1/3
Integrating AD with SCP
  

EduardoOliveira Lv1  Posted 2026-Oct-20 03:07

Sangfor SCP Integration with Active Directory (LDAP)
This guide connects Sangfor SCP to an Active Directory domain over LDAP and imports AD users so they can sign in to the platform. It works for any domain: replace the values in < > with your own. Screenshots use an example domain.

Before you startCollect the values below. They are used throughout this guide.
Value
Description
Example
<DOMAIN>
Domain DNS name
company.local
<DOMAIN_DN>
Domain in DN format
DC=company,DC=local
<DC_IP>
IP of a domain controller reachable from SCP
192.168.1.10
<SERVICE_OU>
OU that holds the bind account
Service Accounts
<BIND_ACCOUNT>
Service account SCP uses to read AD
BIND SCP
<USERS_OU>
OU with the users who will access SCP
Users SCP
Requirements:
  • Administrator access to AD (ADUC) and to SCP (Platform Admin).
  • Network access from SCP to the domain controller on port 389 (LDAP) or 636 (LDAPS).

Part 1 — Active DirectoryOn the domain controller, open Active Directory Users and Computers (ADUC).
Step 1 — Create the OUs
  • Right-click the domain root <DOMAIN>.
  • Select New → Organizational Unit.
  • Create the OU <SERVICE_OU> for the bind account.
  • Repeat to create <USERS_OU> for SCP users. Sub-OUs are optional (for example, one per company or customer).

With PowerShell:
New-ADOrganizationalUnit -Name "<SERVICE_OU>" -Path "<DOMAIN_DN>" New-ADOrganizationalUnit -Name "<USERS_OU>" -Path "<DOMAIN_DN>"



Step 2 — Create the bind service account
  • In <SERVICE_OU>, right-click and select New → User.
  • Create the account <BIND_ACCOUNT> with a strong password.
  • Check Password never expires so the integration does not stop when the password expires.

The account does not need administrator rights: a regular domain user can already read the directory.






Step 3 — Copy the bind account DN
  • In ADUC, enable View → Advanced Features.
  • Open the properties of <BIND_ACCOUNT>.
  • Go to the Attribute Editor tab and find distinguishedName.
  • Double-click it and copy the value.

The DN follows this format:
CN=<BIND_ACCOUNT>,OU=<SERVICE_OU>,<DOMAIN_DN>Example: CN=BIND SCP,OU=Service Accounts,DC=company,DC=local.
The Object tab shows the canonical name (domain/OU/account), which is not the DN. Always use the distinguishedName value.


Part 2 — Configure LDAP in SCPStep 4 — Open the authentication settingsIn SCP, go to System → System → Authentication and open the LDAP tab.



Step 5 — Fill in the server details
Field
Value
Server Name
A friendly server name (e.g. AD-COMPANY)
Auth Protocol
LDAP (port 389) or LDAPS (port 636, requires a certificate on the DC)
IP Address
<DC_IP>
Port
389 for LDAP, 636 for LDAPS
Distinguished Name (DN)
Bind account DN (Step 3)
Admin Password
Password of <BIND_ACCOUNT>
Under Advanced, the defaults already work for Active Directory:
Field
Default
Server Type
MS Active Directory
Username
sAMAccountName
Name
sAMAccountName (optional: displayName to show the full name)
User Filter
objectCategory=person
Mobile Number
telephoneNumber
Email Address
mail

Step 6 — Test and save
  • Click Test Connectivity and confirm the success message.
  • Click Save.

Part 3 — Import users from ADStep 7 — Open the LDAP import
  • Go to Users and Access Management → Users and open the Other Users tab.
  • Click Import → Import LDAP User.



Step 8 — Select the usersThe Import LDAP Users window shows the AD tree. If it loads, the bind is working.
  • Check <USERS_OU> (or its sub-OUs) and the users who will access SCP. Use the search box to filter by OU or username.
  • Do not select the built-in accounts in the Users container (Administrator, Guest, krbtgt).
  • Under Upon Conflict, choose:

    • Not import (default): keeps existing local or LDAP users with the same username.
    • Overwrite local users or existing LDAP users: replaces their details with the AD data.

  • Click OK.

Imported users authenticate against AD. If phone number or email is missing in AD, SCP generates random values, so fill in mail and telephoneNumber in AD before importing.

Step 9 — VerifyImported users appear in the Other Users tab with LDAP as the authentication type.

Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

Humayun Ahmed Lv4  Posted 2026-Oct-20 11:55
  
Thanks to share!