> For the complete documentation index, see [llms.txt](https://helpcenter.gitprotect.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpcenter.gitprotect.io/sign-in-and-authentication/active-directory-integration.md).
# Active Directory integration
**Integrating Active Directory (AD) with GitProtect enables automated user provisioning upon login, group-to-role mapping, and administrative fallback authentication.**
***
## General information
Integrating **Active Directory** (**AD**) with **GitProtect** (supporting both LDAP and LDAPS protocols) enables centralized and automated permission management within the backup system.
The automatic provisioning feature eliminates the need to create user accounts manually. Instead, each user's **GitProtect** profile is created automatically during their first login. User information and assigned roles are continuously synchronized and updated based on the **Active Directory** group structure. Administrators can further control the **GitProtect** environment by limiting authentication to selected **AD** groups and configuring the system's default language.
Additionally, administrators retain independent emergency access to the system. After each successful authentication, the system stores user's LDAP attributes and group memberships retrieved from **Active Directory** in its local database, while the user's password is securely managed by the password module. If the **Active Directory** server becomes unavailable, the system retrieves the required user and group information from the local database. If the provided password matches the securely stored record in the password module, the user is authenticated and granted access as if they had logged in through **Active Directory**.
***
## Adding Active Directory service to **GitProtect**
The following steps outline how to configure **Active Directory** (**AD**) settings in **GitProtect Management Service**.
{% stepper %}
{% step %}
Navigate to **⚙️ Settings** > **External Identity Providers**, then click **Add new provider** and select **Active Directory**.
{% endstep %}
{% step %}
Specify the required parameters.
* **Name:** custom IdP name.
* **Server address:** **Active Directory** server address, either IP or FQDN.
* **Server port:** 389 (LDAP) or 636 (LDAPS).
* **Start point:** the starting point in the **Active Directory** tree (e.g., `ou=local-dev,DC=ad,DC=local,DC=dev,DC=organization,DC=com`).
* **Account name:** service account name, either UPN (**username\@domain**) or DL (**domain\username**).
* **LDAP server certificate:** if required by your network infrastructure, upload the server's security certificate (PEM, DER, or CRT format) to verify the server's identity.
{% hint style="danger" %}
The connection will succeed if the certificate specified in the settings—or located in the certificates directory (matching the server name)—is valid and matches the server's certificate. Otherwise, the system falls back to default verification, meaning **self-signed certificates will be automatically rejected and the connection will fail**.
{% endhint %}
* **Directory synchronization frequency:** define how often the user database is refreshed and synchronized with **Active Directory**.
* **Add or select password from Password Manager:** service account password.
{% endstep %}
{% step %}
Select the preferred language, default role assigned to users, and default user permissions.
{% endstep %}
{% step %}
To define roles for specific user groups, click **Group mapping**. You can [configure group mapping](#group-mapping) at any time, either during the initial integration or later.
{% hint style="warning" %}
If no group mapping is configured, all users within the specified **Active Directory** domain inherit the default role and permissions for their **GitProtect** accounts.
{% endhint %}
{% endstep %}
{% step %}
Before proceeding, you can test the connection by clicking the question mark at the bottom of the configuration panel.
{% endstep %}
{% step %}
Review your settings and click **Save**. After successfully integrating **Active Directory** with **GitProtect**, a **GitProtect** account is created for each user upon their first login, with permissions based on the default roles or group mapping.
{% hint style="success" %}
Users can log in to the **GitProtect Management Service** using either their UPN (**username\@domain**) or DL (**domain\username**).
{% endhint %}
{% endstep %}
{% endstepper %}
***
## Group mapping
The following steps outline how to configure group mapping settings in **GitProtect Management Service**.
{% stepper %}
{% step %}
Navigate to **⚙️ Settings** > **External Identity Providers**, then click **Add new provider** > **Active Directory** or edit an existing one. In the **Active Directory** configuration aside, scroll down and click **Group mapping**.
{% endstep %}
{% step %}
In the next aside, click **+ Add new group mapping** (or edit an existing one) and specify the required parameters.
* **Claim type:** context for the claim value, in this case
* **Claim value:** name of the **Active Directory** (**AD**) group (for example, **Domain Admins**).
* **Role:** permission level that will be assigned to all users belonging to the specified **AD** group.
* **Permissions:** supplementary privileges to grant to the specified **AD** group beyond their base role (optional).
{% endstep %}
{% step %}
Review your configuration details and click **Save**. Once done, all users within the specified **Active Directory** group will automatically inherit the selected roles and permissions.
{% hint style="success" %}
Access mapping applies dynamically, both during initial user provisioning and as an immediate update to existing **GitProtect** accounts.
{% endhint %}
{% endstep %}
{% endstepper %}
***
## Useful links and items
{% embed url="" %}