LDAP

Many organisations run one or more LDAP directories (OpenLDAP, Oracle/Sun Directory, others) beyond Active Directory. The generic LDAP connector governs any standards-compliant directory, aggregating entries and group memberships and provisioning changes over the protocol.

The LDAP integration is a directory connector. It binds to the directory over LDAP or, preferably, LDAPS using a service account DN. As with every connector, the flow is the same: authenticate to LDAP, read accounts and entitlements during aggregation, and write changes during provisioning.

• 1. Configure the connection and credentials for LDAP.
• 2. Map the account schema, mapping directory entry attributes and group memberships (for example member/memberOf) to SailPoint accounts and entitlements.
• 3. Set the correlation logic so LDAP accounts attach to the right identities (typically on a stable key such as employee ID or email).
• 4. Run account aggregation and confirm accounts and entitlements load.
• 5. Verify correlation, watching for uncorrelated/orphan accounts.

SailPoint can create, modify, enable and disable directory entries and manage group membership, driven by roles, requests and lifecycle events.

Govern group memberships, which are the entitlements in a directory. Pay attention to nested groups and the specific membership attribute your directory uses.

When LDAP aggregation or provisioning fails, work through the usual causes in order:

• Verify the bind DN and password and that LDAPS trust is established.
• Confirm the service account can read the base DN and write where needed.
• Check network/port access (389/636) to the directory.
• Validate the search base, filters and membership attribute mapping.

• Credential expiry (tokens/secrets/certs) silently breaking the connector.
• Insufficient rights on the LDAP service account for the operations you need.
• Schema or correlation misconfiguration leaving accounts uncorrelated.