This page explains how to configure Active Directory integration.
If you have any questions or run into any issues after reading through the content, please feel free to contact us.
In addition, we have provided a page below covering points to check in advance.
If you haven't read it yet, please be sure to check it out as well.
Getting Started
Main Feature Description ① User Management
Main Feature Description ② User Authentication
|
Table of Contents: |
1. About User Sync Settings
Overview of the Information to Configure
After installing the Connector and confirming the connection, configure the user sync settings.
In the user sync settings, in addition to the AD security groups to be synced, you will configure your domain,
LDAP connection information, and the mapping between security groups and TrustLogin groups.
Note: Please perform this work using Google Chrome. Other browsers are not supported.
2. Setup Procedure
Advance Preparation and Checks
- Security Group Membership
Users to be synced are determined by security group membership.
Please confirm that the user belongs to the target security group.
All users in the security group specified in the sync conditions, as well as all users in any groups nested under it, will be included in the sync.
Note: There have been reports that sync fails if "Domain Users" is not selected as the primary group for users to be synced.
- Email Addresses Must Not Be Duplicated
Please confirm that there are no two or more user objects with the same email address
among the users to be synced. If the same email address exists, an error will occur during sync.
- Required Fields
The following three fields are required by TrustLogin, so they must exist in the user objects to be synced.
Last name, first name, email address
Note: It has been confirmed that if only a full-width space is synced for "last name" or "first name," the entire sync process will fail.
In that case, please correct the user data that contains only a full-width space.
Creating an AD User to Perform LDAP Queries
When the Connector runs LDAP queries in your environment, it runs the queries as an AD user (system account). Please create a user with "read-only" permissions only.
Note: Points to note when creating the user
- The option requiring a password change at initial logon must be disabled.
- Please create a dedicated user (system account) for this AD user. If you reuse an existing user, the search will fail if that user is included in the group being searched.
- If periodic password changes are enabled, you will need to update the sync settings in TrustLogin each time the password is changed.
- If the target user is included in the sync scope, sync will not be possible. Please make sure to exclude this user from the sync scope.
Setup Procedure
- Open the AD Integration screen.
- Open the User Sync Settings.
- By default, the User Sync Settings screen is displayed as shown below.
- Click "Add Domain" to configure the sync settings.
Note: If registered members will log in using only their Active Directory ID and password,
without using a TrustLogin password, before starting the sync,
please turn off "Automatically assign password authentication when a member is registered"
in advance under "Settings ＞ Optional Features ＞ Password Authentication ＞ Settings."
| Field Name | Required | Description |
| Sync Interval | 〇 |
The interval at which sync occurs. Default is 30 minutes. You can set a value from a minimum of 10 minutes to a maximum of 10,080 minutes. Note: If the value was set to 10 or less prior to August 21, 2025, you will need to specify a value of 10 or more the next time you save. |
| Domain (Basic information about your domain) | ||
| Domain | 〇 |
Your domain name. Example: globalsign.com |
| Domain Controller | × |
Normally, the Connector installed in your environment automatically selects Example: dc1.example.com |
| Protocol | 〇 | Please select the protocol available in your environment. Note that LDAPS using a self-signed certificate cannot be used. |
| Port | 〇 | Set the port according to the protocol. In most cases, the default value of 389 will work fine. |
|
AD User with Read Permissions (In this section, you configure the credentials used for the LDAP connection) | ||
| userBase | 〇 |
The user base of the AD used to perform LDAP queries. Example: DC=globalsign,DC=com |
| userDn | 〇 |
The distinguished name, or userPrincipalName, of the AD user used to perform LDAP queries. ・Example of a distinguished name: ・Example of userPrincipalName:
For details, please refer to "Troubleshooting A3" and check whether it corresponds to "LDAP: error code 49." |
| userPassword | 〇 | The AD password of the AD user used to perform LDAP queries. |
|
Sync Conditions (In this section, you map AD security groups to TrustLogin groups.) | ||
| Name | 〇 | A label for the sync condition. Any clear, easy-to-understand value is fine. |
| Source AD Domain User Group | × |
Turning this toggle ON will include all users in the domain in the sync. If OFF, only users belonging to the security group specified below will be included in the sync. |
| Source AD Security Group | 〇 |
The distinguished name of the AD security group to be synced. You can specify multiple security groups. Example: |
| Destination TrustLogin Group | × |
Specifies the TrustLogin group to which users You can specify multiple TrustLogin groups. |
|
AD Attributes to Sync (Maps attributes of the AD user object to TrustLogin user attributes. | ||
| First Name | 〇 | The user object attribute that corresponds to the user's first name. Example: givenName Note: If this contains only a full-width space, the entire sync process will fail. |
| Last Name | 〇 | The user object attribute that corresponds to the user's last name. Example: sn Note: If this contains only a full-width space, the entire sync process will fail. |
| Email Address | 〇 | The user object attribute that corresponds to the user's email address. Example: mail Note: Changing the email address of an AD user during active integration is not supported. |
| Department | × | The user object attribute that corresponds to the user's department. |
| Phone Number | × | The user object attribute that corresponds to the user's phone number. |
| Postal Code | × | The user object attribute that corresponds to the user's postal code. |
| Prefecture (State) | × | The user object attribute that corresponds to the user's prefecture (state). |
| City | × | The user object attribute that corresponds to the user's city. |
| Street Address | × | The user object attribute that corresponds to the user's street address. |
After entering all fields correctly, click the Save button. This will start the user sync.
Depending on the number of users to be synced, the sync may take some time.
(For 500 users, it will take approximately one hour to complete.)
Note: Repeatedly clicking the Save button on the User Sync Settings screen while a sync is in progress may cause the sync to fail.
Note: If you manually add and register a new TrustLogin user after integration has started,
that user will not be synced automatically, so you will need to perform a forced sync.
You can perform a forced sync by clicking "Save" on the "User Sync Settings" screen
shown in step 3 above, without changing any settings.
We also have a page summarizing frequently asked questions about AD integration, such as cases where user sync does not work as expected. Please refer to it as needed.