Skip to content
DromlikDocs
sv

Active Directory integration

Last updated: 2026-07-01

Integrate Dromlik with an on-premises Microsoft Active Directory(AD) to sync users into Dromlik and let them sign in with their Windows domain account. This is the right choice when your identity source is a local AD forest rather than Entra ID in the cloud.

What the integration does

  • LDAP user sync — Dromlik reads users, groups and organisational units from AD over LDAP or LDAPS and creates matching extensions.
  • Domain sign-in — users sign in to the Dromlik App with their DOMAIN\username and Windows password.
  • Continuous sync — set an interval and Dromlik keeps names, emails, mobiles and job titles up to date.

Requirements

  • A reachable Active Directory domain controller (LDAP 389 or LDAPS 636).
  • A service account in AD with read access to the users/OUs you want to sync.
  • For LDAPS: the domain controller's CA certificate.
  • Administrator access to Dromlik.

Set up the integration

  1. 1

    Create a bind account in AD

    Create a dedicated service user in AD (e.g. svc-dromlik) with read-only permission on the OUs you plan to sync. Use LDAPS if the domain controller is reachable outside a trusted network.

  2. 2

    Connect Dromlik to AD

    In Dromlik, go to Integrations → Active Directory. Enter:

    • Server address — hostname or IP of the domain controller
    • Port — 389 (LDAP) or 636 (LDAPS)
    • Base DN — e.g. DC=corp,DC=example,DC=com
    • Bind DN — e.g. CN=svc-dromlik,OU=Service Accounts,DC=corp,DC=example,DC=com
    • Bind password — the service account's password

    Click Test connection before saving.

  3. 3

    Choose OUs and groups to sync

    Pick the OUs whose users should get a Dromlik extension. Map AD security groups to Dromlik extension groups if you want new hires to land in the right team automatically.

  4. 4

    Map AD attributes

    Confirm which AD attributes map to which Dromlik fields. Defaults: givenName/sn → name, mail → email, mobile → mobile, telephoneNumber → work number, department → department.

  5. 5

    Enable domain sign-in

    Turn on Allow AD sign-in. Users can now sign in to the Dromlik App with their Windows domain credentials.

Troubleshooting

"Invalid credentials" — the bind DN or password is wrong, or the account is locked/expired in AD.

"Can't reach server" — check firewall rules and DNS resolution from the Dromlik server to the domain controller.

Only some users appear — widen the Base DN or add more OUs to the sync scope.