Skip to main content

​
Reach Active Directory once, use its accounts everywhere in Syteca

Syteca uses Active Directory in three places that all depend on LDAP target configuration. Adding AD users to Syteca and giving them Management Tool access. Storing AD account credentials as secrets that the Password Management feature can rotate. Configuring LDAP-backed Syteca user groups whose members are synchronized from AD groups. All three need a working LDAP target pointing at the right directory server.
Configure an LDAP target when your Syteca deployment needs to:
  1. Provision Active Directory users into Syteca as Management Tool users, without recreating accounts manually.
  2. Use AD credentials for admin login instead of local Syteca accounts.
  3. Rotate the passwords of AD service accounts through Syteca’s Password Management feature.
  4. Populate Syteca user groups from AD group memberships kept in sync with the source of truth.

​
Two target types

Syteca supports two LDAP target types, matched to two different AD reach patterns.
For deployments with a single AD domain, add a single-domain LDAP target. For deployments spanning multiple domains in an AD forest, add one Global Catalog LDAP target instead of one target per domain. Editing user provisioning later is far simpler with the Global Catalog approach.

​
Prerequisites

The Management Tool user performing the LDAP target configuration must:
  1. Log in to the Management Tool as a user with the administrative Database Management permission.
  2. Have access to the domain controller from the Syteca Application Server (network reachability and, for LDAPS, valid trust to the domain controller’s certificate).
Additional requirements for LDAPS (LDAP over SSL) targets:
  1. The domain controller certificate must be signed by a Certificate Authority (CA) trusted by the Application Server.
  2. The domain controller’s fully qualified name must be resolvable from the Application Server (not just its short name).

​
Open the LDAP Targets tab

Both target types are added on the same tab.
  1. Click the Configuration button at the top of the Management Tool interface.
  2. On the Configuration page, select the LDAP Targets tab.
  3. Click the Add button at the top of the page. The Add LDAP Target page opens.

​
Add a single domain LDAP target

Use this option when Syteca needs to reach one specific AD domain, or a specific Organizational Unit within a domain.

​
The LDAP Path format

Enter the LDAP path in the LDAP Path field. The exact format depends on whether you want the whole domain, a specific OU, or an LDAPS connection.
Basic format for a whole domain, unencrypted:
Example. To connect to the test.app.local domain via the SYTECAAPP domain controller:

​
Fill in the remaining fields

1

Enter Domain NetBIOS Name

In the Domain NetBIOS Name field, enter the NetBIOS name of the domain the target reaches.
2

Enter User credentials

In the User field, enter the username of an existing account belonging to the target domain.In the Password field, enter the password for that account.
The credentials of a domain user are also required to use the Password Management feature against accounts in this domain. If Password Management is planned, provide credentials with the appropriate permissions to change AD passwords.
3

Test the connection

Click Test Connection to verify the values entered can establish a connection to the Active Directory domain controller.
The LDAP target cannot be saved until the connection test succeeds. If the test fails, verify the LDAP path syntax, network reachability, credentials, and (for LDAPS) certificate trust.
4

(Optional) Auto-create a secret for the credentials

Select the Create secret checkbox to have Syteca automatically create a new secret storing the connection credentials. Useful when you plan to rotate the domain user’s password later.The auto-created secret uses the following values:All other settings on the secret are set to the defaults. The credentials on a different secret can be used later by editing the LDAP target and selecting any secret in the Use secret drop-down list that the user has Owner permission on.
5

Save the LDAP target

Click Save in the bottom right of the page. The new LDAP target appears in the list on the LDAP Targets tab.
LDAP Targets tab showing an added single-domain LDAP target in the grid

LDAP Targets tab with a single-domain target added.

​
Add an AD Global Catalog LDAP target

Use this option when Syteca needs to reach every domain and subdomain within an Active Directory forest through a single target, instead of adding one target per domain.

​
The LDAP Path format for a Global Catalog

Enter the LDAP path in the LDAP Path field, using the GC:// prefix:
Example. To connect to the root.com domain on the DC-ROOT domain controller that holds the Global Catalog role:
The default port for Global Catalog LDAP connections is 3268. A different port can be specified by adding it at the end of the LDAP Path, separated by a colon.

​
Fill in the remaining fields

1

Resolve or enter the Domain NetBIOS Name

In the Domain NetBIOS Name field, click Try to Resolve to the right of the field. Syteca queries the domain controller for the NetBIOS name of the Global Catalog domain.If the automatic resolution does not return a name, enter the NetBIOS name manually. Example value: ROOT.
2

Enter User credentials

In the User field, enter the username of an existing AD account belonging to the domain controller with the Global Catalog role.In the Password field, enter the password for that account.
3

Test the connection

Click Test Connection to verify the values entered can establish a connection to the Active Directory domain controller.
The LDAP target cannot be saved until the connection test succeeds.
4

(Optional) Auto-create a secret for the credentials

Select the Create secret checkbox to have Syteca automatically create a new secret storing the connection credentials, useful for remote password rotation of the account. Same behavior as the equivalent option for a single-domain target above.
5

Save the LDAP target

Click Save. The new Global Catalog LDAP target appears in the list on the LDAP Targets tab.
LDAP Targets tab showing an added AD Global Catalog LDAP target in the grid

LDAP Targets tab with an AD Global Catalog target added.

​
Using Global Catalog users elsewhere in Syteca

Once a Global Catalog LDAP target is saved, AD users from the entire forest can be searched for and selected when adding an AD user on the Users page.

​
Automatic LDAP targets

If the Syteca Application Server is installed on a computer that already belongs to an Active Directory domain, that domain is added as an LDAP target automatically during Application Server installation. No manual configuration is required. Automatic LDAP targets appear in the grid on the LDAP Targets tab, marked as Automatic in the Type column.
LDAP Targets tab showing an automatic LDAP target created during Application Server install

LDAP Targets tab. Automatic targets are marked with Automatic in the Type column, distinguishing them from manually added targets.

Global Catalog LDAP targets cannot be added automatically. When using an AD Global Catalog to reach an entire AD forest, always add it manually using the procedure in Add an AD Global Catalog LDAP target above.

​
Refresh an automatic LDAP target

If the computer running the Application Server has been added to a domain after the Application Server was installed, or has been moved to a different domain, the automatic LDAP target must be refreshed to pick up the new domain. The same procedure also creates the automatic target if it does not yet exist.
1

Log in with the required permission

Log in to the Management Tool as a user with the administrative Database Management permission.
2

Open the LDAP Targets tab

Click the Configuration button at the top of the Management Tool. On the Configuration page, select the LDAP Targets tab.
3

Refresh the automatic target

Click the Refresh Automatic LDAP Target button at the top of the page. If no automatic LDAP target exists yet, one is added. If an automatic LDAP target already exists, it is updated.
To change the credentials stored for an automatic LDAP target (for example, when the password of the domain user has changed), click the Edit icon next to the target and enter the new credentials on the Edit LDAP Target page.

​
Edit an LDAP target

1

Open the LDAP Targets tab

Log in to the Management Tool as a user with the administrative Database Management permission, click Configuration, and select the LDAP Targets tab.
2

Open the target for editing

Click the Edit icon next to the LDAP target you want to change.
3

Edit the target parameters

On the Edit LDAP Target page, change any of the LDAP target parameters as needed.
4

Choose how credentials are supplied

Unlike when adding a new LDAP target, editing offers a choice between two credential sources:
  • Enter credentials manually — use the User (an existing user in the Active Directory domain being connected to) and Password fields below this option.
  • Use secret — select any secret from the drop-down that you have Owner permissions for; its stored credentials are used for the LDAP target instead.
5

Test the connection

Click Test Connection to confirm Syteca can reach the Active Directory domain controller with the values entered.
The LDAP target can’t be saved until the connection test succeeds.
6

Save

Click Finish to save the changes.
Edit LDAP Target page with the Enter credentials manually and Use secret options

Choosing between manual credentials and a stored secret when editing an LDAP target.

​
Delete an LDAP target

1

Open the LDAP Targets tab

Log in to the Management Tool as a user with the administrative Database Management permission, click Configuration, and select the LDAP Targets tab.
2

Remove the target

Click the Remove icon next to the LDAP target — or click Remove All in the column header to delete every LDAP target listed.
3

Confirm

Click Delete in the confirmation pop-up.
Once deleted, the target no longer appears in the grid, and users from that domain can no longer log in to the Management Tool or authenticate to Client computers using secondary user authentication.

​
Synchronize Active Directory user groups manually

For endpoint AD users who have sessions recorded, Syteca synchronizes their AD user group memberships automatically. In certain cases where automatic synchronization is not possible, run the sync manually. Common scenarios include after adding a large batch of AD users at once, or after an AD group restructuring at the domain controller level.
1

Log in with the required permission

Log in to the Management Tool as a user with the administrative Database Management permission.
2

Open the LDAP Targets tab

Click the Configuration button, then select the LDAP Targets tab.
3

Open the Sync AD User Groups popup

Click the Sync Active Directory User Groups button at the top of the page. The Update Data for AD User Groups popup opens.
4

Choose a domain and start the sync

In the Domain field, search for and select the domain to synchronize. Click OK.
Only domains that contain at least one endpoint AD user with at least one recorded session appear in the domain list. Domains without any recorded sessions are not shown, because there is nothing for Syteca to sync against.
5

Track progress

Synchronization can take a long time to complete, especially for large AD forests. Track progress on the Tasks List tab of the System Health page.

Users

Adding AD users to Syteca. LDAP targets are the prerequisite.

PAM Secrets

The Create Secret option on LDAP targets creates a PAM secret for the domain user account.

Administrative permissions

The Database Management permission that gates LDAP target configuration.

Password Management

Rotate AD account passwords via LDAP targets and the auto-created secrets.