Connect Identities
Connect an Active Directory domain or an EntraID tenant to AuthNull.
- In Identity, open Identity Sources.
- Click Add identity source.
- Choose Active Directory or EntraID.
Active Directory
Adding Active Directory has two steps:
- Connect Active Directory — describe the domain (this section).
- Install DC Sensor — install the sensor on your Domain Controllers. See Install the DC Sensor.
Fields
| Field | Required | Description |
|---|---|---|
| Display Name | Yes | A friendly name for this directory, e.g. Corp AD. |
| Domain Name | Yes | The AD domain, e.g. authnull.lab. |
| Base DN | Auto | Derived from the domain, e.g. authnull.lab becomes DC=authnull,DC=lab. Click Edit to change it, Reset to go back. |
| Enforcement Mode | Yes | Monitor (default) or Enforce. In Monitor, every sign-in is allowed and no push is sent. |
| Fallback if Authnull is unreachable | Yes | Allow (default, recommended) or Deny. |
| Sync scope | Yes | All users in this domain by default. Click Narrow scope to sync only some groups or OUs. |
| Sync Filter — Groups | With Narrow scope | Plain group names, e.g. Domain Admins. |
| Sync Filter — OUs | With Narrow scope | OU values, e.g. OU=ITStaff. |
Rules
- Domain Name must contain a dot and must not contain
@. - Sync Filter — Groups takes plain names. Do not add a
CN=prefix. - Sync Filter — OUs values must each start with
OU=. - A domain that is already connected is refused.
Fallback is used when AuthNull cannot be reached. It is also used when a push is denied, expires or times out. With Fallback = Allow, a denied push can still let the user in. Choose Deny if that is not acceptable.
There are no service-account password, DC host, LDAP port or LDAPS fields. The sensor on the Domain Controller reads the directory locally.
Save
Click Save & Continue. The wizard moves to Install DC Sensor. Continue with Install the DC Sensor.
Click Cancel to leave without saving.
EntraID
Choose EntraID to open Integrate EntraID. The page includes a setup guide.
Register an app in Microsoft Entra
Do this first, in the Microsoft Entra admin center.
- Go to App registrations and create a new app registration.
- Copy the Directory (tenant) ID and Application (client) ID.
- Under Certificates & secrets, create a client secret. Copy its value.
- Under API permissions, add these Microsoft Graph application permissions:
| Permission | Required |
|---|---|
User.Read.All | Yes |
Group.Read.All | Yes |
Directory.Read.All | Optional |
- Click Grant admin consent for these permissions.
Fields
| Field | Description |
|---|---|
| Entra Name | A friendly name for this tenant. |
| Select Integration Type | Agentless or AgentBased. |
| Tenant ID | The Directory (tenant) ID from your app registration. |
| Client ID | The Application (client) ID. |
| Client Secret | The client secret value. |
Click Configure EntraID to save. Click Back to return.
AuthNull syncs EntraID users every 5 minutes.
Changing settings later
There is no edit screen for an identity source.
Mode (Monitor or Enforce) can be changed at any time from the Mode column on Identity Sources.
Sync scope and Fallback are written into sensor.yml when you download it. To change them:
- Download a new
sensor.yml. - Replace the file on each Domain Controller.
- Restart the sensor service.
See Install the DC Sensor for file locations.