Day 12

What is Active Directory, and why is it often called the company's "master phonebook"?

Active Directory (AD) is Microsoft's system for storing and managing user accounts and logins across a company network, holding one entry per person with details like username, department, and group memberships, similar to one master listing everyone relies on.

Why do companies rely so heavily on Active Directory for logins?

It gives employees one login instead of dozens, lets group memberships map directly to access, and gives IT the fastest single lever to change someone's access the moment they join, move, or leave.

What does "integrating AD with SailPoint" actually mean?

It means setting up a working, ongoing connection between the two systems so SailPoint can read AD accounts and group memberships as part of its regular aggregation process, rather than a one-time data export.

What is the role of the AD connector specifically?

It's the dedicated software bridge that knows how to ask Active Directory for account and group data in AD's own native format, configured with AD's address and a set of allowed credentials; without it, SailPoint cannot read anything from AD.

What two main types of data typically flow from AD into SailPoint?

User accounts (usernames, display names, emails, and enabled/disabled status) and group memberships, which often become entitlements inside a person's Identity Cube.

What is a domain controller, and why do larger companies often run several of them?

A domain controller is a server holding a live copy of the Active Directory database that answers directory questions; larger companies run several, kept in sync with each other, for reliability and speed.

What is the difference between read access and write access when SailPoint connects to AD?

Read access lets SailPoint view AD data without changing anything, while write access, sometimes called provisioning, lets SailPoint also make changes back in AD, like disabling an account; most organizations start with read-only access for safety.

What does LDAP stand for, and how would you describe it to a beginner?

LDAP stands for Lightweight Directory Access Protocol, a standard, widely used language many different directory systems use to answer lookup questions, designed to be simple and fast.

How does Active Directory relate to LDAP?

Active Directory is one specific Microsoft product, while LDAP is a general, open standard that many products support; under the hood, AD actually uses LDAP as one of its main languages, so every Active Directory speaks LDAP, but not everything that speaks LDAP is Active Directory.

How is information organized within an LDAP directory?

As a tree structure, with a root at the top, branches representing things like departments or groups below it, and individual people or accounts sitting as "leaves" at the bottom of the appropriate branch.

What is a Distinguished Name (DN), and how is it similar to a mailing address?

A Distinguished Name is the full, unique address of one entry in the LDAP tree, tracing from the leaf up to the root, much like a full mailing address combines house number, street, city, and country into one unique location.

What is a "base DN," and why is getting it wrong a common setup mistake?

The base DN is the starting branch of the tree that SailPoint begins reading from; setting it too high reads far more than intended, while setting it too low can miss entire groups of people who should have been included.

What does it mean for SailPoint to "bind" to an LDAP directory, and what's considered best practice for doing so?

Binding means logging into the directory with valid credentials before reading any data; best practice is to use a dedicated service account with only the minimum access needed, often over an encrypted connection using SSL or TLS.

How would you define synchronization in this context, and why is it necessary?

Synchronization is the ongoing process of keeping SailPoint's data and the directory's data identical over time; without it, SailPoint's picture of the directory would slowly drift out of date as changes happen on the AD/LDAP side.

What is the difference between a full sync and an incremental (delta) sync?

A full sync re-reads every entry in the directory every time it runs, making it thorough but slow and resource-intensive, while an incremental sync only reads entries that changed since the last run, making it fast and ideal for frequent use.

What is the difference between scheduled (pull) sync and real-time (push) sync?

Scheduled sync has SailPoint reach out to the directory on a timer and ask what's changed, while real-time sync has the directory proactively notify SailPoint the instant something changes; scheduled is simpler and more common, while real-time keeps data current with far less delay.

What typically happens when a sync conflict occurs, such as an admin editing a field in SailPoint while HR updates the same field in AD?

Most integrations follow a "source of truth wins" rule, meaning the directory's value overwrites the SailPoint value on the next sync, so manual fixes should be made at the true source rather than only inside SailPoint.

What are the most common categories of AD/LDAP integration problems administrators run into?

Connection and authentication failures, expired or incorrect credentials, firewall and network access problems, schema mismatches where fields don't line up, and sync delays that leave data stale.

How can you tell the difference between a credentials problem and a firewall/network problem when a connection fails?

A credentials problem typically causes an active rejection or bind failure, while a firewall or network problem usually causes the connection attempt to simply time out with no response at all.

What is the recommended order for troubleshooting a broken AD/LDAP integration, and why does the order matter?

Check the connection first, then credentials, then the network path, then field mapping, then the sync schedule, in that order, since each earlier failure blocks everything downstream, so there's no point checking field mapping if the connection never even succeeded.