LDAP and Active Directory

Use the @bijection/connectors/ldap entrypoint to declare LDAP and Active Directory resources.

Availability

This page describes the pinned source package. Published availability is unestablished for this artifact. Source build and package availability.

Resources and modes

Resource	Mode	Description
Directory entries	`incremental`	incremental

Declare a resource in application code, then bind deployment-specific settings and credentials. See typed resources, connections and source inspection.

Directory entries

incremental: incremental

The following example matches configuration standard.

import { ldap } from "@bijection/connectors/ldap";

export const directory = ldap.directory.incremental();

Inferred record types

{
  "key": string;
  "dn": string;
  "version": string;
  "attributes": Record<string, string[]>;
}

Configuration: standard

Case: ldap/directory/incremental/standard. Connection and resource configuration are declared by this exact case. Credential kind: ldap. Keep credential material in the private credential inventory.

Setting	Type	Required	Owner
`endpoint`	string	Yes	Shared connection

Complete configuration contract

{
  "setup": [],
  "resource": {
    "access": {},
    "defaults": {},
    "connector": "ldap",
    "output": {
      "kind": "single",
      "collection": "entries"
    },
    "credential_kind": "ldap",
    "connection_fields": [
      "endpoint"
    ],
    "address": {
      "kind": "setup",
      "field": "endpoint"
    }
  },
  "connection_setup": {
    "type": "object",
    "value": {
      "endpoint": {
        "fieldType": {
          "type": "string"
        },
        "optional": false
      }
    }
  },
  "execution": null
}

Native admission analysis is available for this exact declaration. Collection: entries

Contract	Meaning
Initial	Current membership
Changes	Repeated observations of current records
Deletions	Withdrawal from selected scope
Resume	Opaque cursor
Gap	Explicit repair required after a gap
Retention	Unspecified

Complete native profile

{
  "movement": {
    "exchanges": {
      "entries": {
        "200": {
          "placement": "retained_bytes",
          "interpretation": "json",
          "projectsBeforeRetention": true,
          "retainedBodyLimitBytes": "524288",
          "fileLimitBytes": null
        },
        "410": {
          "placement": "retained_bytes",
          "interpretation": "opaque",
          "projectsBeforeRetention": false,
          "retainedBodyLimitBytes": "524288",
          "fileLimitBytes": null
        }
      }
    },
    "nativeInputLimitBytes": null,
    "steps": [
      {
        "id": "acquire.1",
        "inputs": [],
        "action": {
          "operation": "acquire",
          "subject": "exchange entries",
          "limitBytes": null
        }
      },
      {
        "id": "retain.1",
        "inputs": [
          "acquire.1"
        ],
        "action": {
          "operation": "retain",
          "subject": "acquisition evidence",
          "reason": "recovery",
          "release": "acquisition_custody"
        }
      },
      {
        "id": "interpret.1",
        "inputs": [
          "retain.1"
        ],
        "action": {
          "operation": "interpret",
          "subject": "acquired input",
          "produces": "records"
        }
      },
      {
        "id": "materialize.1",
        "inputs": [
          "interpret.1"
        ],
        "action": {
          "operation": "materialize",
          "subject": "source rows",
          "reason": "serving",
          "release": "replacement"
        }
      },
      {
        "id": "publish.1",
        "inputs": [
          "materialize.1"
        ],
        "action": {
          "operation": "publish",
          "subject": "source rows",
          "visibility": "with_acquisition"
        }
      }
    ]
  },
  "initial": "current_membership",
  "changes": "observations",
  "deletions": "scope_membership",
  "resume": "opaque_cursor",
  "retentionMs": null,
  "gap": "explicit_repair",
  "limits": {
    "http_response_bytes": "524288",
    "initial_rows": "50000"
  },
  "restrictions": [],
  "commands": {}
}

Commands, occurrences and artifacts

{
  "records": {
    "entries": {
      "protocol": "record_observation",
      "coverage": "incremental_snapshot",
      "consistency": "observations",
      "atomicity": "record",
      "history": "observations",
      "recordRefresh": false,
      "reconciliation": false,
      "notifications": false,
      "snapshotMaxRows": "50000",
      "profile": {
        "movement": {
          "exchanges": {
            "entries": {
              "200": {
                "placement": "retained_bytes",
                "interpretation": "json",
                "projectsBeforeRetention": true,
                "retainedBodyLimitBytes": "524288",
                "fileLimitBytes": null
              },
              "410": {
                "placement": "retained_bytes",
                "interpretation": "opaque",
                "projectsBeforeRetention": false,
                "retainedBodyLimitBytes": "524288",
                "fileLimitBytes": null
              }
            }
          },
          "nativeInputLimitBytes": null,
          "steps": [
            {
              "id": "acquire.1",
              "inputs": [],
              "action": {
                "operation": "acquire",
                "subject": "exchange entries",
                "limitBytes": null
              }
            },
            {
              "id": "retain.1",
              "inputs": [
                "acquire.1"
              ],
              "action": {
                "operation": "retain",
                "subject": "acquisition evidence",
                "reason": "recovery",
                "release": "acquisition_custody"
              }
            },
            {
              "id": "interpret.1",
              "inputs": [
                "retain.1"
              ],
              "action": {
                "operation": "interpret",
                "subject": "acquired input",
                "produces": "records"
              }
            },
            {
              "id": "materialize.1",
              "inputs": [
                "interpret.1"
              ],
              "action": {
                "operation": "materialize",
                "subject": "source rows",
                "reason": "serving",
                "release": "replacement"
              }
            },
            {
              "id": "publish.1",
              "inputs": [
                "materialize.1"
              ],
              "action": {
                "operation": "publish",
                "subject": "source rows",
                "visibility": "with_acquisition"
              }
            }
          ]
        },
        "initial": "current_membership",
        "changes": "observations",
        "deletions": "scope_membership",
        "resume": "opaque_cursor",
        "retentionMs": null,
        "gap": "explicit_repair",
        "limits": {
          "http_response_bytes": "524288",
          "initial_rows": "50000"
        },
        "restrictions": [],
        "commands": {}
      }
    }
  },
  "occurrences": null,
  "artifacts": {
    "raw_archive": false,
    "native_file_transfer_limit_bytes": null,
    "external_versions": false,
    "files": {}
  },
  "commands": {}
}

Recorded checks

Requirement	Scope	Evidence	Result
incremental-token-reset	{“kind”:“collection”,“name”:“entries”}	Fixture: ./src/connectors/ldap/fixtures/cursor-reset.json	passed (2026-10-24T21:36:12.067Z)
page-publication-recovery	{“kind”:“collection”,“name”:“entries”}	No retained check covers this scoped LDAP requirement; the bridge’s Go tests use a scripted directory and no real directory has been reached.	Execution result unavailable
stated-cursor-empty-page-advances	{“kind”:“collection”,“name”:“entries”}	No retained check covers this scoped LDAP requirement; the bridge’s Go tests use a scripted directory and no real directory has been reached.	Execution result unavailable
stated-cursor-repeat-refused	{“kind”:“collection”,“name”:“entries”}	No retained check covers this scoped LDAP requirement; the bridge’s Go tests use a scripted directory and no real directory has been reached.	Execution result unavailable
identity-account	{“kind”:“connection”}	Fixture: ./src/connectors/ldap/fixtures/identity.json	passed (2026-10-24T21:36:12.068Z)

Hosted qualification: unestablished for this catalog configuration. Installed connections report their own identity, authority and current status.

Provider guidance

Compiled declaration examples and configuration details are published in the connector reference. Run bijection ldap serve --config bridge.json next to the directory and expose it through an authenticated HTTPS ingress. The bridge holds the bind DN and password, uses LDAPS or StartTLS, and keeps no state. Bind the resource’s endpoint to the ingress URL and install the bridge’s bearer as an ldap credential (ldap.credential). The bridge’s mode selects change tracking:

dirsync: Active Directory DirSync with tombstones for deleted objects (needs “Replicating Directory Changes” on the naming context root).
usn: Active Directory uSNChanged windows on one domain controller plus the Deleted Objects container for tombstones. A new DC invocation id resets.
snapshot: any LDAPv3 directory. Each pass is a new paged baseline, and an entry that baseline does not return leaves.

Entries are keyed by objectGUID or entryUUID, carry the DN, the configured version attribute and the configured attributes as text lists. The snapshot holds at most maxEntries (default 50000, at most 131072). An entry that moves out of the base DN or stops matching the filter gets no tombstone; in the Active Directory modes the bridge forces a new baseline once the current one is older than rebaseline_hours (default 24), and that baseline withdraws it. A 410 from the bridge restarts the baseline. No real directory has been reached by these checks.

Provider references

Provider references and prerequisites are maintained in the connector guidance above. No separate provider-documentation review date is recorded.

Source and evidence

Canonical connector source, native analysis and check receipts. Connector artifact: 905888ea276a2a28e36981a79e8142b2547ea451c3e63162cb6915ad4a7d1305. The resource declaration examples above are compiled and compared with exact catalog declarations. Recorded checks apply only to their source, declaration and runtime identities. Configure a connection and inspect its status to establish deployment-specific readiness.

Get Started

Use-case atlas

Platform

Data and Operations

Guides

Client Libraries

Tools

API Reference

LDAP and Active Directory

Availability

Resources and modes

Directory entries

incremental: incremental

Configuration: standard

Provider guidance

Provider references

Source and evidence

​Availability

​Resources and modes

​Directory entries

​incremental: incremental

​Configuration: standard

​Provider guidance

​Provider references

​Source and evidence

Availability

Resources and modes

Directory entries

incremental: incremental

Configuration: standard

Provider guidance

Provider references

Source and evidence