Your administrator account associated with Active Directory must be configured in the directory and have read permissions to the organizational unit where user attribute searches are done.

This topic details specific tasks for configuring an Active Directory datastore connection. For more comprehensive information and instructions, see Datastores in the PingFederate Server documentation.

  1. From the PingFederate admin console, go to System > Data Stores. Click Add a New Data Store.
    The Data Store window configuration opens.
  2. On the Data Store Type tab:
    1. In the Name field, enter a name.
    2. From the Type list, select Directory (LDAP).
    3. Click Next.
  3. On the LDAP Configuration tab:
    1. In the Hostname(s) field, enter the hostname for the configuration. Click Add.

      This is the hostname of the domain controller.

      Note:

      The Hostname(s) field entry can rely on network naming to route to the closest domain controller. For example, pingdemo.com resolves to dc1.pingdemo.com.

      Alternatively, you can define domain controllers explicitly, separated by a space. For example, dc1.pingdemo.com dc2.pingdemo.com. This creates a failover to each domain controller. If it does not find the user in the first directory, it then queries the second and so on.

    2. In the User DN field, enter the distinguished name (DN).

      This is used as the domain name of the service account used to query the directory.

    3. In the Password field, enter a password.

      This is the password of the service account.

    4. Select the Use DNS SRV Record check box.

      SRV records are not required for this configuration, but you can use them.

    5. Choose whether to enable the Use LDAPS check box.
      • Select the Use LDAPS check box.

        The configuration assumes port 636 if the LDAPS option is selected.

      • Clear the Use LDAPS check box.

        The configuration assumes port 389 if the LDAPS option is cleared.

      Note:

      If you are running your directory on another port, you must state this in the Hostname(s) field as shown in the image below, and have the Active Directory public certificate uploaded in your trusted keystore. In following image, notice port 1389 is specified in the Hostname(s) field.


      A screen capture of the Data Store window and LDAP Configuration tab in PingFederate. The LDAP Configuration tab contains multiple configuration fields for the user to edit. The following fields and their entries are displayed: Hostname(s) with cjmuir-r:1389 and selected as the default, another row of Hostname(s) with Email address, a cleared Use LDAPS check box, a cleared Use DNS SRV Record check box, the Load Type list with the PingDirectory option selected, a cleared Bind Anonymously check box, the User DN field with cn=Directory Manager entered, the Password field with a hidden entry, and cjmuir-r:1389 selected from the connection list, and the Test Connection button displayed.
    6. Click Next.
    7. On the Summary tab, click Save.
    The Data Store configuration window closes. You are directed back to the Data Stores window where you can manage all your datastore connections.