> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bijection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# LDAP and Active Directory

> Resources, examples, configuration and evidence for LDAP and Active Directory.

Use the `@bijection/connectors/ldap` entrypoint to declare LDAP and Active Directory resources.

## Availability

This page describes the pinned source package. Published availability is unestablished for this artifact. [Source build and package availability](https://docs.bijection.com/client/sdk-distribution.md).

## Resources and modes

| Resource | Mode | Description |
| - | - | - |
| Directory entries | `incremental` | incremental |

Declare a resource in application code, then bind deployment-specific settings and credentials. See [typed resources](https://docs.bijection.com/integrations/resources.md), [connections](https://docs.bijection.com/integrations/connections.md) and [source inspection](https://docs.bijection.com/integrations/cli.md).

## Directory entries

### incremental: incremental

The following example matches configuration `standard`.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { ldap } from "@bijection/connectors/ldap";

export const directory = ldap.directory.incremental();
```

> **Inferred record types**
>
> ```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "key": string;
>   "dn": string;
>   "version": string;
>   "attributes": Record<string, string[]>;
> }
> ```

#### Configuration: standard

Case: `ldap/directory/incremental/standard`.

Connection and resource configuration are declared by this exact case.

Credential kind: `ldap`. Keep credential material in the private credential inventory.

| Setting | Type | Required | Owner |
| - | - | - | - |
| `endpoint` | string | Yes | Shared connection |

> **Complete configuration contract**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "setup": [],
>   "resource": {
>     "access": {},
>     "defaults": {},
>     "connector": "ldap",
>     "output": {
>       "kind": "single",
>       "collection": "entries"
>     },
>     "credential_kind": "ldap",
>     "connection_fields": [
>       "endpoint"
>     ],
>     "address": {
>       "kind": "setup",
>       "field": "endpoint"
>     }
>   },
>   "connection_setup": {
>     "type": "object",
>     "value": {
>       "endpoint": {
>         "fieldType": {
>           "type": "string"
>         },
>         "optional": false
>       }
>     }
>   },
>   "execution": null
> }
> ```

Native admission analysis is available for this exact declaration.

**Collection: entries**

| Contract | Meaning |
| - | - |
| Initial | Current membership |
| Changes | Repeated observations of current records |
| Deletions | Withdrawal from selected scope |
| Resume | Opaque cursor |
| Gap | Explicit repair required after a gap |
| Retention | Unspecified |

> **Complete native profile**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "movement": {
>     "exchanges": {
>       "entries": {
>         "200": {
>           "placement": "retained_bytes",
>           "interpretation": "json",
>           "projectsBeforeRetention": true,
>           "retainedBodyLimitBytes": "524288",
>           "fileLimitBytes": null
>         },
>         "410": {
>           "placement": "retained_bytes",
>           "interpretation": "opaque",
>           "projectsBeforeRetention": false,
>           "retainedBodyLimitBytes": "524288",
>           "fileLimitBytes": null
>         }
>       }
>     },
>     "nativeInputLimitBytes": null,
>     "steps": [
>       {
>         "id": "acquire.1",
>         "inputs": [],
>         "action": {
>           "operation": "acquire",
>           "subject": "exchange entries",
>           "limitBytes": null
>         }
>       },
>       {
>         "id": "retain.1",
>         "inputs": [
>           "acquire.1"
>         ],
>         "action": {
>           "operation": "retain",
>           "subject": "acquisition evidence",
>           "reason": "recovery",
>           "release": "acquisition_custody"
>         }
>       },
>       {
>         "id": "interpret.1",
>         "inputs": [
>           "retain.1"
>         ],
>         "action": {
>           "operation": "interpret",
>           "subject": "acquired input",
>           "produces": "records"
>         }
>       },
>       {
>         "id": "materialize.1",
>         "inputs": [
>           "interpret.1"
>         ],
>         "action": {
>           "operation": "materialize",
>           "subject": "source rows",
>           "reason": "serving",
>           "release": "replacement"
>         }
>       },
>       {
>         "id": "publish.1",
>         "inputs": [
>           "materialize.1"
>         ],
>         "action": {
>           "operation": "publish",
>           "subject": "source rows",
>           "visibility": "with_acquisition"
>         }
>       }
>     ]
>   },
>   "initial": "current_membership",
>   "changes": "observations",
>   "deletions": "scope_membership",
>   "resume": "opaque_cursor",
>   "retentionMs": null,
>   "gap": "explicit_repair",
>   "limits": {
>     "http_response_bytes": "524288",
>     "initial_rows": "50000"
>   },
>   "restrictions": [],
>   "commands": {}
> }
> ```

> **Commands, occurrences and artifacts**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "records": {
>     "entries": {
>       "protocol": "record_observation",
>       "coverage": "incremental_snapshot",
>       "consistency": "observations",
>       "atomicity": "record",
>       "history": "observations",
>       "recordRefresh": false,
>       "reconciliation": false,
>       "notifications": false,
>       "snapshotMaxRows": "50000",
>       "profile": {
>         "movement": {
>           "exchanges": {
>             "entries": {
>               "200": {
>                 "placement": "retained_bytes",
>                 "interpretation": "json",
>                 "projectsBeforeRetention": true,
>                 "retainedBodyLimitBytes": "524288",
>                 "fileLimitBytes": null
>               },
>               "410": {
>                 "placement": "retained_bytes",
>                 "interpretation": "opaque",
>                 "projectsBeforeRetention": false,
>                 "retainedBodyLimitBytes": "524288",
>                 "fileLimitBytes": null
>               }
>             }
>           },
>           "nativeInputLimitBytes": null,
>           "steps": [
>             {
>               "id": "acquire.1",
>               "inputs": [],
>               "action": {
>                 "operation": "acquire",
>                 "subject": "exchange entries",
>                 "limitBytes": null
>               }
>             },
>             {
>               "id": "retain.1",
>               "inputs": [
>                 "acquire.1"
>               ],
>               "action": {
>                 "operation": "retain",
>                 "subject": "acquisition evidence",
>                 "reason": "recovery",
>                 "release": "acquisition_custody"
>               }
>             },
>             {
>               "id": "interpret.1",
>               "inputs": [
>                 "retain.1"
>               ],
>               "action": {
>                 "operation": "interpret",
>                 "subject": "acquired input",
>                 "produces": "records"
>               }
>             },
>             {
>               "id": "materialize.1",
>               "inputs": [
>                 "interpret.1"
>               ],
>               "action": {
>                 "operation": "materialize",
>                 "subject": "source rows",
>                 "reason": "serving",
>                 "release": "replacement"
>               }
>             },
>             {
>               "id": "publish.1",
>               "inputs": [
>                 "materialize.1"
>               ],
>               "action": {
>                 "operation": "publish",
>                 "subject": "source rows",
>                 "visibility": "with_acquisition"
>               }
>             }
>           ]
>         },
>         "initial": "current_membership",
>         "changes": "observations",
>         "deletions": "scope_membership",
>         "resume": "opaque_cursor",
>         "retentionMs": null,
>         "gap": "explicit_repair",
>         "limits": {
>           "http_response_bytes": "524288",
>           "initial_rows": "50000"
>         },
>         "restrictions": [],
>         "commands": {}
>       }
>     }
>   },
>   "occurrences": null,
>   "artifacts": {
>     "raw_archive": false,
>     "native_file_transfer_limit_bytes": null,
>     "external_versions": false,
>     "files": {}
>   },
>   "commands": {}
> }
> ```

**Recorded checks**

| Requirement | Scope | Evidence | Result |
| - | - | - | - |
| incremental-token-reset | \{"kind":"collection","name":"entries"} | Fixture: ./src/connectors/ldap/fixtures/cursor-reset.json | passed (2026-10-24T21:36:12.067Z) |
| page-publication-recovery | \{"kind":"collection","name":"entries"} | No retained check covers this scoped LDAP requirement; the bridge's Go tests use a scripted directory and no real directory has been reached. | Execution result unavailable |
| stated-cursor-empty-page-advances | \{"kind":"collection","name":"entries"} | No retained check covers this scoped LDAP requirement; the bridge's Go tests use a scripted directory and no real directory has been reached. | Execution result unavailable |
| stated-cursor-repeat-refused | \{"kind":"collection","name":"entries"} | No retained check covers this scoped LDAP requirement; the bridge's Go tests use a scripted directory and no real directory has been reached. | Execution result unavailable |
| identity-account | \{"kind":"connection"} | Fixture: ./src/connectors/ldap/fixtures/identity.json | passed (2026-10-24T21:36:12.068Z) |

Hosted qualification: **unestablished for this catalog configuration**. Installed connections report their own identity, authority and current status.

## Provider guidance

Compiled declaration examples and configuration details are published in the [connector reference](https://docs.bijection.com/integrations/connectors/index).

Run `bijection ldap serve --config bridge.json` next to the directory and
expose it through an authenticated HTTPS ingress. The bridge holds the bind DN
and password, uses LDAPS or StartTLS, and keeps no state. Bind the resource's
`endpoint` to the ingress URL and install the bridge's bearer as an `ldap`
credential (`ldap.credential`). The bridge's `mode` selects change tracking:

* `dirsync`: Active Directory DirSync with tombstones for deleted objects
  (needs "Replicating Directory Changes" on the naming context root).
* `usn`: Active Directory `uSNChanged` windows on one domain controller plus the
  Deleted Objects container for tombstones. A new DC invocation id resets.
* `snapshot`: any LDAPv3 directory. Each pass is a new paged baseline, and an
  entry that baseline does not return leaves.

Entries are keyed by `objectGUID` or `entryUUID`, carry the DN, the configured
version attribute and the configured attributes as text lists. The snapshot holds
at most `maxEntries` (default 50000, at most 131072). An entry that moves out of the
base DN or stops matching the filter gets no tombstone; in the Active Directory
modes the bridge forces a new baseline once the current one is older than
`rebaseline_hours` (default 24), and that baseline withdraws it. A 410 from the
bridge restarts the baseline. No real directory has been reached by these checks.

## Provider references

Provider references and prerequisites are maintained in the connector guidance above. No separate provider-documentation review date is recorded.

## Source and evidence

[Canonical connector source](https://github.com/bijectionhq/component-support/blob/b632604330ce9cbcfe17a5a680ef4fbe80f6f672/packages/connectors/src/connectors/ldap/README.md), [native analysis](https://github.com/bijectionhq/component-support/blob/b632604330ce9cbcfe17a5a680ef4fbe80f6f672/packages/connectors/contract-analysis.json) and [check receipts](https://github.com/bijectionhq/component-support/blob/b632604330ce9cbcfe17a5a680ef4fbe80f6f672/packages/connectors/evidence.json).

Connector artifact: `905888ea276a2a28e36981a79e8142b2547ea451c3e63162cb6915ad4a7d1305`.

The resource declaration examples above are compiled and compared with exact catalog declarations. Recorded checks apply only to their source, declaration and runtime identities. Configure a connection and inspect its status to establish deployment-specific readiness.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.