tab.
Click the **Edit** icon next to the LDAP target you want to change.
On the **Edit LDAP Target** page, change any of the LDAP target parameters as needed.
Unlike when adding a new LDAP target, editing offers a choice between two credential sources:
* **Enter credentials manually** — use the **User** (an existing user in the Active Directory domain being connected to) and **Password** fields below this option.
* **Use secret** — select any [secret](/docs/pam/secrets/view-manage-secrets) from the drop-down that you have Owner permissions for; its stored credentials are used for the LDAP target instead.
Click **Test Connection** to confirm Syteca can reach the Active Directory domain controller with the values entered.
The LDAP target can't be saved until the connection test succeeds.
Click **Finish** to save the changes.
## Delete an LDAP target
Log in to the Management Tool as a user with the [administrative Database Management permission](/docs/administration/users/administrative-permissions), click **Configuration**, and select the **LDAP Targets** tab.
Click the **Remove** icon next to the LDAP target — or click **Remove All** in the column header to delete every LDAP target listed.
Click **Delete** in the confirmation pop-up.
Once deleted, the target no longer appears in the grid, and users from that domain can no longer log in to the Management Tool or authenticate to Client computers using secondary user authentication.
## Synchronize Active Directory user groups manually
For endpoint AD users who have sessions recorded, Syteca synchronizes their AD user group memberships automatically. In certain cases where automatic synchronization is not possible, run the sync manually. Common scenarios include after adding a large batch of AD users at once, or after an AD group restructuring at the domain controller level.
Log in to the Management Tool as a user with the administrative Database Management permission.
Click the **Configuration** button, then select the **LDAP Targets** tab.
Click the **Sync Active Directory User Groups** button at the top of the page. The **Update Data for AD User Groups** popup opens.
In the **Domain** field, search for and select the domain to synchronize. Click **OK**.
Only domains that contain at least one endpoint AD user with at least one recorded session appear in the domain list. Domains without any recorded sessions are not shown, because there is nothing for Syteca to sync against.
Synchronization can take a long time to complete, especially for large AD forests. Track progress on the [Tasks List](/docs/administration/dashboards/system-health-dashboards) tab of the System Health page.
## Related
Adding AD users to Syteca. LDAP targets are the prerequisite.
The Create Secret option on LDAP targets creates a PAM secret for the domain user account.
The Database Management permission that gates LDAP target configuration.
Rotate AD account passwords via LDAP targets and the auto-created secrets.