---
title: Quick LDAP/AD Definition 
slug: kronpam-reference-guide-3-9-0/quick-ldapad-definition
description: Learn how to add a new LDAP server in the administrator settings with this comprehensive guide. Discover the necessary configuration parameters, advanced settings, and how to populate attributes such as email and manager information. Visual aids are inclu
docTags: 
createdAt: 2022-08-03T09:57:57.000Z
---

To use the Kron PAM Setup Wizard to configure an LDAP/Active Directory integration:

1. Navigate to **Administration > System Configuration Manager > Integrations > Ldap Integration.**

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/31lMaDbmF_5lrA3-xA26X_image.png "LDAP Manager ")

- Click **Add New Ldap Server.**

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/5XUJkcvPlYuw0YVhycxFT_image.png" size="70" isUploading="false" width="595" height="764" darkWidth="595" darkHeight="764" showCaption="false"}

1. Enter the related configuration parameters:
   -
     **LDAP Source Name**: A different name must be defined for each LDAP, like ldap1, ldap2, etc.
   -
     **URL**: LDAP IP address and port number.
   -
     **Domain**: LDAP domain.
   - **Username**: read-only user credentials to get the user list information
     .
   - **Password**: the username’s password
   - **Base DN**: LDAP group area or organization unit
   - **Group Search Phase**: The search phase of the imported user groups must be provided as (objectClass=group)
   - **User Search Phase**: The search phase of the imported users must be provided as (objectClass=user)
   - **Principal Key**: Represents user information that is sent to AD for authentication. For instance, if you use only the question mark(**?**), the username is only sent to AD for authentication, but if you use the domain after the question mark (?domain.com) query sends the username with the domain.
   - Follow these steps for each LDAP definition.
2. Click the **Save** button.

:::hint{type="info"}
The Password field in LDAP User Integration and LDAP Device Integration configuration is no longer mandatory. When the Username field follows the user\@device format, the system queries the “VAULT” first. If a matching credential exists in the vault, the vault password is used regardless of whether a static password is defined in the integration configuration. If no vault credential is found, the system falls back to the manually provided static password if present. Vault-managed passwords support periodic rotation without requiring reconfiguration of LDAP integration definitions. This behavior applies consistently to both LDAP User Import and LDAP Device Discovery.
:::



::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/LsDn_MgQA4HlWbntu4WEM_image.png" size="80" caption="Figure - Example Usage of Vault account in LDAP configuration" isUploading="false" width="648" height="421" darkWidth="648" darkHeight="421" showCaption="true"}

### Advanced Settings

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/e2XHoHqrDUESBWO4_LL5o_image.png" size="56" width="754" height="651" position="center" caption="LDAP Account Advanced Settings " darkWidth="754" darkHeight="651" showCaption="true"}

**Is Active Directory: **If the LDAP account is a Windows Active Directory, it should be set as **YES**.

**NIS Net Group Enable: **This parameter only applies to an Oracle 11g LDAP. The value can be set as** YES** or **NO.** The default value is **NO**. 
In an Oracle LDAP, there may be a netgroup entry defined by objectClass with the value nisNetGroup. If the value is TRUE, it enables the import of users with the netgroup property.

**User Search with Member of: **If the users have the MemberOf attribute in the LDAP Server, this parameter can be set to **Yes** to import users. By default, the Members attribute in the User Group is used to import users.

**User Phone Number Attribute: **Kron PAM can send SMS to users by using the **phoneNumber** property of users. When adding users from AD/LDAP, the attributes to be looked at first should be included in this advanced parameter to fill out the user's **phoneNumber **property. Multiple attributes can be defined. Starting from the first defined attribute, the **phoneNumber** user property is filled with the first attribute that is full.

**User Personal No Attribute: **When adding users from AD/LDAP, the attributes to be looked at first should be included in this advanced parameter to fill out the user's **Personal No** property. Multiple attributes can be defined. Starting from the first defined attribute, the **Personal No** (personal\_id in the database) user property is filled with the first attribute that is full.

**Additional Attributes: **Additional attributes can be added with a comma (,) separator without a space. 
For example: userPrincipalName,objectClass,ubaThreshold

**Connector Site Name:** If you are using the Tenant Connector feature, you should select the remote site name.

Usually, LDAP user attributes are taken from AD and filled accordingly for a user, but the email attribute is an exception. If the email attribute is needed for an LDAP user with no email value on AD, this attribute can be filled on the **User Properties** screen. If the email attribute is filled on AD, the LDAP sync job overwrites this email property.

The Manager attribute is added to the user properties automatically when LDAP is imported. However, it is mandatory to import the AD user managers to Kron PAM. If the AD managers are not imported, the Manager attribute won’t be added to the user properties.

The attributes are shown in the **User Properties** window in the following figure.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/3P-SvYxIubf-wAA5qsO-t_image.png" size="58" width="754" height="645" position="center" caption="LDAP User Properties " darkWidth="754" darkHeight="645" showCaption="true"}