Breadcrumbs

Active Directory Synchronization

Synchronize users and groups from Active Directory, so people sign in to GlobalForms with their domain account and AD groups become GlobalForms roles.

What synchronization does

  • Groups become roles. Each AD group in scope becomes a GlobalForms role with the same name. Use these roles in form access settings.

  • Users are created or updated with the roles for their groups and the Authenticated role.

  • Passwords stay in Active Directory. Users sign in as DOMAIN\username with their domain password, which GlobalForms checks with Active Directory each time.

  • The built-in Administrator account and users created directly in GlobalForms are not changed.

By default, every synchronized user can create submissions on any form that allows the Authenticated role. Limit synchronization to the OUs you need, and use form access settings to control who can submit each form.

Before you begin

  • The name or address of a domain controller.

  • Your domain's base DN, for example dc=example,dc=local for example.local.

  • The organizational units (OUs) that contain the users and groups you want.

  • A domain service account that can read users and groups.

Configure Active Directory

  1. Add an ldap section to config\local.json:

    JSON
    {
  "ldap": {
    "url": "ldap://dc01.example.local",
    "baseDN": "dc=example,dc=local",
    "username": "EXAMPLE\\svc_globalforms",
    "password": "<Password>",
    "ou": ["Staff", "Contractors"],
    "interval": 60
  }
}

    Write the backslash in the user name twice, as shown.

  2. Restart the GlobalForms service.

  3. Sign in to GlobalForms as an administrator and select Synchronize AD in the menu bar to run the first synchronization.

  4. When it finishes, a message shows how many groups and users were added and updated. Check the new roles and users.

Settings

Setting

Description

url

Required. Domain controller address, for example ldap://dc01.example.local (port 389)

baseDN

Required. Where to search, for example dc=example,dc=local

username

Required. Service account as DOMAIN\\user. The domain part is also used as the prefix for synchronized user names.

password

Required. Service account password

ou

Optional. A list of OU names to include. If left out, all users and groups under baseDN are synchronized.

filter

Optional. An LDAP filter to limit which objects are read. Default (objectclass=*).

interval

Minutes between automatic synchronizations. 0 or left out turns automatic synchronization off. Automatic synchronization starts after the first interval has passed.

Troubleshooting

Message or symptom

Cause and fix

Configuration is missing ldap section

Add the ldap section to local.json and restart the service.

user or password is incorrect in local.json file's ldap parameters

Check username (with the domain and a double backslash) and password.

url is incorrect in local.json file's ldap parameters

The domain controller name can't be found. Check url and DNS.

AD server is not responding…

Check that the domain controller is running and that port 389 is open from the GlobalForms server.

Expected users or groups are missing

Check ou and filter, then synchronize again.

A user can't sign in

Users sign in as DOMAIN\username. Check that the account is enabled in Active Directory and that the user was synchronized.