--- title: "Configure AIM for Active Directory" canonical: "https://docs.aryaka.com/space/KNOW/1090388026/Configure%20AIM%20for%20Active%20Directory" format: markdown --- This topic describes the configuration required to integrate your organization's Active Directory domain server with Aryaka Identity Management (AIM) to provide identity authentication. During configuration, you must provide details about your active directory instance and which users and user groups you want to be included in the integration. To edit or delete an existing configuration, see the Manage Active Directory topic. Complete the following procedure to configure AIM for Active Directory: To configure identity authentication using Active Directory Open the Aryaka Identity Management page if it is not already open: Log in to MyAryaka. The Home page appears. Click Global Settings in the left navigation pane. The Global Settings page appears and displays a series of tiles. Click Manage in the Identity Management tile. The Aryaka Identity Management page appears. Click Add on the Enterprise’s Active Directory tile in the Available Identity Providers section. The Configure Enterprise’s Active Directory page appears and displays the following panes: AD Details User Queries User Group Queries Enter the following information in the fields displayed in the AD Details pane: Active Directory Name—Name for this Active Directory instance. Note that you can create multiple Active Directory instances. Host Name—URL or IP address of your Active Directory server. Secure Connection—Indicate whether the Active Directory connection is secure. Accept the default (Yes) or select No from the drop-down list. Port Number—The port your Active Directory server uses to connect to AIM. Accept the default port number or enter a different value. Note that the default port is 636 if the Secure Connection field is set to Yes; it is 389 if it is set to No. Bind DN—Distinguished name (DN) of the administrator user to use when querying the Active Directory server and requesting authentication. For example, CN=Administrator,CN=Users,DC=aryaka,DC=dev . Bind Credential—Password that corresponds with the Bind DN user. (Optional) Click the Advanced tab to display additional settings. These settings have default values that are displayed after you click Submit (step 7). You can also enter new values as needed for your organization. The settings and their associated defaults are as follows: User Object Classes—user, person, organizationalPerson Username AD Attribute—cn RDN AD Attribute—cn UUID AD Attribute—objectGUID Changed Sync Period—86400 (synchronization interval in seconds between Active Directory and the AIM service) User Search Scope—Subtree (drop-down list allows you to switch this value to One Level) Enter the following information in the User Queries pane: Enter a comma-separated list of distinguished user names in the Users DN field. For example, the string: CN=Users,DC=aryaka,DC=com queries for users' common names (CN), with a domain component (DC) defined as aryaka , and another domain component defined as com . Users returned by the query can be managed with AIM. (Optional) Click the Advanced tab to display additional configuration fields. The Include CN Members and Exclude CN Members panes appears. Click Add to enter user names that you want to either include or exclude from the user query. Enter the following information in the User Group Queries pane: Enter a comma-separated list of distinguished group names in the Groups DN field. For example the string: OU=Groups,DC=aryaka,DC=com queries for organizational units (OU) defined as Groups , with a domain component (DC) defined as aryaka , and another domain component defined as com (as in @aryaka.com). Groups returned by the query can be managed with AIM. (Optional) Click the Advanced tab to display the following additional configuration fields: Click Add on the Include CN Groups or Exclude CN Groups pane to enter user group names that you want to either include or exclude from the user query. Edit any of the following fields if your Active Directory structure differs from the listed defaults: Groups Object Classes—Group Groups AD Attribute—cn Member Attribute Types—DN Member Attribute—member Member User Attribute—cn Delete imported groups during sync—Yes Click Submit . AIM queries Active Directory and displays the results on the < IdPname > page. Note that you can click Resync on the Sync Status tile to perform the same query again. Related topics Manage Active Directory Aryaka Identity Management Security engine rulesets