Active Directory/LDAP User & Group Imports via Director

I have successful imports of users from LDAP working to Icinga2 via Director. I also successfully imported a group via LDAP.

My question is, is it possible to sync the LDAP group and all of the users it contains to Icinga2 via Director in order to have users automatically sync’d and created when users are added/changed/removed from the group in Active Directory?

This would be ideal if possible. If not, I will just import the users and manually create groups in icinga2 as I don’t know what the benefit would be of importing a group from LDAP if it doesn’t understand its members/users etc…


This depends a bit on your AD LDAP structure

  • Are CN matching the sAMAccountName
  • Can you filter our certain groups you want
  • Group in Group will be a problem

What can be tricky:

  • New groups must be added before the user
  • Users must be updated before a group can be removed

Here is an example. I won’t describe the LDAP Resource here, but its simple to create and used for auth in Icinga Web as well.

Import source: AD Users

Name: AD Users
Source Type: Ldap
Key column name: sAMAccountName
Resource: Your LDAP resource
Ldap Search Base: ou=User,ou=myorg,dc=int,dc=example,dc=com
Object class: user
Object filter: &(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))
Properties: sAMAccountName, cn, sn, givenName, mail, mobile, memberOf

Now where the magic happens is modifier:

Property: memberOf
Modifier: Filter Array Values
Method: Simple Match
Filter: *,ou=groups,ou=myorg,dc=int,dc=example,dc=com
Policy: Keep matching
When empty: Return empty array
Property: memberOf
Modifier: Regex Replacement
Pattern: /^cn=(.+?),ou=.*/i
Replacement: \1

The modifier will replace the DN with the simple CN, which should be identical to the sAMAccountName of the group.

Import source: AD Groups

Name: AD Users
Source Type: Ldap
Key column name: cn
Resource: Your LDAP resource
Ldap Search Base: ou=groups,ou=myorg,dc=int,dc=example,dc=com
Object class: group
Object filter:
Properties: cn, name

Sync rule: AD Groups

Type: User group

Properties from AD Groups:

  • ${cn} -> object_name

Sync rule: AD Users

Type: User

Properties from AD Users:

  • ${sAMAccountName} -> object_name
  • ${memberOf} -> groups
  • ${cn} -> display_name
  • ${mail} -> email
  • ${mobile} -> pager


object User "mfrosch" {
    display_name = "Markus Frosch"
    email = ""
    groups = [
        // others
object UserGroup "net-auth-consulting" {
1 Like

Thank you! I will play around with this today.

We have set up import of users and groups in a certain ou called icinga on our AD server. The import seems to work fine except that although we create the groups and run an import before adding users to the groups on the AD server, the groups are empty in icinga. If we add users to the group on the icinga server, the synchronization rule will remove the users from the group.

Any suggestions to why the groups are empty?

Hello Per,

as far as I understand your problem, you have to add the users in the groups in AD. If you add them in icinga, the director will sync the groups from AD and there they are empty.

I hope that helps.

Hi again. we do add the users on the AD server, but they do not show up in Icinga. So although the group is created, it shows up as empty in Icinga.