Essal Access can sync with your existing corporate directory — LDAP or Microsoft Active Directory — to automatically reflect your organisational structure in the platform.
Directory Sync Overview
Directory sync is a one-way pull from your directory server into Essal. Essal reads users and groups from the directory on a configurable schedule and reconciles them against existing Access users.
Sync operations:
- Create: New directory users are provisioned in Essal
- Update: Changed attributes (name, email, department) are reflected
- Deactivate: Users removed from the directory are suspended in Essal
- Group sync: Directory groups are mapped to Essal roles
Configuring an LDAP Connection
Store your bind_password in a secrets manager. Never include it directly in application code or commit it to source control.
Configuring Active Directory
For Active Directory, use the active_directory type and provide the domain:
Group Mapping
Map directory groups to Essal roles so that group membership in your directory automatically grants the corresponding app access in Essal:
Sync Schedule and Manual Sync
By default, Essal syncs with the directory every 4 hours. You can adjust the schedule or trigger an immediate sync:
The sync job runs asynchronously. Poll GET /v1/access/directories/dir_01HXYZDIR1/sync/latest to check its status and review any errors. 