Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is Active Directory; how does it relate to LDAP?
Short answer
Active Directory (AD) is Microsoft's enterprise directory service: it holds user, group and computer accounts on domain controller servers (Active Directory Domain Services). The data in AD is accessed with the LDAP protocol; that is, AD is a directory service, and LDAP is the protocol for querying that directory and verifying the user by binding. TR7 connects to AD not with a separate feature but with LDAP or LDAPS: in AGS, the LDAP-type Authentication Provider offers the AD-specific sign-in name formats as Bind Template options while Authentication Method is Direct Bind (UPN: user@domain, NetBIOS: domain\user); for management users, the $USERNAME@alanadi format common in AD is written in the LDAP Principal Pattern field on the LDAP Settings screen.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers | Provider Type = LDAP; Bind Template while Authentication Method = Direct Bind: UPN (user@domain), NetBIOS (domain\user) | Verifying AGS users with their AD account |
| AGS → Authentication → Authentication Providers | Default Domain | The AD domain name to be added if the username has no domain name |
| AGS → Authentication → Authentication Servers | Protocol = LDAP / LDAPS; Server Hosts | The addresses and ports of more than one domain controller |
| Settings → User Management → LDAP Settings | LDAP Principal Pattern, Base DN | Login of management users to the TR7 interface with their AD account |
| Load Balancer → vService | L7 TCP vService | Distributing the LDAP / LDAPS traffic going to domain controllers |
Relationship
| Active Directory | LDAP | |
|---|---|---|
| What it is | A directory service product | An access protocol standard |
| Role | Holding accounts, groups and policies | Querying the directory, verifying the user by binding |
| Sign-in name | UPN (user@domain), NetBIOS (DOMAIN\user), sAMAccountName | DN or the bind name the server accepts |
| How TR7 connects | Over LDAP or LDAPS | - |
Common Misconceptions
- "Connecting to AD requires a separate AD feature in TR7." The name of the AGS provider type is LDAP; AD is connected to with this type, over standard LDAP or LDAPS.
- "The username is accepted in any format." AD recognizes the same account in the UPN, NetBIOS and sAMAccountName formats; in Direct Bind, Bind Template, and in LDAP Settings, LDAP Principal Pattern determines which of these formats is sent.
- "AD is only for Windows sessions." The accounts in AD can be used in every application that speaks LDAP; in TR7, for both AGS and management login.
How it is done in the documentation
