Documentation Connector Configuration

Connector Configuration

Learn how to configure and connect Identity Mesh to your identity providers and target systems.

Supported Connectors

Identity Mesh supports a wide range of identity providers and target systems through our connector framework.

Active Directory

LDAP

Connect to on-premises or cloud-hosted Active Directory

Microsoft Entra ID

Azure AD Import only

Import from Microsoft Entra ID (formerly Azure AD). Read-only today; write-back on the roadmap.

Okta

SCIM Import only

Import users and groups from the Okta identity platform (read-only today)

Workday

REST API Import only

Import workers from Workday HCM for HR-driven provisioning (read-only today)

LDAP

LDAP Coming Soon

Generic LDAP connector for any LDAP-compliant directory

SCIM 2.0

SCIM Coming Soon

Standard SCIM 2.0 connector for any SCIM-compliant system

SQL Database

SQL

Direct database connector for custom identity stores

REST API

REST Coming Soon

Generic REST API connector for custom integrations

Active Directory Configuration

Prerequisites

Active Directory domain controller accessible from Identity Mesh
Service account with read permissions (or read/write for bi-directional sync)
LDAP port 389 (or LDAPS port 636) open in firewall. LDAPS (port 636) is required for password provisioning via EnableAfterCreate
Base DN for user and group searches

Configuration Example

{
  "type": "active-directory",
  "name": "Corporate AD",
  "config": {
    "host": "dc01.company.com",
    "port": 636,
    "useSsl": true,
    "baseDn": "DC=company,DC=com",
    "bindDn": "CN=svc-identitymesh,OU=Service Accounts,DC=company,DC=com",
    "bindPassword": "{{secret:ad-password}}",
    "userSearchBase": "OU=Users,DC=company,DC=com",
    "userSearchFilter": "(&(objectClass=user)(objectCategory=person))",
    "groupSearchBase": "OU=Groups,DC=company,DC=com",
    "groupSearchFilter": "(objectClass=group)",
    "createEnabled": true,
    "enableAfterCreate": true,
    "deleteMode": "disable",
    "attributeMapping": {
      "username": "sAMAccountName",
      "email": "mail",
      "firstName": "givenName",
      "lastName": "sn",
      "displayName": "displayName",
      "employeeId": "employeeNumber"
    }
  }
}

Configuration Fields

host

Domain controller hostname or IP address

port

LDAP port (389 for LDAP, 636 for LDAPS)

useSsl

Enable SSL/TLS encryption (recommended)

baseDn

Base distinguished name for searches

bindDn

Service account distinguished name

bindPassword

Service account password (use secrets)

userSearchBase

Base DN for user searches

userSearchFilter

LDAP filter for user objects

groupSearchBase

Base DN for group searches

groupSearchFilter

LDAP filter for group objects

ObjectType

The type of AD object to import. Controls the LDAP filter automatically. Default: User

User — Standard user accounts. Filter: (&(objectClass=user)(!(objectClass=computer)))
Group — Security and distribution groups. Filter: (objectClass=group)
Contact — External contact objects (mail-only, no login). Filter: (objectClass=contact)
Computer — Machine accounts for device management. Filter: (objectClass=computer)

When using the Admin Portal, the Object Type dropdown appears in the AD Schema Discovery section after a successful test connection. Selecting a type automatically updates the Filter field. If you run Discover Attributes, any additional object classes found in your AD are added to the dropdown.

createEnabled

Allow the connector to create new AD accounts during export. Default: true

enableAfterCreate

After creating a user, set the password and enable the account (UAC 512). Requires useSsl: true and a unicodePwd projection attribute rule with a GeneratePassword() transform. Default: false

deleteMode

How to handle object deletion: disable (set ACCOUNTDISABLE bit) or delete (remove from AD). Default: disable

Microsoft Entra ID Configuration (Import only)

Prerequisites

Azure AD tenant with appropriate licensing
App registration in Azure AD with required API permissions
Client ID and client secret from app registration
Tenant ID (directory ID)

Configuration Example

{
  "type": "entra-id",
  "name": "Azure AD",
  "config": {
    "tenantId": "12345678-1234-1234-1234-123456789abc",
    "clientId": "87654321-4321-4321-4321-cba987654321",
    "clientSecret": "{{secret:azure-client-secret}}",
    "scopes": [
      "User.Read.All",
      "Group.Read.All",
      "Directory.Read.All"
    ],
    "attributeMapping": {
      "username": "userPrincipalName",
      "email": "mail",
      "firstName": "givenName",
      "lastName": "surname",
      "displayName": "displayName",
      "employeeId": "employeeId"
    }
  }
}

Required API Permissions

Grant these Microsoft Graph API permissions to your app registration:

User.Read.All

Read all users' full profiles
Group.Read.All

Read all groups
Directory.Read.All

Read directory data

Okta Configuration (Import only)

Configuration Example

{
  "type": "okta",
  "name": "Okta Production",
  "config": {
    "domain": "company.okta.com",
    "apiToken": "{{secret:okta-api-token}}",
    "scimEndpoint": "https://company.okta.com/api/v1/scim/v2",
    "attributeMapping": {
      "username": "userName",
      "email": "emails[0].value",
      "firstName": "name.givenName",
      "lastName": "name.familyName",
      "displayName": "displayName",
      "active": "active"
    }
  }
}

SQL Database Configuration

Prerequisites

SQL Server instance accessible from Identity Mesh
Database account with read permissions on the source table or view
A datetime2 column for delta tracking (not date which lacks time granularity)
A unique identifier column for each row (e.g., primary key)

Configuration Example

{
  "type": "sql",
  "name": "HR Database",
  "config": {
    "connectionString": "Server=hrdb.company.com;Database=HRSystem;",
    "importQuery": "dbo.Employees",
    "externalIdColumn": "EmployeeId",
    "objectType": "User",
    "watermarkColumn": "ModifiedDateUtc",
    "deltaColumnType": "datetime",
    "isActiveColumn": "IsActive",
    "columnsToLoad": ["EmployeeId", "Email", "DisplayName", "Department", "Title", "ManagerEmail"]
  }
}

Configuration Fields

connectionString

SQL Server connection string. For Azure SQL with token auth, omit User ID/Password.

importQuery

SELECT query or table/view name (e.g., dbo.Employees)

externalIdColumn

Column used as the unique external identifier. Default: Id

deltaColumn (alias: watermarkColumn)

Column for watermark-based delta import. Must be datetime2, bigint, or rowversion. You can use either deltaColumn or watermarkColumn in the config JSON.

deltaColumnType

Type hint: datetime, long, bigint, rowversion, or binary. Default: datetime

softDeleteColumn (alias: isActiveColumn)

Column indicating soft-deleted rows. Optional. You can use isActiveColumn as an alias — when used, the semantics are inverted automatically (IsActive=0 means deleted).

softDeleteValue

Value that indicates deletion. For SQL bit columns, use 0 or 1. Default: true. When using isActiveColumn, this defaults to 0 automatically.

columnsToLoad

Array of column names to SELECT instead of *. Reduces network I/O and memory for wide tables. The externalIdColumn, deltaColumn, and softDeleteColumn are always included automatically. Omit or set to [] for SELECT *.

Delta Column Type Matters

The delta column must be datetime2 — not date. A date column stores only the date with no time component, so multiple changes on the same day would be missed during delta imports. Use datetime2 for millisecond-level granularity.

Dynamic Target Container

Projection rules support {{attribute}} templates in the Target Container field. At projection time, tokens are resolved against the mesh object's attributes, placing objects into different OUs automatically.

OU={{department}},OU=Users,DC=corp,DC=com

If a user's department attribute is Engineering, the resolved container becomes OU=Engineering,OU=Users,DC=corp,DC=com. Unresolved tokens (missing or null attributes) are left as-is.

Authentication Modes

SqlAuth

SQL Server authentication with username and password (default)

Integrated

Windows Integrated Authentication using the service account

AzureADClientCredential

Entra ID service principal for Azure SQL Database (requires tenantId)

AzureManagedIdentity

Azure Managed Identity for Azure SQL Database

AzureDefault

Azure DefaultAzureCredential (tries MI, CLI, environment, etc.)

Testing Your Connection

After configuring your connector, test the connection to ensure it's working properly.

Using the API

POST /api/v1/connectors/test
Content-Type: application/json
Authorization: Bearer {{api_token}}

{
  "connectorId": "conn_abc123"
}

Expected Response

{
  "status": "success",
  "message": "Connection successful",
  "details": {
    "connectorType": "active-directory",
    "usersFound": 1523,
    "groupsFound": 87,
    "latency": 145
  }
}

Connector Configuration

Supported Connectors

Active Directory

Microsoft Entra ID

Okta

Workday

LDAP

SCIM 2.0

SQL Database

REST API

Active Directory Configuration

Prerequisites

Configuration Example

Configuration Fields

Microsoft Entra ID Configuration (Import only)

Prerequisites

Configuration Example

Required API Permissions

Okta Configuration (Import only)

Configuration Example

SQL Database Configuration

Prerequisites

Configuration Example

Configuration Fields

Delta Column Type Matters

Dynamic Target Container

Authentication Modes

Testing Your Connection

Using the API

Expected Response

Next Steps

Policy Rules

API Reference

Need Help?