Active Directory integration overview

Active Directory integration

If your organization utilizes Active Directory (AD) to manage network identity and access, you can connect your environment to ThoughtFarmer using the Employee Directory Connector (EDC). The EDC provides automated, bi-directional synchronization to ensure user profiles, security groups, and organizational structure remain up to date across both platforms.

The EDC supports full Active Directory integration for both ThoughtFarmer Cloud and on-premise deployments, including environments with multiple Active Directory domains or forests.

Note: If integrating with multiple Active Directory domains, you must complete the configuration steps below for each distinct directory store.

Active Directory service account requirements

To establish a secure connection with Active Directory, ThoughtFarmer requires a dedicated domain service account.

• Password Expiration: The service account password must be set to never expire. If the account password expires, Active Directory authentication, background user synchronization, and single sign-on (SSO) workflows will immediately fail.

• Permissions Baseline:

  • Full Integration (Read/Write): Requires read and write permissions in Active Directory. This enables ThoughtFarmer to sync profile updates back to your directory store.

  • Restricted Integration (Read-Only): If your organizational security policy restricts write access, assign Read-Only permissions. ThoughtFarmer will read directory objects without modifying your Active Directory data.

• For detailed schema permission mappings, see our technical reference guides: AD security permissions and Field mappings data ownership and user test.

Adding a new Active Directory instance

1. Log in to ThoughtFarmer as an administrator.

2. Navigate to Admin panel > Users & security > Employee Directory Connector.

3. Click Add new external user store.

4. Configure the initial parameters:

5. Name: Enter a descriptive name for this directory store (e.g., Corporate Active Directory).

6. Type: Select Active Directory from the dropdown menu.

7. Enabled: Check this box to activate the integration.

8. Write enabled: Check this box if ThoughtFarmer should be permitted to update user attributes back to Active Directory.

9. User auto-creation: Check this box to automatically create new ThoughtFarmer intranet user accounts whenever new active users are detected in Active Directory.

10. Click Save. You will be redirected to the detailed Configuration page for the newly created store.

Configuring Active Directory settings

To complete the setup, navigate to Admin panel > Users & security > Employee Directory Connector, select your Active Directory store, and open the Configuration tab. Complete the fields using the reference guide below:

Once all fields are configured, click Save changes at the bottom of the page.

Understanding write access

Enabling Write access allows ThoughtFarmer to act as the authoritative source of truth for designated user profile fields.

• When Write Enabled is checked: Profile edits made by users or administrators within ThoughtFarmer will write back to and overwrite matching attributes in Active Directory, provided ThoughtFarmer is designated as the Data Owner for those specific fields.

• When Write Enabled is unchecked: ThoughtFarmer operates in read-only mode. No changes made within the intranet will alter data within your Active Directory schema.

To toggle this setting at any time, navigate to Admin panel > Users & security > Employee Directory Connector, select the store, open the Basic information tab, and toggle the Write enabled checkbox. Click Save to commit the change.