Skip to main content

Documentation Index

Fetch the complete documentation index at: https://conductorone-groman-network-requirements-updates.mintlify.app/llms.txt

Use this file to discover all available pages before exploring further.

​
Availability

The Active Directory connector is self-hosted and supports Windows and Linux.

​
Capabilities

ResourceSyncProvision
Accounts
Groups
Group Managed Service Accounts (gMSAs)
The Active Directory connector supports automatic account provisioning and deprovisioning. When a new account is created by C1, the account’s password is sent to a vault. Notes:
  • The connector syncs each user’s primary group membership (for example, Domain Users) via the primaryGroupID attribute. AD does not include primary groups in memberOf, so the connector resolves these automatically.
  • The connector supports syncing across multiple AD domains and forests in a single run via additional-domains configuration.
  • gMSA sync is opt-in and requires the enable-gmsa-sync flag. gMSA provisioning modifies the msDS-GroupMSAMembership security descriptor ACL.
  • The connector supports two connection modes: LDAP (default on Linux) and WinLDAP (default on Windows, uses wldap32.dll for Kerberos/GSSAPI).
  • Account provisioning (create/delete) requires LDAPS (ldaps: true).
  • When sync-scope is set to GlobalCatalog, provisioning is not supported and some profile fields may be unavailable.

​
Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the Perform connector action automation step. Global actions (connector-level):
Action nameAdditional fieldsDescription
enable_userresource_id (resource ID, required)Enable a disabled AD account (clears ACCOUNTDISABLE flag)
disable_userresource_id (resource ID, required)Disable an active AD account (sets ACCOUNTDISABLE flag)
lock_accountresource_id (resource ID, required)Lock an AD account — alias for disable_user, sets the ACCOUNTDISABLE UAC flag. AD has no separate lock state.
unlock_accountresource_id (resource ID, required)Unlock an AD account — alias for enable_user, clears the ACCOUNTDISABLE UAC flag.
update_user_attrsresource_type (string, required), resource_id (string, required), attrs (map, required), attrs_update_mask (string list, required)Update user attributes. Known names (for example, first_name) are mapped to AD attributes; unknown names are passed through as raw AD attribute names. Empty values clear the attribute.
lookup_userAt least one of: upn (string), sam_account_name (string), employee_id (string)Look up a user by UPN, SAM Account Name, or Employee ID and return their DN, SAM Account Name, UPN, display name, employee ID, and objectGUID
set_managerresource_id (resource ID, required), plus exactly one of: manager_resource_id (resource ID) or clear_manager (bool)Set or clear the manager attribute on a user. The handler returns the resulting manager_dn as an output for observability; manager_dn is not an input.
Resource actions (on user resources):
Action nameAdditional fieldsDescription
update_profileuser_id (resource ID, required), plus optional string fields (see Profile push attributes below), and custom_attributes (map of raw AD attribute names to values)Update a user’s profile attributes. Empty values clear the attribute in AD.
move_ouuser_id (resource ID, required), target_ou (string, required)Move a user to a different Organizational Unit. Automatically handles CN collisions by appending a numeric suffix.
Resource actions (on group resources):
Action nameAdditional fieldsDescription
createname (string, required), organizationalUnit (string, required), plus optional: sAMAccountName, description, groupScope (global/domain_local/universal), groupType (security/distribution), managedByUser (resource ID), managedByGroup (resource ID), mailEnabled (bool), primaryEmailAddress, emailAliases (string list), hideFromGAL (bool), gidNumber (int), userMembers (resource ID list), groupMembers (resource ID list)Create a new AD group with optional initial members, mail settings, and POSIX attributes
Custom PowerShell actions: You can define additional actions backed by PowerShell scripts in the config file. See Custom PowerShell actions below.

​
Resources

​
Gather Active Directory credentials

To configure the Active Directory connector, you need an Active Directory service account with appropriate permissions. The specific permissions depend on your intended use:
  • Sync only: Read access to AD objects
  • Entitlement provisioning: Delegated rights to modify group membership
  • Account provisioning: Delegated rights to create, delete, and manage user accounts, plus LDAPS enabled
  • gMSA provisioning: Permission to modify msDS-GroupMSAMembership on gMSA objects
The service account also needs Log on as a service permission and Modify access to C:\ProgramData\ConductorOne.

​
Create a service account

1
Create a dedicated AD service account for the connector (for example, svc-baton). A standard domain user account with read access is sufficient for sync-only operation.
2
Grant the service account Log on as a service permission via local or domain Group Policy, depending on your environment.

​
Entitlement provisioning permissions

For entitlement provisioning support, the service account needs delegated rights to manage group membership.
1
Open Active Directory Users and Computers (ADUC) or run dsa.msc from the command line.
2
Right-click on your forest root (or a specific OU if you only want to provision into groups in that OU) and select Delegate Control.
3
Add the service account running the baton-active-directory service.
4
From the tasks to delegate, check the box for Modify the membership of a group.
5
Click Next, then Finish.
This delegation grants the service account the ability to provision and deprovision access from Active Directory groups, but it excludes special built-in groups like Administrators, Domain Admins, Enterprise Admins, and Schema Admins. To manage those protected groups, you must grant explicit Write Members permission on each group and update AdminSDHolder to prevent the permission from being removed:
1
For each protected group: right-click the group, click the Security tab, click Advanced, click Add, select the service account as the principal, and grant Write Members permission.
2
Run the following PowerShell script from a domain controller with domain admin credentials to ensure AdminSDHolder does not remove the permission after 60 minutes:
$domain = "REPLACE_WITH_YOUR_DOMAIN"
$samAccountName = "REPLACE_WITH_YOUR_SERVICE_ACCOUNT"
$adminSDHolderPath = "CN=AdminSDHolder,CN=System," + (Get-ADDomain).DistinguishedName

$acl = Get-Acl "AD:\$adminSDHolderPath"
$identity = New-Object System.Security.Principal.NTAccount("$domain\$samAccountName")

$rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
    $identity,
    [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty,
    [System.Security.AccessControl.AccessControlType]::Allow,
    [Guid]"bf967a9c-0de6-11d0-a285-00aa003049e2",  # GUID for 'member' attribute
    [System.DirectoryServices.ActiveDirectorySecurityInheritance]::None
)

$acl.AddAccessRule($rule)
Set-Acl -Path "AD:\$adminSDHolderPath" -AclObject $acl

​
Account provisioning permissions

User account provisioning requires ldaps: true in your config.
1
Open ADUC or run dsa.msc from the command line.
2
Right-click on your forest root (or a specific OU) and select Delegate Control.
3
Add the service account running the baton-active-directory service.
4
From the tasks to delegate, check the box for Create, delete, and manage user accounts.
5
Click Next, then Finish.
Your service account is now ready. Continue to the connector configuration.

​
Configure the Active Directory connector

To complete this task, you’ll need:
  • The Connector Administrator or Super Administrator role in C1
  • An Active Directory service account with the appropriate permissions (see above)
The Active Directory connector is self-hosted only. It runs on a Windows or Linux server in your environment with direct network access to your domain controllers.To get started, follow the Self-hosted tab instructions.

​
What’s next?

Once your Active Directory connector is synced, you can use C1 to run user access reviews on AD group memberships, enable just-in-time access requests for AD groups and gMSAs, and automate provisioning workflows using connector actions.