---
alias: operation-guide-security-portal-strategy-activedirectory
description: "Sign in users with their Windows Active Directory account, validated by the Security Portal over LDAP."
---

# Windows Active Directory

The **Windows Active Directory** strategy signs in users with their Windows Active Directory account. The Security Portal validates the user name and password against Active Directory over LDAP or LDAPS. Users sign in as `DOMAIN\user`, and the strategy matches them to the MES User with that account. For other LDAP directories, use the [[operation-guide-security-portal-strategy-ldap|LDAP Server]] strategy.

Before configuring the strategy, collect the address of the Active Directory server, the base distinguished name where the user search starts, and a user with permission to search Active Directory.

## Configuration

Available out of the box with the ID `ActiveDirectory`. Enable and configure it in DevOps Center during the installation, with the domain, address, base DN, user name, password, port, SSL, and certificate validation settings. Disabled by default. For more than one domain, see [Multiple Domains](#multiple-domains).

### Parameters

| **Strategy type**       | **Plugin**                                 |
|-------------------------|--------------------------------------------|
| `local-ActiveDirectory` | `@criticalmanufacturing/auth-plugin-local` |

Table: Windows Active Directory strategy type and plugin

Each strategy entry also accepts the [common strategy properties](../security-portal-configuration/security_portal_config_securityportal.md#common-strategy-properties).

| **Parameter**                       | **Required** | **Description**                                                                                                            |
|-------------------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------|
| `defaultDomain`                     | No           | Domain added to the user name when the user signs in without a `DOMAIN\` prefix.                                           |
| `ldap.url`                          | Yes          | Address of the Active Directory server, for example `ldap://example.com`. Use an `ldaps://` address to connect over LDAPS. |
| `ldap.base`                         | Yes          | Base distinguished name where the search starts, for example `DC=example,DC=com`.                                          |
| `ldap.user`                         | Yes          | User with permission to search Active Directory.                                                                           |
| `ldap.password`                     | Yes          | Password of `ldap.user`.                                                                                                   |
| `ldap.disableCertificateValidation` | No           | Set to `true` to skip the validation of the LDAPS server certificate. Default: `false`.                                    |
| `ldap.caCertificatePath`            | No           | Path of the CA certificate that validates the LDAPS server certificate. If omitted, the system certificate store is used.  |

Table: Windows Active Directory strategy parameters

### Example

```json
{
  "id": "ActiveDirectory",
  "type": "local-ActiveDirectory",
  "config": {
    "defaultDomain": "<DefaultDomain>",
    "ldap": {
      "url": "ldap://<example.com>",
      "base": "DC=<example>,DC=<com>",
      "user": "<User>",
      "password": "<Password>"
    }
  }
}
```

### Multiple Domains

To sign in users from more than one Active Directory domain, configure one `local-ActiveDirectory` strategy per domain. See [[operation-guide-multipledomains]].