Active Directory integration
Learn how to integrate Active Directory with Xopero ONE using LDAP.
Integrating Active Directory (AD) with Xopero ONE enables automated user provisioning upon login, group-to-role mapping, and administrative fallback authentication.
General information
Integrating Active Directory (AD) with Xopero ONE (supporting both LDAP and LDAPS protocols) enables centralized and automated permission management within the backup system.
The automatic provisioning feature eliminates the need to create user accounts manually. Instead, each user's Xopero ONE profile is created automatically during their first login. User information and assigned roles are continuously synchronized and updated based on the Active Directory group structure. Administrators can further control the Xopero ONE environment by limiting authentication to selected AD groups and configuring the system's default language.
Additionally, administrators retain independent emergency access to the system. After each successful authentication, the system stores user's LDAP attributes and group memberships retrieved from Active Directory in its local database, while the user's password is securely managed by the password module. If the Active Directory server becomes unavailable, the system retrieves the required user and group information from the local database. If the provided password matches the securely stored record in the password module, the user is authenticated and granted access as if they had logged in through Active Directory.
Adding Active Directory service to Xopero ONE
The following steps outline how to configure Active Directory (AD) settings in Xopero ONE Management Service.
Navigate to ⚙️ Settings > External Identity Providers, then click Add new provider and select Active Directory.
Specify the required parameters.
Name: custom IdP name.
Server address: Active Directory server address, either IP or FQDN.
Server port: 389 (LDAP) or 636 (LDAPS).
Start point: the starting point in the Active Directory tree (e.g.,
ou=local-dev,DC=ad,DC=local,DC=dev,DC=organization,DC=com).Account name: service account name, either UPN (username@domain) or DL (domain\username).
LDAP server certificate: if required by your network infrastructure, upload the server's security certificate (PEM, DER, or CRT format) to verify the server's identity.
The connection will succeed if the certificate specified in the settings—or located in the certificates directory (matching the server name)—is valid and matches the server's certificate. Otherwise, the system falls back to default verification, meaning self-signed certificates will be automatically rejected and the connection will fail.
Directory synchronization frequency: define how often the user database is refreshed and synchronized with Active Directory.
Add or select password from Password Manager: service account password.
Select the preferred language, default role assigned to users, and default user permissions.
To define roles for specific user groups, click Group mapping. You can configure group mapping at any time, either during the initial integration or later.
If no group mapping is configured, all users within the specified Active Directory domain inherit the default role and permissions for their Xopero ONE accounts.
Before proceeding, you can test the connection by clicking the question mark at the bottom of the configuration panel.
Review your settings and click Save. After successfully integrating Active Directory with Xopero ONE, a Xopero ONE account is created for each user upon their first login, with permissions based on the default roles or group mapping.
Users can log in to the Xopero ONE Management Service using either their UPN (username@domain) or DL (domain\username).
Group mapping
The following steps outline how to configure group mapping settings in Xopero ONE Management Service.
Navigate to ⚙️ Settings > External Identity Providers, then click Add new provider > Active Directory or edit an existing one. In the Active Directory configuration aside, scroll down and click Group mapping.
In the next aside, click + Add new group mapping (or edit an existing one) and specify the required parameters.
Claim type: context for the claim value, in this case http://schemas.microsoft.com/ws/2008/06/identity/claims/role
Claim value: name of the Active Directory (AD) group (for example, Domain Admins).
Role: permission level that will be assigned to all users belonging to the specified AD group.
Permissions: supplementary privileges to grant to the specified AD group beyond their base role (optional).
Review your configuration details and click Save. Once done, all users within the specified Active Directory group will automatically inherit the selected roles and permissions.
Access mapping applies dynamically, both during initial user provisioning and as an immediate update to existing Xopero ONE accounts.
Useful links and items
Last updated
Was this helpful?