Directory Integration

Integrating vScope with your Active Directory (AD) or other LDAP-compatible directory service lets users sign in with their existing domain accounts, and lets you assign vScope permissions automatically based on directory group membership. Using the LDAP protocol, vScope can connect to Active Directory as well as other LDAP-compliant directory services.

Goal

Connect vScope to your directory service and map directory groups to vScope permission groups.

Prerequisites

• You have Administrator permissions in vScope.
• A service account with read access to users, groups, and their group memberships in the directory. A dedicated, read-only account is recommended over reusing a privileged administrator account.
• LDAP/LDAPS network access from the vScope server to the directory service (see Ports used by vScope).

Important

We highly recommend always keeping a local vScope recovery account available in case directory integration or SSO ever becomes unreachable. See Cannot log in to vScope if you get locked out.

Steps

Connect to your directory service

1. Go to Settings > Users & Access > Active Directory / LDAP.
2. Enter the connection details for your directory service, including the service account credentials from the prerequisites above.
3. Click Connect. A successful connection turns the button green and unlocks the Group Mapping section.

Group Mapping

Group Mapping automatically assigns vScope permission groups based on your directory groups, so you don’t have to manage user permissions manually in vScope.

1. In the Group Mapping section, map directory groups to vScope user groups.
   • For example, create groups in your directory service such as vScopeAdmins and vScopeUsers, then map each to the corresponding vScope permission group.
2. If a directory group isn’t visible in the dropdown, click Refresh Groups to reload the list from the directory.

(Optional) Tune nested group resolution

If your directory uses nested groups (groups that contain other groups), resolving full group membership can take noticeably longer to authenticate in large or deeply nested domains.

1. Go to Nested Group Options and select Advanced.
2. Choose the group membership resolution method that best balances accuracy and performance for your environment. Resolving nested memberships fully is more accurate but slower; limiting resolution depth is faster but may miss group memberships inherited through nested groups.

Expected result

Users can sign in to vScope with their directory credentials, and are placed into the correct vScope permission groups automatically based on their directory group memberships.

Important notes

• Changes to a user’s group membership in the directory are only picked up the next time vScope resolves that user’s groups (typically at login), not instantly.
• If a user is removed from all mapped directory groups, they lose the associated vScope permissions but the account itself is not deleted from vScope.