> ## Documentation Index > Fetch the complete documentation index at: https://doc.lucidworks.com/llms.txt > Use this file to discover all available pages before exploring further. # Active Directory for ACLs V2 > The Active Directory Connector for ACLs indexes Access Control List (ACL) information so that it can be used by other connectors. export const schema = { "type": "object", "title": "Active Directory ACLs - LDAP (v2)", "description": "Active Directory Connector for Access Control.", "required": ["id", "properties"], "properties": { "created": { "type": "string", "title": "Date Created", "description": "The date at which this Configuration was created.", "hints": ["readonly", "hidden"] }, "description": { "type": "string", "title": "Description", "description": "Optional description", "hints": ["lengthy"], "maxLength": 125 }, "collection": { "type": "string", "title": "Collection ID", "description": "The associated content Collection.", "hints": ["readonly", "hidden"], "minLength": 1, "pattern": "^[a-zA-Z0-9_-]+$" }, "type": { "type": "string", "title": "Type", "description": "A type ID for this connector.", "hints": ["readonly", "hidden"] }, "pipeline": { "type": "string", "title": "Pipeline ID - not needed for ACL connector", "description": "Name of the IndexPipeline used for processing output.", "hints": ["readonly", "hidden"], "minLength": 1, "pattern": "^[a-zA-Z0-9_-]+$" }, "diagnosticLogging": { "type": "boolean", "title": "Diagnostic Logging", "description": "Enable diagnostic logging; disabled by default", "default": false }, "connector": { "title": "Connector Type", "description": "Connector type.", "minLength": 1, "type": "string", "hints": ["hidden"] }, "parserId": { "type": "string", "title": "Parser ID", "description": "The Parser to use in the associated IndexPipeline.", "hints": ["readonly", "hidden"] }, "coreProperties": { "type": "object", "title": "Core Properties", "description": "Common behavior and performance settings.", "required": [], "properties": { "fetchSettings": { "type": "object", "title": "Fetch Settings", "description": "System level settings for controlling fetch behavior and performance.", "required": [], "properties": { "indexingInactivityTimeout": { "type": "number", "title": "Indexing inactivity timeout(seconds)", "description": "The maximum amount of time to wait for indexing results (in seconds). If exceeded, the job will be failed", "default": 1800, "maximum": 9223372036854776000, "exclusiveMaximum": false, "minimum": 60, "exclusiveMinimum": false, "multipleOf": 1 }, "indexContentFields": { "type": "boolean", "title": "Index content fields - not needed for ACL connector", "description": "When enabled, content fields will be indexed to the crawl-db collection.", "default": false, "hints": ["readonly", "hidden"] }, "numFetchThreads": { "type": "number", "title": "Fetch Threads", "description": "Maximum number of fetch threads; defaults to 5.This setting controls the number of threads that call the Connectors fetch method.Higher values can, but not always, help with overall fetch performance.", "default": 5, "maximum": 500, "exclusiveMaximum": false, "minimum": 1, "exclusiveMinimum": false, "multipleOf": 1 }, "indexingThreads": { "type": "number", "title": "Index Subscription Threads", "description": "Maximum number of indexing threads; defaults to 4.This setting controls the number of threads in the indexing service used for processing content documents emitted by this datasource.Higher values can sometimes help with overall fetch performance.", "default": 4, "maximum": 10, "exclusiveMaximum": false, "minimum": 1, "exclusiveMinimum": false, "multipleOf": 1 }, "pluginInstances": { "type": "number", "title": "Number of plugin instances for distributed fetching", "description": "Maximum number of plugin instances for distributed fetching. Only specified number of plugin instanceswill do fetching. This is useful for distributing load between different instances.", "default": 0, "maximum": 500, "exclusiveMaximum": false, "minimum": 0, "exclusiveMinimum": false, "multipleOf": 1 }, "fetchItemQueueSize": { "type": "number", "title": "Fetch Item Queue Size", "description": "Size of the fetch item queue.Larger values result in increased memory usage, but potentially higher performance.Default is 10k.", "default": 10000, "hints": ["hidden"], "maximum": 500000, "exclusiveMaximum": false, "minimum": 1, "exclusiveMinimum": false, "multipleOf": 1 }, "fetchRequestCheckInterval": { "type": "number", "title": "Fetch request check interval(ms)", "description": "The amount of time to wait before check if a request is done", "default": 15000, "hints": ["hidden"], "maximum": 500000, "exclusiveMaximum": false, "minimum": 1000, "exclusiveMinimum": false, "multipleOf": 1 }, "fetchResponseScheduledTimeout": { "type": "number", "title": "Fetch response scheduled timeout(ms)", "description": "The maximum amount of time for a response to be scheduled. The task will be canceled if this setting is exceeded.", "default": 300000, "maximum": 500000, "exclusiveMaximum": false, "minimum": 1000, "exclusiveMinimum": false, "multipleOf": 1 }, "fetchResponseCompletedTimeout": { "type": "number", "title": "Fetch response completion timeout(ms)", "description": "The maximum amount of time for a response to be completed. If exceeded, the task will be retried if the job is still running", "default": 300000, "hints": ["hidden"], "maximum": 600000, "exclusiveMaximum": false, "minimum": 1, "exclusiveMinimum": false, "multipleOf": 1 }, "pluginInactivityTimeout": { "type": "number", "title": "Plugin inactivity timeout(seconds)", "description": "The maximum amount of time to wait for plugin activity (in seconds). If exceeded, the job will fail with a plugin inactivity timeout.", "default": 600, "maximum": 691200, "exclusiveMaximum": false, "minimum": 60, "exclusiveMinimum": false, "multipleOf": 1 }, "indexMetadata": { "type": "boolean", "title": "Index metadata", "description": "When enabled the metadata of skipped items will be indexed to the content collection.", "default": false }, "asyncParsing": { "type": "boolean", "title": "Async Parsing", "description": "When enabled, content will be indexed asynchronously.", "default": false } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.AclConnectorConfig$CoreLdapConfig$LdapFetchSettings", "com.lucidworks.fusion.connector.plugin.api.config.CoreConfig$FetchSystemSettings"] } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.AclConnectorConfig$CoreLdapConfig", "com.lucidworks.fusion.connector.plugin.api.config.CoreConfig"], "hints": ["advanced"] }, "modified": { "type": "string", "title": "Date Modified", "description": "The date at which this Configuration was last modified.", "hints": ["readonly", "hidden"] }, "id": { "type": "string", "title": "Configuration ID", "description": "A unique identifier for this Configuration.", "minLength": 1, "pattern": "^[a-zA-Z0-9_-]+$" }, "category": { "type": "string", "title": "Category", "default": "Active Directory Connector for Access Control.", "hints": ["hidden", "readonly"] }, "properties": { "type": "object", "title": "Properties", "description": "Plugin specific properties.", "required": ["security", "searchProperties"], "properties": { "security": { "type": "object", "title": "Security trimming configuration", "required": [], "properties": { "collectionId": { "type": "string", "title": "ACL collection id", "description": "Id of the collection to be used for storing ACL records. If not specified, ACL collection name will be generated automatically using pattern '_access_control_hierarchy'." } }, "interfaces": ["com.lucidworks.fusion.connector.plugin.api.config.security.AccessControlConfig$Properties"] }, "authProperties": { "type": "object", "title": "AD Server Authentication Properties", "description": "The credentials to access the AD server", "required": [], "properties": { "userPrincipal": { "type": "string", "title": "LDAP User Principal", "description": "A User Principal with permissions to access the LDAP server. A User Principal can takes the format \"user@domain\", \"domain\\user\" or a distinguished name to the user such as \"CN=user,DC=domain,DC=com\". This property is not required for anonymous access" }, "password": { "type": "string", "title": "LDAP password", "description": "Password of the User Principal. This property is not required for anonymous access", "hints": ["secret"] } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapAuthenticationConfig"] }, "serverProperties": { "type": "object", "title": "AD Server Properties", "description": "AD server Configurations", "required": [], "properties": { "ldapHost": { "type": "string", "title": "LDAP Host", "description": "The LDAP host of the LDAP/AD server where user information is stored." }, "ldapPort": { "type": "number", "title": "LDAP/Active Directory Port", "description": "The LDAP/AD server port to use. It will be used for all communication to server with an exception: When You specify one of standard global catalog ports (3268 or 3269) then requests like netbios domain searchwill use default ldap/ldaps port.", "default": 389, "maximum": 2147483647, "exclusiveMaximum": false, "minimum": -2147483648, "exclusiveMinimum": false, "multipleOf": 1 }, "globalCatalogPort": { "type": "number", "title": "Global Catalog Port - deprecated", "hints": ["hidden"], "maximum": 2147483647, "exclusiveMaximum": false, "minimum": -2147483648, "exclusiveMinimum": false, "multipleOf": 1 } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapServerConfig"] }, "searchProperties": { "type": "object", "title": "AD Search Properties", "description": "Search Configurations", "required": ["userSearchProp", "groupSearchProp"], "properties": { "baseDn": { "type": "string", "title": "Base DN", "description": "The base Distinguished Name (DN) in LDAP directory. It will be used for query for deleted objects. Also, it will be used in normal search queries in case the specific user/group dn is not set", "minLength": 1 }, "apiQueryRowLimit": { "type": "number", "title": "API query row limit", "description": "The maximum number of rows returned on a single page from the server. If the server have a lower upper bound, the maximum available amount will be requested.", "default": 1000, "hints": ["advanced"], "maximum": 1000, "exclusiveMaximum": false, "minimum": 1, "exclusiveMinimum": false, "multipleOf": 1 }, "useGlobalCatalog": { "type": "boolean", "title": "Use Global Catalog - deprecated", "default": false, "hints": ["hidden"] }, "followReferrals": { "type": "boolean", "title": "Follow Referrals", "description": "Whether or not to follow LDAP referrals when fetching ldap groups.", "default": false, "hints": ["advanced"] }, "userSearchProp": { "type": "object", "title": "User Search Properties", "description": "User Search Configurations", "required": [], "properties": { "crawlForUsers": { "type": "boolean", "title": "Crawl AD for users", "description": "Set to true if you want to crawl Active directory servers for users data.", "default": true }, "userBaseDn": { "type": "string", "title": "User base DN", "description": "Optional - Distinguished name (DN) in LDAP directory where user objects reside, such as CN=Users,DC=example,DC=com. If you do not specify this, the \"Base DN\" will be used when querying for users." }, "userFilter": { "type": "string", "title": "User filter", "description": "LDAP filter used when querying to listing all user objects.", "default": "(&(objectclass=user)(sAMAccountName=*))" } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapSearchUserConfig"] }, "groupSearchProp": { "type": "object", "title": "Group Search Properties", "description": "Group Search Configurations", "required": [], "properties": { "crawlForGroups": { "type": "boolean", "title": "Crawl AD for groups", "description": "Set to true if you want to crawl Active directory servers for groups data.", "default": true }, "groupBaseDn": { "type": "string", "title": "Group base DN", "description": "Optional - Distinguished name (DN) in LDAP directory where group objects reside, such as CN=Users,DC=example,DC=com. If you do not specify this, the \"Base DN\" will be used when querying for groups." }, "groupFilter": { "type": "string", "title": "Group filter", "description": "LDAP filter used when listing all group objects.", "default": "(&(objectclass=group))" } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapSearchGroupConfig"] } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapSearchConfig"] }, "azureProperties": { "type": "object", "title": "Azure AD Properties", "description": "Properties that should be set when want to crawl Azure AD instances for additional group definitions", "required": ["authProperties"], "properties": { "crawlForGroups": { "type": "boolean", "title": "Crawl Azure for groups", "description": "Set to true if you want to crawl Azure AD instances for groups data.", "default": false }, "crawlForUsers": { "type": "boolean", "title": "Crawl Azure for users", "description": "Set to true if you want to crawl Azure AD instances for user data.", "default": false }, "authProperties": { "type": "object", "title": "Authentication Properties", "description": "The credentials to access the Azure instance", "required": [], "properties": { "tenantId": { "type": "string", "title": "Azure AD Tenant ID", "description": "If crawling Azure AD instances, supply Azure Tenant ID. This is required when listing Azure Groups from Microsoft Graph API." }, "clientId": { "type": "string", "title": "Azure AD Client ID", "description": "If crawling Azure AD instances, supply the Azure Application's Client ID. This is required when listing Azure Groups from Microsoft Graph API." }, "clientSecret": { "type": "string", "title": "Azure AD Client Secret", "description": "If crawling Azure AD instances, supply the Azure Application's Client secret. This is required when listing Azure Groups from Microsoft Graph API.", "hints": ["secret"] } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.azure.AzureAuthenticationConfig"] }, "batchSize": { "type": "number", "title": "Graph client request batch size", "description": "Batch size of the requests to Microsoft Graph API.", "default": 500, "hints": ["advanced"], "maximum": 2147483647, "exclusiveMaximum": false, "minimum": -2147483648, "exclusiveMinimum": false, "multipleOf": 1 } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.azure.AzureConfig"] }, "connectionProperties": { "type": "object", "title": "Connections Properties (Deprecated)", "description": "Connections Configurations", "required": [], "properties": { "connectionPoolInitial": { "type": "number", "title": "Connection pool initial connections", "description": "Number of initial connections to open in the ldap connection pool.", "default": 1, "hints": ["hidden"], "maximum": 2147483647, "exclusiveMaximum": false, "minimum": -2147483648, "exclusiveMinimum": false, "multipleOf": 1 }, "connectionPoolMax": { "type": "number", "title": "Connection pool maximum", "description": "Maximum number of ldap connections that can be opened in the ldap connection pool.", "default": 10, "hints": ["hidden"], "maximum": 2147483647, "exclusiveMaximum": false, "minimum": -2147483648, "exclusiveMinimum": false, "multipleOf": 1 } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapConnectionConfig"], "hints": ["advanced"] }, "timeoutProperties": { "type": "object", "title": "Timeout Properties", "description": "Timeout Configurations", "required": [], "properties": { "readTimeout": { "type": "number", "title": "Read timeout", "description": "The read timeout in milliseconds for an LDAP operation.", "default": 5000, "maximum": 2147483647, "exclusiveMaximum": false, "minimum": -2147483648, "exclusiveMinimum": false, "multipleOf": 1 }, "connectTimeout": { "type": "number", "title": "Connect timeout", "description": "If the LDAP provider cannot establish a connection within this timeout period in milliseconds, it aborts the connection attempt.", "default": 3000, "maximum": 2147483647, "exclusiveMaximum": false, "minimum": -2147483648, "exclusiveMinimum": false, "multipleOf": 1 } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapTimeoutConfig"], "hints": ["advanced"] }, "sslProperties": { "type": "object", "title": "SSL Properties", "description": "SSL Configurations", "required": [], "properties": { "useLdaps": { "type": "boolean", "title": "Use SSL", "description": "Whether or not to use LDAPS secure protocol.", "default": false, "hints": ["advanced"] }, "base64SSLCertificate": { "type": "string", "title": "SSL Certificate", "description": "For use with LDAP with SSL only, this is the Base 64 encoded SSL server certificate that will be used to securely communicate with the LDAP server. The entire content of the SSL certificate must be set included the ----BEGIN CERTIFICATE -----and ----- END CERTIFICATE-----. No additional encoding is required.", "hints": ["advanced", "lengthy", "secret"] } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapSSLConfig"], "hints": ["advanced"] }, "documentsProperties": { "type": "object", "title": "Document Save Options", "description": "Document Save Options", "required": [], "properties": { "adNetbiosDomain": { "type": "string", "title": "AD Netbios Domain", "description": "Use this Active Airectory netbios domain. If not specified, the 'CN=Partitions,CN=Configuration,{dn}' will be used to dynamically look up the netbios domain.", "hints": ["advanced"] }, "userIdsAreCaseSensitive": { "type": "boolean", "title": "User IDs are case sensitive", "description": "If set to 'true' - created entries will not be capitalized", "default": false, "hints": ["hidden"] } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.ldap.LdapDocumentConfig"], "hints": ["advanced"] }, "itemRetryProperties": { "type": "object", "title": "Item Retry Settings", "description": "Options to configure the retry operation for items.", "required": [], "properties": { "maxRetries": { "type": "number", "title": "Max retry attempts", "description": "The maximum number of attempts for a failed item", "default": 3, "maximum": 20, "exclusiveMaximum": false, "minimum": 0, "exclusiveMinimum": false, "multipleOf": 1 }, "retryDelayInSeconds": { "type": "number", "title": "Retry delay", "description": "The amount of time, in seconds, before process again a failed item", "default": 30, "maximum": 600, "exclusiveMaximum": false, "minimum": 1, "exclusiveMinimum": false, "multipleOf": 1 } }, "interfaces": ["com.lucidworks.connectors.components.config.ItemRetryConfig$Properties"] } }, "interfaces": ["com.lucidworks.connector.plugins.acl.config.AclConnectorConfig$Properties", "com.lucidworks.connectors.components.config.ItemRetryConfig", "com.lucidworks.fusion.connector.plugin.api.config.ConnectorPluginProperties", "com.lucidworks.fusion.connector.plugin.api.config.security.AccessControlConfig"] }, "type_description": { "type": "string", "title": "Type Description", "default": "Active Directory Connector for Access Control.", "hints": ["hidden", "readonly"] } }, "category": "Active Directory", "categoryPriority": 1 }; export const SchemaParamFields = ({schema}) => { const sanitize = str => { if (typeof str !== "string") return str; return str.replace(/^"(.*)"$/s, "$1").replace(/\\/g, "").replace(/"/g, "'"); }; const formatDescription = str => { const s = sanitize(str); return (/[.!?]\)*$/).test(s) ? s : `${s}.`; }; const {description, properties = {}, required: requiredProps = []} = schema; const visibleProps = useMemo(() => Object.entries(properties).filter(([, prop]) => !prop.hints?.includes("hidden")), [properties]); return
{description &&

{formatDescription(description)}

} {visibleProps.map(([name, prop]) => { const isRequired = requiredProps.includes(name); const hasDefault = prop.default !== undefined; const rawDefault = prop.default; const isComplexDefault = hasDefault && (typeof rawDefault === "object" || typeof rawDefault === "string" && (rawDefault.length > 20 || rawDefault.includes('"'))); const fieldProps = { key: name, body: prop.title || name, type: prop.type, ...prop.title && ({ post: [<>API property: {name}] }), ...isRequired && ({ required: true }), ...!isComplexDefault && hasDefault ? { default: sanitize(String(rawDefault)) } : {} }; const isObject = prop.type === "object" && prop.properties; const isArrayOfObjects = prop.type === "array" && prop.items?.type === "object" && prop.items.properties; return {prop.description &&

{formatDescription(prop.description)}

} {isComplexDefault &&

Default: 

                  
                    {JSON.stringify(rawDefault, null, 2)}
} {isArrayOfObjects &&

Object attributes: 

                
                  {'{\n'}
                  {Object.entries(prop.items.properties).map(([iname, iprop]) => <>
                      {`  ${iname}`}
                      {prop.items?.required?.includes(iname) &&  required}
                      {`: {\n    display name: ${sanitize(iprop.title || '')}\n    type: ${iprop.type}\n  }\n`}
                    )}
                  {'}'}
} {isObject && } ; })}
; }; export const LwTemplate = ({title = "Key questions to get you started", icon = "sparkles", cta = "Powered by Agent Studio", linkHref = "https://lucidworks.com/demo/?utm_source=docs&utm_medium=referral&utm_campaign=docs_cta_ai"}) => { const [isLoaded, setIsLoaded] = useState(false); useEffect(() => { const timer = setTimeout(() => { setIsLoaded(true); }, 500); return () => clearTimeout(timer); }, []); return
{isLoaded && ` }} />} Powered by Lucidworks Agent Studio
; }; [localhost link]: http://localhost:3000/docs/fusion-connectors/connectors/ad-acl-v2 [mintlify link]: https://doc.lucidworks.com/docs/fusion-connectors/connectors/ad-acl-v2 [old doc.lw link]: https://doc.lucidworks.com/fusion-connectors/69 * **Latest version:** v2.1.4 * **Compatible with Fusion version:** 5.1.0 through 5.5.2 The Active Directory Connector for ACLs V2 plugin: * Is a special connector that supports other data sources with collecting Access Control List (ACL) data * Indexes ACL information into a configured "sidecar" Solr collection, for use by other connectors * Connects to LDAP, AD, and Azure AD instances to add objects directly to a special collection for use in [security trimming queries](/docs/5/fusion/reference/config-ref/pipeline-stages/query-stages/active-directory-security-trimming-query-stage) * Extends the Azure AD model from V1 to return a **delta link** at the end of a crawl, allowing incremental delta searches for groups and users Deprecation and removal notice This connector is deprecated as of June 19, 2023 and is removed or expected to be removed as of January 31, 2024. The Active Directory for ACLs V2 connector is not compatible with Fusion 5.6 and later, regardless of the removal date. Use the LDAP ACLs V2 connector instead. For more information about deprecations and removals, including possible alternatives, see [Deprecations and Removals](/docs/fusion-connectors/deprecations-and-removals). ## Flow overview 1. **LDAP initial crawl** for first paginated list of results. When complete, the initial crawl creates a checkpoint as the starting point for incremental crawls. 2. **LDAP incremental crawls** uses checkpoints to produce specific, paginated access control elements. When complete, the incremental crawl creates another checkpoint to use as a starting point for further incremental crawls. 3. **Azure AD crawl** fetches groups and users stored in Azure AD. Both User and Group retrieval is using the [MS API delta link request](https://docs.microsoft.com/en-us/graph/delta-query-overview) to retrieve incremental changes. Unlike LDAP, AD request returns additions and deletions in a single search, so there is no need to split crawls onto two searches per object. ### Flow details The same type of request with an empty delta link parameter is used for the initial crawl. Objects are retrieved as delta going back to the very beginning of the Azure AD instance. For non-removed Azure groups, the Azure group processor sends an additional request to server to populate its `memberof` collection. If an error occurs (for example, a wrong Azure response), then an error is emitted. This causes future crawls to start from the first page of a crawl, using the initial delta link for the current crawl. **Important** Azure rejects delta links older than 30 days. This mean incremental crawls must be performed more often than oncer per month. ## Configuration * The `aclCollectionName` field value should match the associated value in the main datasource. For example, **SharePoint** > **Security Trimming** > **ACL Collection Name**. * To improve performance, narrow search results for users and groups by setting the `userBaseDn` and `groupBaseDn` field values. These fields must select the subtree of the `baseDn` field. When entering configuration values in the UI, use *unescaped* characters, such as `\t` for the tab character. When entering configuration values in the API, use *escaped* characters, such as `\\t` for the tab character.