---
title: Configuring Trusted Agent for LDAP Connections
slug: neurons-for-itsm/admin-user-help/enu/latest/configuring-trusted-agent-for-ldap-connections
createdAt: 2026-07-14T19:16:51.263Z
---
***Role**: Administrators.*
***Minimum Version**: *Ivanti Neurons for ITSM* 2023.1*
Configure and synchronize employee profiles from your LDAP Active Directory server to Neurons for ITSM.
::::ExpandableHeading
## Add a New LDAP Connection and Push Policy Settings
:::hint{type="info"}
This procedure must be completed prior to installing Trusted Agent as described in [Install Trusted Agent](docId\:a0hAYNshu5n26tGcUdpSS). Also note that in the current version of Neurons for ITSM, you can add only one Trusted Agent connection.
:::
1. In the Configuration console, select **Extend > Integration Tools > Trusted Agent Connections**.
:::Paragraph{indent="1"}
The **Trusted Agent Connections** form is displayed. Use this form to configure a new connection or edit an existing one.
:::
2. Click **New trusted agent connection** to open the **Trusted Agent Connections** form.
3. Enter the connection settings in the **Configuration** section of the **Trusted Agent for Connections** form.
::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/ztmY2yw-qBcCh0o0p-hTj_blanktrustedagentconnectionsform.png" alt="screeenshot of a blank trusted agent connections form" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/blank_trusted_agent_connections_form.png" githubPath="Content/Resources/Images/trustedAgents-images/blank_trusted_agent_connections_form.png" showCaption="false" indent="1"}
| Field | Description |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Setting Name** | A unique name for this LDAP server connection. |
| **Policy Type** | Select **LDAP**. |
| **Server** | The LDAP domain controller host IP address. |
| **Base DN** | Optional. The distinguished name for the LDAP object in the LDAP server. This value is not case sensitive. |
| **User Name** | If the server requires authentication, enter the LDAP domain server name. |
| **Password** | If the server requires authentication, enter the LDAP domain server password. |
| **Encryption Method** | Select an encryption method:
- **No encryption**
- **Use SSL encryption (ldaps\://)**
- **Use StartTLS extension** |
| **Authentication Type** | Select an authentication type:
- For **No encryption** method, select **Ntlm**.
- For **SSL** or **TLS** method, select **Simple (Basic) authentication**. |
| **Api Key** | Optional: The SignalR API key required to enable external authentication.
The SignalR API key is required if you want to enable users to login externally, if you do not want to enable external authentication this key is not required. For information on SignalR, see [https://learn.microsoft.com/en-us/aspnet/signalr/overview/getting-started/introduction-to-signalr.](https://learn.microsoft.com/en-us/aspnet/signalr/overview/getting-started/introduction-to-signalr)
To generate the API key, see step 4 below.
Paste the generated API key into this field.
When the key is provided, and the LDAP settings are pushed successfully, the **Enable Authentication** switch is displayed.
:inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/oiQLV3gAQIX50qWo5ETKi_externalauthenticationselector.png" alt="screenshot of the external authentication selector" caption size="40"}
This switch can be toggled ON *after the Trusted Agent is installed*. If you toggle the switch ON before the Trusted Agent is installed a warning is displayed. See [Enable External Authentication](docId\:wFPurW9Ip9CEtaLCzxUQl). |
4. Optional: Generate a SignalR API Key to enable external authentication:
:::hint{type="info" indent="1"}
This step is only required if you want to enable external authentication. For information on SignalR, see [https://learn.microsoft.com/en-us/aspnet/signalr/overview/getting-started/introduction-to-signalr](https://learn.microsoft.com/en-us/aspnet/signalr/overview/getting-started/introduction-to-signalr).
:::
:::Paragraph{indent="1"}
a. In the Configuration Console, select **Security Controls > API Keys**.
:::
:::Paragraph{indent="1"}
b. In the **API Keys** workspace, select **Add Key Group**.
:::
:::Paragraph{indent="1"}
c. In the **Name** field, enter Signalr, and then enter a brief description in the **Description** field.
:::
:::Paragraph{indent="1"}
d. Click **Save Key Group**.
:::
:::Paragraph{indent="1"}
e. Select the Signalr group in the **Key Groups** list.
:::
:::Paragraph{indent="1"}
f. In the **API Keys** pane, select **Add API Key**.
:::
:::Paragraph{indent="1"}
g. Select the **Activated** checkbox if not already selected.
:::
:::Paragraph{indent="1"}
h. Enter a description, on behalf of, and role information if required.
:::
:::Paragraph{indent="1"}
i. Click **Save Key**.
:::
:::Paragraph{indent="1"}
j. Copy the generated API key identifier to the clipboard.
:::
:::Paragraph{indent="1"}
k. Return to the **Trusted Agent for LDAP Connections** form, and then paste the key into the **Api Key** field.
:::
5. Click **Push Policy Settings**.
:::Paragraph{indent="1"}
While the LDAP settings for the Trusted Agent are being processed, the **Status** is displayed as **Pending**.
:inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/tSTAsqBSMWVst4aZFMVPy_statuspending1.png" alt="image showing agent policy status pending" caption size="45" width="452" height="93"}
:::
:::hint{type="info" indent="1"}
The **Push Policy Settings** button changes to **Update Policy Settings**, and is disabled while the settings are being processed.
:::
:::Paragraph{indent="1"}
The LDAP settings push can take up to 20 minutes to complete. Click **Refresh** to check if the push has completed. When completed successfully, the **Status** is displayed as **Success**. A pop-up message is also displayed.
:inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/CtWyOd4BeCx0dDrnyvL0-_statussuccess1.png" alt="image showing agent policy status successful" caption size="45" width="454" height="95"}
:::
::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/MklU7GwvEtX8f5RkoRDZW_policyconnectionsuccessmessage.png" alt="Image showing massage informong that Push LDAP Settings are successful" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/policy_connection_success_message.png" githubPath="Content/Resources/Images/trustedAgents-images/policy_connection_success_message.png" showCaption="false" indent="1"}
:::hint{type="info"}
Occasionally the status may revert to **Pending**. If this happens, push the LDAP settings again by clicking **Update Policy Settings**, and then click **Refresh**. The status changes to **Success**.
:::
:::Paragraph{indent="1"}
If the push fails, a **Failed** pop-up message is displayed.
:::
::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/HbDQRYIRA3TmGtwYePk6i_policyconnectionfailedmessage404x55.png" alt="Image showing massage informong that Push LDAP Settings have failed" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/policy_connection_failed_message_404x55.png" githubPath="Content/Resources/Images/trustedAgents-images/policy_connection_failed_message_404x55.png" showCaption="false" indent="1"}
:::Paragraph{indent="1"}
If a failed push occurs, check your settings are correct, and then:
:::
:::Paragraph{listStyleType="disc" indent="2"}
Push the settings again.
:::
:::Paragraph{listStyleType="disc" indent="2"}
If the push still fails, refresh the page in the browser, and push the settings again.
:::
:::Paragraph{indent="1"}
When processing is complete, an enrollment key, comprising of the tenant ID and activation key, is displayed in the **Enrollment Key** field.
:::
6. Under the **Download URL for Installer (Windows)** section, click **Download** to download the installer files.
:::hint{type="info" indent="1"}
Copy the IvantiCloudAgent.exe and IvantiCloudAgent.exe.options files to the server on the private network where Trusted Agent is to be installed.
:::
**When completed successfully, proceed to installing the Trusted Agent before continuing with the remaining procedures in this topic, refer to **[Install Trusted Agent](docId\:a0hAYNshu5n26tGcUdpSS)
::::
::::ExpandableHeading
## Connect Trusted Agent to the Directory Server and Test the Connection
:::hint{type="info"}
Prior to testing the connection, ensure that the **Agent Status** is displayed as "Success" on the **Trusted Agent Connection** page, and that Trusted Agent is installed successfully on the machine in the private network.
:::
1. In the Configuration console, select **Extend > Integration Tools > LDAP Settings**.
The **LDAP Settings** list is displayed.
2. Click **Add New**.
The **Connect to Directory** form is opens.
::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/sIuFNot0oQmAOt3SgoD7D_connecttodirectory.png" alt="A screenshot of the connect to directory form" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/connect_to_directory.png" githubPath="Content/Resources/Images/trustedAgents-images/connect_to_directory.png" showCaption="false" indent="1"}
3. Select **Use Trusted Agent**.
Provided the Trusted Agent is running, selecting this checkbox automatically populates the settings fields with the Trusted Agent connection settings.
:::hint{type="info" indent="1"}
For security reasons, the **Password** field displays "not set". The password is not shown.
:::
4. Click **Test Connection**.
A message is displayed to inform you if the connection is successful or has failed. If an error is displayed, return to the connection settings to determine the error, edit and test again.
5. If successful, click **Next**.
When you click **Next** the **Select Directory Info to Sync** form is displayed. Use this form to select and add the root nodes to synchronize. See [Configure Root Nodes, Save and Synchronize Directory Information and Enable External Authentication](docId\:wFPurW9Ip9CEtaLCzxUQl) below.
:::hint{type="info"}
If the connection test failed, you can find error information on the failed connection in **Trusted Agent Monitoring**. For more information, see [Trusted Agent Monitoring and Logging](docId\:YGE08xVtsChFzydIgjB73).
:::
::::
::::ExpandableHeading
## Configure Root Nodes, Save and Synchronize Directory Information and Enable External Authentication
When you have a successful connection, you need to select the directory root nodes (employees) to connect, save the LDAP settings, and then synchronize the settings to import their data.
### Connecting the Root Nodes
1. Click **Root DSE** to expand the list.
2. Select the nodes you want to connect and synchronize.
3. Scroll down to the end of the page, click **Add selected node as root**, and then click **Select sample entry**.
::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/GfB3zx4c50AmTXj1e-9zm_addselectednodes.png" alt="Image showing the Add selected node as root and Select sample entry that you select, as mentioned in the above instruction" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/add_selected_nodes.png" githubPath="Content/Resources/Images/trustedAgents-images/add_selected_nodes.png" showCaption="false" indent="1"}
4. Check at the top of the page if the selected nodes are displayed under **Root LDAP node(s)** and **Sample LDAP entry to extract fields from**.
5. Click **Next** to move to the **Field Mapping** form.
:::hint{type="info" indent="1"}
For this version, changes to field mapping are optional, you can skip the field mapping process if not required and move directly to completing the synchronization. If changes to the field mapping are required, see [Mapping Fields](docId\:cu-xe1esQwc_MZ5p2w2CE).
:::
6. Click **Next**, then click **Next** again to display the **Completed** form.
This form displays the **Save** and **Synchronize Now** functions.
### Save and Synchronize the LDAP Settings
Save the LDAP settings before synchronizing them.
1. Click **Save** to save the LDAP settings.
2. Click **OK** in the **LDAP Wizard** message dialog.
3. Click **Synchronize now**.
The **LDAP Sync** dialog appears.
4. Click **OK**.
:::hint{type="info"}
Once you have established the LDAP connection, and the connection is validated, you can use a workflow to schedule synchronization of the LDAP connection, and to notify users if the synchronization is started or has failed. See [Example: Using a Workflow to Schedule LDAP Synchronization](docId\:LcG6q-AHRwEfwHyfeOsYF). You can also synchronize existing LDAP connections from the **LDAP Settings** list by selecting **Sync Now** in the **Action** column.
:::
### Enable External Authentication
If you configured an API key for the LDAP connection, toggle ON the **Enable Auth** switch in the **Trusted Agent Connections** form to enable external authentication for imported employees.
1. Open the **Trusted Agent Connections** form.
2. Toggle the **Enable Auth** switch ON.
A success message is displayed when external authentication is enabled for the connection.
::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/gzW1rVWZkFL9eA6CoNEql_extauthverificationsuccessmessage.png" alt="screenshot of the external authentication success message" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/ext_auth_verification_success_message.png" githubPath="Content/Resources/Images/trustedAgents-images/ext_auth_verification_success_message.png" showCaption="false" indent="1"}
:::hint{type="info"}
You can return to the **Trusted Agent LDAP Connections** form at any time to disable or re-enable external authentication.
:::
If the enable external authentication generates an error, check the following:
- Trusted Agent is installed, see [Install Trusted Agent](docId\:a0hAYNshu5n26tGcUdpSS)
- You have generated a SignalR API key.
- You have entered the correct API key (SignalR API key) in the **Trusted Agent Connections** form.
::::
::::ExpandableHeading
## Check the LDAP Import Log, Verify Employee Import and External Authentication
### Check the LDAP Import Log
1. Select **Extend > Integration Tools > LDAP Import Log**.
2. Click **Refresh** to update the list and check that your LDAP import is logged.
This may take a few minutes to update if the LDAP import is queued. Click **Refresh** again to refresh the list.
View the Trusted Agent Monitoring logs if you want to verify the status of all the operations performed while setting up the Trusted Agent. See [Trusted Agent Monitoring and Logging](docId\:YGE08xVtsChFzydIgjB73).
### Verify Employee Import
You can verify all selected employees have been imported by the Trusted Agent connection to the **Employee** workspace.
1. From the **Administrator** dashboard, open the **Employee** workspace.
2. Check the list of employees and verify that the employees you imported are present in the list.
:::hint{type="success"}
Use the **Employee** workspace search function to quickly locate each entry.
:::
### Verify External Authentication
If you have configured external authentication to enable external login for employees, check employee records to verify that their external login is enabled.
1. From the **Administrator** dashboard, open the **Employee** workspace.
2. Select an employee that you imported and open the **Employee** record.
3. Check the following:
- The **Enable External Auth** checkbox is checked.
- The employee user name and the Trusted Agent instance appears in the **Login for External Auth** entry.
::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/JoH5xB06C8AvdU4AsW2Es_extauthverification.png" alt="screenshot of employee external authentication fields" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/ext_auth_verification.png" githubPath="Content/Resources/Images/trustedAgents-images/ext_auth_verification.png" showCaption="false"}
4. Repeat step 2 and 3 above to verify additional records as required.
::::
:::ExpandableHeading
## Synchronizing Existing LDAP Settings for Trusted Agent
This feature enables you to verify and synchronize an existing Trusted Agent LDAP connection from the **LDAP Settings** list.
if you have made alterations to an existing Trusted Agent LDAP configuration, you can use the **Verify Config** option on the **LDAP Settings** page to validate the alterations made to the LDAP configuration.
When running **Verify Config** from the LDAP settings page, this prompts you to select the appropriate root node or directory within the configuration. This step is vital as it ensures that any changes made to the Trusted Agent LDAP configuration are saved, and accurately validated. By choosing the correct root node, you guarantee that your LDAP configuration remains consistent and functional.
This process also safeguards the integrity of workflows within the system. Ensuring that LDAP configuration changes are correctly validated helps prevent any disruptions or breakages in workflows that rely on LDAP data.
The **Sync Now** function for the Trusted Agent LDAP connection listed in the **LDAP Settings** page is disabled if the connection configuration settings are not verified.
::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/x051vOc8aEiCKUBDpiXRl_synch-nowverifyconfigfortaldap.png" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/synch-now_verify_config_for_TA_LDAP.png" githubPath="Content/Resources/Images/trustedAgents-images/synch-now_verify_config_for_TA_LDAP.png" showCaption="false"}
**To verify and synchronize existing Trusted Agent LDAP settings:**
1. In the Configuration console, select **Extend > Integration Tools > LDAP Settings**.
The **LDAP Settings** list is displayed.
2. Select **Verify Config** for the LDAP connection.
The LDAP settings configuration opens.
3. Follow the configuration pages displayed, selecting **Next** to move through the process, ensuring the correct root nodes or directories are selected.
4. **Save** the LDAP configuration.
5. You can synchronize the LDAP connection in the settings page, or use the **Sync Now** function displayed in the **LDAP Settings** list.
:::