Skip to main content

Active Directory (LDAP)

Integrate Active Directory with Cloudaware via LDAP to discover users, groups, computers, and OUs into the CMDB for reporting and relationship mapping.

info
  • Audience: Cloudaware administrators
  • Outcome: The Active Directory LDAP connection is configured, and directory objects are continuously discovered in the CMDB

Capabilities​

The integration supports:

  • Discovery of Active Directory users, groups, computers, OUs, servers, and group policies in the CMDB
  • Relationships between Active Directory objects and related applications or assets in Cloudaware
  • Search and reporting for Active Directory objects using CMDB Navigator and CMDB list views

Prerequisites​

Before you begin, make sure you have:

  • Access to a Cloudaware account.
  • A user with access to the Admin Console for managing cloud accounts, organizations, and integrations (Cloudaware Administrator).
  • LDAP endpoint reachable from Cloudaware or via TunHub
  • Service account Bind DN and password
  • Base DN to scope discovery (e.g., DC=example,DC=com)

Setup​

  1. In Cloudaware, go to Admin.
  2. Select Active Directory (LDAP) → + ADD.
  3. Enter the following values:
    • Bind DN: The service account distinguished name.
    • Host: The LDAP host. Use the TunHub hostname if the host is private.
    • Port: The LDAP port, such as 389 or 636. Use the TunHub port if the host is private.
    • Password: The service account password.
    • Base DN: The directory base DN.
  4. Click SAVE.
  5. Confirm that the integration status indicator is green.

Verify Ingestion​

  • In CMDB Navigator, open ACTIVE DIRECTORY object lists.
  • Validate user/group counts and recent Last Updated timestamps.
  • Build a report filtering by OU to confirm scope.

Supported Objects​

Cloudaware ingests the following Active Directory (AD) objects:

Active Directory ObjectCMDB Object API Name
Active Directory ComputerCA10AD__CaAdComputer__c
Active Directory GroupCA10AD__CaAdGroup__c
Active Directory Group LinkCA10AD__CaAdGroupLink__c
Active Directory Group PolicyCA10AD__CaAdGroupPolicy__c
Active Directory Organizational UnitCA10AD__CaAdOrganizationalUnit__c
Active Directory ServerCA10AD__CaAdDirectory__c
Active Directory UserCA10AD__CaAdUser__c

Troubleshooting​

note

Initial directory discovery may take time to complete.

Authentication Failed or Integration Shows Red Status​

  • Verify that the Bind DN is the full distinguished name of the service account.
  • Re-enter the service account password.
  • Confirm that the account is not locked, expired, or blocked by directory policy.
  • Check that the LDAP server allows the bind method used by the integration.

TLS or LDAPS Connection Fails​

  • Confirm that the configured Port matches the LDAP mode, such as 389 for LDAP or 636 for LDAPS.
  • Verify that the LDAP server certificate is valid and trusted.
  • If the LDAP endpoint is private, configure access through TunHub.

No Directory Objects Appear in CMDB​

  • Allow the initial discovery cycle to complete.
  • Confirm that the Base DN includes the users, groups, computers, and OUs you expect to discover.
  • Verify that the service account has read access to the target directory scope.
  • In CMDB Navigator, check the ACTIVE DIRECTORY object lists.

Discovery Scope Is Too Broad or Too Narrow​

  • Review the Base DN value and adjust it to the required OU or domain scope.
  • Use a narrower Base DN to limit discovery to a specific part of the directory.
  • Use a broader Base DN if expected users, groups, computers, or OUs are missing.

Reconfigure or Remove the Integration​

warning

To update connection settings, edit the existing integration instead of deleting and re-creating it.

Update the Integration Details​

  1. Go to Admin.
  2. Select Active Directory (LDAP).
  3. Select the specific integration.
  4. Open the three-dot menu (⋮), then click Edit.
  5. Update the required fields.
  6. Click Save.

Remove the Integration from Cloudaware​

  1. Go to Admin.
  2. Select Active Directory (LDAP).
  3. Select the specific integration.
  4. Open the three-dot menu (⋮), then click Delete.
  5. Confirm the deletion if prompted.

Security Notes​

  • Use a dedicated Active Directory service account with the minimum required read access to the configured Base DN.
  • Scope discovery with the narrowest practical Base DN to limit which users, groups, computers, and OUs Cloudaware can read.
  • Prefer LDAPS on port 636 when the LDAP endpoint is reachable directly.
  • Rotate the service account password according to your organization's credential-rotation policy.
  • Credentials are stored securely and are only visible to Cloudaware collector.