LDAP

Directory Services

Overview

The LDAP Connector integrates with LDAP-compliant directory services, including Microsoft Active Directory, to synchronize identity and infrastructure data into the Brinqa platform. It retrieves user accounts, computer accounts, groups, printers, sites, and subnets over the LDAP protocol, mapping user entries to Person and computer entries to Host while surfacing the directory's own schema attributes for every object type.

Connections are made directly to the directory server over TCP with support for SSL/TLS, StartTLS, and configurable TLS protocol versions. Every model is retrieved with a paged subtree search rooted at the configured base context, so large directories are traversed in bounded batches.

The connector is built on the UnboundID LDAP SDK and implements the Brinqa Connectors Framework SPI (Connector, TestOp, DynamicSchemaOp, SearchOp).

Category: Directory Services

---

Data retrieved from LDAP

Connector Object	Required	Maps to Data Model
User	Yes	Person
Computer	Yes	Host
Group	Yes	Group
Printer	Yes	Printer
Site	Yes	Site
Subnet	Yes	Subnet

Model relationships

note

For detailed steps on how to view the data retrieved from LDAP in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select LDAP from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Hostname	Yes	my.ldap.server	The name or IP address of the host where the LDAP server is running.
Port	Yes	389	TCP/IP port number used to communicate with the LDAP server. The default is 389.
Principal	Yes	cn=manager	The distinguished name with which to authenticate to the LDAP server.
Password	Yes	—	Password for the principal.
Base context	Yes	ou=Acme,dc=example,dc=com	Starting point in the LDAP tree that will be used when searching the tree. Searches are performed when discovering users from the LDAP server.
Page size	Yes	500	Size of the batch of objects to process during search. This attribute must be less than the maximum search limit for the target directory.
User object classes	No	—	Specifies additional LDAP object classes to include when retrieving attributes for entries of the person object class. This allows access to custom attributes defined through schema extensions.
SSL/TLS	No	false	Use secure connection
Use STARTTLS	No	false	Upgrade a non-encrypted connection by wrapping it with SSL/TLS.
SSL/TLS protocol	No	TLSv1.2	Specify one of these acceptable SSL/TLS protocol values: TLSv1, TLSv1.1, TLSv1.2
Trust all	No	false	Trust all hostnames and certificates.

Authentication

The connector uses the LDAP protocol (not HTTP/REST), so it does not exchange an OAuth/bearer token over an HTTP endpoint. Authentication is performed via Simple Bind (principal DN + password) on a TCP connection to the directory server. Because there is no HTTP token exchange, the standard request-endpoint / request-headers / request-body / token-response tables are not applicable.

Bind Parameters

Parameter	Source	Description
Principal	principal config property	Distinguished name used to bind (e.g. cn=manager).
Password	credentials config property (confidential)	Password for the principal.
Host/Port	host / port config properties	Server endpoint the connection is opened against.
Transport	ssl / startTls / protocol / trustAll config properties	TLS negotiation settings for the connection.

Connection Flow

1. Establish TCP connection to the configured host and port.
2. Negotiate TLS if SSL or StartTLS is enabled (using TrustAllTrustManager with optional hostname verification, honoring the configured protocol version).
3. Perform Simple Bind using the configured principal DN and password.

How the Credential Is Used

A new authenticated LDAPConnection is opened per operation (connection test and each model search) and bound with the configured principal before any search request is issued on that connection. The same bound connection is reused across all paged search requests for that operation and is closed when the operation completes. There is no long-lived token to refresh.

---

Sync Behavior

Each sync is a full sync. The connector does not maintain a sync token and does not apply an incremental since filter, so every run re-fetches the complete set of entries for each enabled model using a paged subtree search. Source timestamps are still surfaced: the LDAP whenCreated and whenChanged attributes are mapped to SOURCE_CREATED_DATE and SOURCE_LAST_MODIFIED respectively, so downstream consumers can detect change over time.

How to obtain LDAP credentials

Obtain the required credentials (host, port, principal, credentials, baseContext, pageSize) from your LDAP administrator or the LDAP admin console, then enter them in the connection settings above.

note

Note: Anonymous bind is also supported — if the principal is left blank, the connector connects without authentication.

note

Note: Anonymous bind is also supported — if the principal is left blank, the connector connects without authentication.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

User

Source Field Name	SDM Attribute
(constant)	CATEGORIES
(schema-declared)	STATUS
department	DEPARTMENT
description / fallback to NAME	DESCRIPTION
displayName / cn / name / userPrincipalName / sAMAccountName	NAME
distinguishedName (normalized)	UID
givenName	FIRST_NAME
homePhone, telephoneNumber, otherTelephone, mobile, otherMobile, pager, otherPager, facsimileTelephoneNumber, otherFacsimileTelephoneNumber, ipPhone, otherIpPhone	PHONE_NUMBERS
mail	EMAILS
manager	REPORTS_TO
manager	MANAGERS
sAMAccountName	USERNAME
sn	LAST_NAME
title	JOB_TITLE
whenChanged	SOURCE_LAST_MODIFIED
whenCreated	SOURCE_CREATED_DATE

Computer

Source Field Name	SDM Attribute
(constant)	CATEGORIES
description / operatingSystem / fallback to NAME	DESCRIPTION
displayName / dNSHostName / name / cn / distinguishedName	NAME
distinguishedName (normalized)	UID
dNSHostName	DNS_NAMES
dNSHostName (filtered)	PRIVATE_DNS_NAMES
dNSHostName (filtered)	PUBLIC_DNS_NAMES
dNSHostName (normalized)	HOSTNAMES
operatingSystem + operatingSystemVersion	OPERATING_SYSTEM
whenChanged	SOURCE_LAST_MODIFIED
whenCreated	SOURCE_CREATED_DATE

Group

Source Field Name	SDM Attribute
distinguishedName (normalized)	UID
whenChanged	SOURCE_LAST_MODIFIED
whenCreated	SOURCE_CREATED_DATE

Printer

Source Field Name	SDM Attribute
distinguishedName (normalized)	UID
whenChanged	SOURCE_LAST_MODIFIED
whenCreated	SOURCE_CREATED_DATE

Site

Source Field Name	SDM Attribute
distinguishedName (normalized)	UID
whenChanged	SOURCE_LAST_MODIFIED
whenCreated	SOURCE_CREATED_DATE

Subnet

Source Field Name	SDM Attribute
distinguishedName (normalized)	UID
whenChanged	SOURCE_LAST_MODIFIED
whenCreated	SOURCE_CREATED_DATE

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

User

Operation options

Option	Type	Default	Description
context	String	baseContext config property	Overrides the LDAP search base for this operation.
filter	String	—	Native LDAP filter string, AND-combined with the model's object-class filter.
pageSize	Integer	pageSize config property (500)	Overrides the paged-search batch size for this operation.

Delta sync

Not supported. The connector performs a full sync of User on every run and applies no incremental date filter.

API

• Type: LDAP search (UnboundID LDAP SDK SearchRequest — not HTTP/REST) · Endpoint: LDAP
• Default filters: (&(|(objectClass=person)(objectClass=user))(!(objectClass=computer))) (AND-combined with the native filter option when provided)

Computer

Operation options

Option	Type	Default	Description
context	String	baseContext config property	Overrides the LDAP search base for this operation.
filter	String	—	Native LDAP filter string, AND-combined with the model's object-class filter.
pageSize	Integer	pageSize config property (500)	Overrides the paged-search batch size for this operation.

Delta sync

Not supported. The connector performs a full sync of Computer on every run and applies no incremental date filter.

API

• Type: LDAP search (UnboundID LDAP SDK SearchRequest — not HTTP/REST) · Endpoint: LDAP
• Default filters: (objectClass=computer) (AND-combined with the native filter option when provided)

Group

Operation options

Option	Type	Default	Description
context	String	baseContext config property	Overrides the LDAP search base for this operation.
filter	String	—	Native LDAP filter string, AND-combined with the model's object-class filter.
pageSize	Integer	pageSize config property (500)	Overrides the paged-search batch size for this operation.

Delta sync

Not supported. The connector performs a full sync of Group on every run and applies no incremental date filter.

API

• Type: LDAP search (UnboundID LDAP SDK SearchRequest — not HTTP/REST) · Endpoint: LDAP
• Default filters: (objectClass=group) (AND-combined with the native filter option when provided)

Printer

Operation options

Option	Type	Default	Description
context	String	baseContext config property	Overrides the LDAP search base for this operation.
filter	String	—	Native LDAP filter string, AND-combined with the model's object-class filter.
pageSize	Integer	pageSize config property (500)	Overrides the paged-search batch size for this operation.

Delta sync

Not supported. The connector performs a full sync of Printer on every run and applies no incremental date filter.

API

• Type: LDAP search (UnboundID LDAP SDK SearchRequest — not HTTP/REST) · Endpoint: LDAP
• Default filters: (objectClass=printqueue) (AND-combined with the native filter option when provided)

Site

Operation options

Option	Type	Default	Description
context	String	CN=Configuration, + baseContext config property	Overrides the LDAP search base for this operation; when set, the CN=Configuration, prefix is not applied.
filter	String	—	Native LDAP filter string, AND-combined with the model's object-class filter.
pageSize	Integer	pageSize config property (500)	Overrides the paged-search batch size for this operation.

Delta sync

Not supported. The connector performs a full sync of Site on every run and applies no incremental date filter.

API

• Type: LDAP search (UnboundID LDAP SDK SearchRequest — not HTTP/REST) · Endpoint: LDAP
• Default filters: (objectClass=site) (AND-combined with the native filter option when provided)

note

• If the configured base context does not already contain cn=configuration, the connector automatically prepends CN=Configuration, to the base context for site searches.

---

Subnet

Operation options

Option	Type	Default	Description
context	String	CN=Configuration, + baseContext config property	Overrides the LDAP search base for this operation; when set, the CN=Configuration, prefix is not applied.
filter	String	—	Native LDAP filter string, AND-combined with the model's object-class filter.
pageSize	Integer	pageSize config property (500)	Overrides the paged-search batch size for this operation.

Delta sync

Not supported. The connector performs a full sync of Subnet on every run and applies no incremental date filter.

API

• Type: LDAP search (UnboundID LDAP SDK SearchRequest — not HTTP/REST) · Endpoint: LDAP
• Default filters: (objectClass=subnet) (AND-combined with the native filter option when provided)

note

• Same as Site — the connector automatically searches under CN=Configuration if that component is not already present in the base context.

---

Changelog

Changelog

The LDAP connector has undergone the following changes:

Version	Description	Migration Steps
3.1.13	Bug Fixes - Fixed string attribute values being delivered with control characters (U+0000 through U+001F, and U+007F) exactly as the directory returned them. A NUL character in a value truncates the stored index key, breaks exact-match and CONTAINS searches, and corrupts CSV, JSON and data-warehouse exports. Control characters are now removed from every string attribute before it leaves the connector; tab, newline and carriage return are replaced with a single space so words stay separated. Values with no control characters are passed through unchanged, and attributes the directory declares with distinguished-name syntax are unaffected — they were already escaped per RFC 4514.	N/A
3.1.12	Bug Fixes - Fixed an issue where Active Directory date/time attributes with sentinel values (e.g., "not set" or "never expires") could produce invalid/out-of-range timestamps, causing sync failures due to Parquet timestamp/BigQuery's supported date range overflow errors. AD magic numbers (0, -1, Long.MAX_VALUE) and dates outside 1970–9999 are now returned as null instead of unreasonable far-future dates. Improvements - Improved Active Directory datetime attribute detection to also match by attribute name, ensuring fields like accountExpires are correctly identified as timestamps regardless of the LDAP server's OID configuration. - Added detailed logging to Windows FILETIME conversion with warn-level messages when sentinel values or out-of-range timestamps are dropped.	N/A
3.1.11	Improvements - Added detailed Data Source documentation for each model, describing the LDAP search base, filter, scope, requested attributes, and pagination strategy used during synchronization.	N/A
3.1.10	Improvements - Upgraded internal framework to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.1.9	Improvements - Changed schema initialization in LdapModel from eager (constructor) to lazy with synchronized access, deferring the LDAP connection until the schema is first requested. - Made schema and attributeInfoMap fields non-final to support lazy initialization. - getAttributeInfoMap() now calls schema() internally to ensure lazy initialization has occurred. - Improved unsupported attribute type log message to include the syntax OID (attributeType={syntaxOID}) alongside the attribute name. Bug Fixes - Fixed NullPointerException in User.getUserCustomObjectClasses() when additionalUserObjectClasses configuration property is blank or null — now returns Collections.emptyList() instead of attempting to split a blank string.	N/A
3.1.8	New Features - New configuration property additionalUserObjectClasses that allows specifying additional LDAP object classes for retrieving custom user attributes defined through schema extensions. - Display and help text for the new property in Messages.properties. Improvements - Refactored getUserCustomObjectClasses to return a List instead of an array. - Removed the flags attribute from the additional user object classes configuration property. - Updated help text for the additional user object classes property to clarify its purpose. - Fixed grammar error in help text for additional user object classes in Messages.properties.	N/A
3.1.7	New Features Broader Person Coverage - The User sync now includes standard LDAP person object classes (person / inetOrgPerson) in addition to Active Directory user accounts. Human users from non-Active-Directory directories — and additional person records previously skipped — are now retrieved. Computer accounts continue to be excluded from the User model. Re-syncing will surface any additional user records that are now in scope.	N/A
3.1.6	Improvements - Hardened the handling of multi-valued and single-valued attribute values during synchronization for more consistent, reliable attribute population.	N/A
3.1.5	Improvements - Attribute matching is now case-insensitive, so directory attributes are mapped reliably regardless of the casing returned by the server. - Schema is now loaded once and reused, reducing redundant directory lookups during synchronization.	N/A
3.1.4	Bug Fixes Active Directory Timestamp Conversion - Corrected the conversion of Active Directory time attributes (such as last logon and password-last-set). Previously these timestamps were computed incorrectly and produced invalid date values; they now resolve to the correct date and time.	• User / Computer: Date attributes sourced from Active Directory time fields now resolve to corrected values. Re-sync the connector so existing records are refreshed with the corrected timestamps.
3.1.3	Bug Fixes - Fixed an error that could occur during synchronization when an expected attribute was absent from a directory entry. Missing attributes are now skipped safely instead of interrupting the sync.	N/A
3.1.2	Improvements Computer Host Attributes - Consolidated computer host and DNS data onto the multi-valued hostname and public DNS name attributes, removing the deprecated single-value equivalents.	• Computer: The deprecated single-value hostname and public DNS name attributes (and their use as identifiers) have been removed in favor of the multi-valued equivalents. Re-sync the connector so Computer assets are rematched on the current identifiers.
3.1.1	New Features Trust All Hostnames and Certificates - Added a new "Trust all" configuration option that allows the connector to trust all hostnames and certificates. This eases connectivity to directory servers using self-signed or otherwise untrusted certificates.	N/A
3.1.0	New Features Active Directory Support - Added dedicated support for Microsoft Active Directory, including correct interpretation of Active Directory date/time attributes. Improvements - Reworked the directory connectivity and schema-discovery layer for more robust attribute retrieval across directory implementations. Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.9	Improvements - Custom attributes defined through directory content rules (DIT content rules), including those contributed by auxiliary object classes, are now discovered and synchronized. This surfaces additional schema-extended attributes that were previously not retrieved.	N/A
3.0.8	Improvements - Removed the fixed per-operation timeout so long-running directory searches against large or slow directories are no longer cut short.	N/A
3.0.7	Improvements - Removed the fixed connection timeout to improve reliability when establishing connections to directory servers under varying network conditions.	N/A
3.0.6	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.5	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.4	Improvements - Added detailed error logging for connection, schema-retrieval, test, and search failures to make troubleshooting connectivity and synchronization issues easier.	N/A
3.0.3	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.2	Improvements - Added connection and operation timeouts to directory connections so the connector fails fast and predictably when a directory server is unreachable or unresponsive.	N/A
3.0.1	Improvements - Internal code cleanup with no change to connector behavior.	N/A
3.0.0	Overview The LDAP connector integrates with LDAP-compliant directory services, including Microsoft Active Directory, to synchronize identity and infrastructure data into the Brinqa platform. It retrieves users, computers, groups, printers, sites, and subnets over the LDAP protocol with support for SSL/TLS, StartTLS, and paged search. Category: Directory Services Models	N/A