NexTool Solutions

We connected a lab Active Directory to GLPI 11: 7 users imported in 1.4 seconds, each one with the right profile based on their AD group and logging in with their network password. So far, everything as expected. The problem showed up when we offboarded an employee in AD: in GLPI, they stayed active, with the same profile. And changing the configuration afterwards did not fix it, because GLPI only applies the offboarding rule the first time it notices the departure.

Using Microsoft Entra ID (Azure AD) and want single sign-on in the browser? See SSO with Microsoft Entra ID in GLPI. This article covers on-premises AD, over LDAP.

What the AD integration does

• Login with the network password: users sign in to GLPI with the same username and password they use for Windows. The password is never stored in GLPI.
• Data import: first name, last name, email, phone, job title and other fields come from AD.
• Profile by group: authorization rules assign the profile and the entity according to the AD group (technician, manager, user).
• Synchronization: changes in AD, such as a new phone number, a new job title or an offboarding, reach GLPI through the scheduled synchronization.

The lab

We set up a Samba domain controller (Active Directory compatible) with the domain ACME.TEST, the fictitious company Acme, three groups (GLPI-Tecnicos, GLPI-Gestores, GLPI-Usuarios) and eight users: seven active and one disabled in an OU for offboarded staff. On the other side, a test GLPI 11.0.7.

Step 1: the LDAP directory

In Setup > Authentication > LDAP directories:

The Test button checks the connection before importing anything.

Step 2: the profile from the AD group

In Administration > Rules > Authorizations assignment rules, one rule per group:

Authorizations granted by rules are dynamic: if the person leaves the group in AD, the profile is removed at the next synchronization.

Step 3: import and synchronize

From the screen (Import new users) or from the command line, which is what you need for scheduling:

php bin/console ldap:synchronize_users --ldap-server-id=1 --deleted-user-strategy=1,0,1

In the lab, the import brought in the 7 active users in 1.4 seconds, and the disabled one was left out by the filter. Name, email and phone came from AD, and each user received the profile of their group. Login with the AD password worked, and with the wrong password it was denied.

What happened when we offboarded an employee

We disabled a user in AD and ran the synchronization, first with the default configuration.

Two conclusions:

1. GLPI's default is to do nothing with people who leave AD (strategy "0,0,0"). A former employee keeps an active account in GLPI until someone notices.
2. The strategy applies at the moment GLPI detects the departure. If the first synchronization ran with the default, changing the configuration later does not catch those already marked. These users have to be handled manually.

Configure the action for users deleted from LDAP before the first synchronization (in Setup > Authentication, or with --deleted-user-strategy in the command). The combination we recommend is "1,0,1": disable the account, keep the groups (for the history) and remove the dynamic authorizations.

For the return, the restore strategy "3" re-enables the account when the person is reactivated in AD.

A detail about the default profile

All imported users also received GLPI's default profile (in our case, Self-Service), in addition to the profile from the rule. For technicians, this does no harm, but it shows up when switching profiles. If you do not want it, review which profile is GLPI's default before importing.

Checklist

1. Read-only service account for the RootDN.
2. LDAPS or StartTLS in production.
3. BaseDN at the people OU and a filter that excludes disabled accounts.
4. objectguid as the synchronization field.
5. Authorization rules by AD group, with a defined entity.
6. Action for users deleted from LDAP configured before the first synchronization ("1,0,1").
7. Scheduled synchronization (cron) with ldap:synchronize_users, at least daily.
8. Test with a fictitious user: create, change group, offboard and reactivate in AD, and check GLPI at each step.

Need help with the integration or with an access audit? Talk to the team. To understand profiles and permissions, see profiles and permissions in GLPI.

NexTool test on October 4, 2026: Samba domain controller (Active Directory compatible) with fictitious users and a test GLPI 11.0.7. The lab was deleted at the end. Synchronization behavior checked in GLPI's own command.