Credential Synchronization

bilgi

Credential Synchronization automatically turns users from Database Provider, LDAP Active Directory, and API Authentication Provider sources into Credential records, either on a schedule or on manual trigger. This keeps credentials centrally up to date from the external source instead of being created manually for each provider.

Sync Profile

Each identity provider (Database Provider, LDAP Active Directory, API Authentication Provider) has a separate Sync Profile tab in its edit screen. The common fields in this tab are:

Field	Description
Enable Synchronization	When enabled, credentials are synchronized from this source according to the configured schedule. When disabled, neither the scheduled nor the manual synchronization runs.
Cron Expression	A Quartz cron expression that determines how often synchronization runs (e.g. 0 0 2 * * ?). If left empty, synchronization can only be triggered manually from the Synchronization screen.
Deactivation Mode	The action applied to credentials whose corresponding user is no longer present in the source on the last run: • Disable (recoverable) — the credential is disabled but its record is kept. This is the default. • Delete (irreversible) — the credential is permanently deleted. • None (keep as is) — no action is taken; drift is accepted.

Provider-specific additional fields are described below.

LDAP Active Directory

Field	Description
Root OU DN	The root DN of the OU (Organizational Unit) tree to synchronize. Example: OU=Users,DC=acme,DC=corp

not

LDAP synchronization synchronizes not only users but also the organization tree the users belong to. Other sources (Database, API) synchronize users only.

Database Provider

Field	Description
User List Query	A parameterless SELECT statement that returns the users to synchronize. The returned columns must use the following aliases: username (required), email, full_name. Example: select login as username, mail as email, display_name as full_name from users

API Authentication Provider

Field	Description
User List URL	The endpoint that returns the list of users to synchronize.
HTTP Method	The HTTP method used when calling the user list endpoint.
Timeout	The request is terminated after this many seconds.
Request Body	An optional request body sent to the user list endpoint (for POST/PUT).
Request Headers	Optional HTTP headers sent with the user list request (e.g. Authorization).
Users Array JSON Path	The JSON Path expression to the user array in the response. Default: $
Username JSON Path	The JSON Path expression to the username within a user item. Required.
Email JSON Path	The JSON Path expression to the email within a user item.
Full Name JSON Path	The JSON Path expression to the full name within a user item.

Synchronization Status and History

The screen opened from Identity > Providers > Synchronization lists LDAP, Database, and API sources in separate tabs. Each row shows:

Field	Description
Name	The name of the identity provider.
Type	The source type (LDAP / Database / API).
Schedule	The configured cron expression.
Status	The job status: Scheduled, Running, Paused, Blocked, Complete, Error, or Undefined (never run).
Last Synchronized	The completion time of the last run.
Upserted, Deactivated, Skipped, Errors	The record counts processed on the last run.

The Synchronize Now button on this screen triggers synchronization for the corresponding source immediately, without waiting for its schedule.

uyarı

Synchronize Now cannot be run for a source whose synchronization is disabled (the Enable Synchronization field is off).

Behavior and Safety Notes

bilgi

• If a manually created (non-sync-managed) credential's username also exists in the source, synchronization does not overwrite that record; an administrator must resolve the conflict.
• If a credential is already managed by another source (for example LDAP), a different source (for example Database) does not take it over.
• If the same username already exists in another project, synchronization does not create a new credential with that username in a different project.
• If the user list cannot be fetched from the source (connection error, etc.) or the source returns zero users, the deactivation step for that run is skipped so that a transient source outage cannot cause a mass deactivation.

Related Pages

For provider connection settings, see Database Provider, LDAP Active Directory, and API Authentication Provider. For the synchronized records, see Credentials.