> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/integrations-and-connectors.md).

# Integrations and connectors

Integrations connect SECUREpass to the systems that already hold your identities and data — directories, cloud IAM platforms, SaaS applications, databases and SIEM.

Every connector follows the same shape: pick the connector, add a connection, test it, map what comes across, then sync. This page walks one connector end to end and then explains how to sync and verify.

## The connector catalogue

Select **Integrations** in the left navigation.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/v2CUpJ8ka5fsygFyDv7S/assets/01.png)

Connectors are grouped into five tabs: **All**, **Identity Providers**, **Data Systems**, **SaaS Applications** and **SIEM**. Use the search box to jump straight to one by name.

The badge in the corner of a connector card is the number of connections already configured against it. A card with no badge has none.

### Identity Providers

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/w85xjvZA6PFr9hMnUrdj/assets/02.png)

AWS IAM · Azure AD · Active Directory (LDAP) · Okta · OneLogin · OpenLDAP · Oracle IAM · Ping Identity

### Data Systems

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/z4IE3Hakyok83NP3SdkG/assets/03.png)

Hashicorp · Microsoft SQL · MongoDB · Oracle · PostgreSQL

**SaaS Applications** and **SIEM** work the same way and hold the application and log-forwarding connectors.

## Adding a connection

Select the connector you want — OpenLDAP is used here as the example.

The connector opens on its connections list, showing what is already configured, each connection's status, and the actions available on it. Select **Add Connection**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/TzTJxgiD2mZmCQCgglPk/assets/04.png)

{% stepper %}
{% step %}

### Connection details

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/vn7G1GxtFg2a6dyezhAH/assets/05.png)

| Field             | What to enter                                                                       |
| ----------------- | ----------------------------------------------------------------------------------- |
| Connection Name   | A name for this connection. Required                                                |
| LDAP URL          | The directory address and port, for example `ldap://server:389`. Required           |
| Base DN           | Where in the directory tree to start, for example `dc=example,dc=com`. Required     |
| User DN (Bind DN) | The account SECUREpass binds as, for example `cn=admin,dc=example,dc=com`. Required |
| Password          | The bind password. Required                                                         |

Select **Test Connection**. Do not move on until it passes — everything after this depends on SECUREpass being able to reach and bind to the directory.
{% endstep %}

{% step %}

### Select organisational units

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/o6gqJtyzwVNzsZdCRg7X/assets/06.png)

Tick the OUs to sync users from. **Child OUs are included automatically**, so ticking a parent brings everything beneath it.

Select **Continue**.
{% endstep %}

{% step %}

### Map attributes

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/i8NFbvA4m7x25YQ70GBE/assets/07.png)

Each SECUREpass attribute — first name, last name, email, mobile number, username and the rest — is mapped to the directory attribute it should come from.

{% hint style="warning" %}
Check every row before saving. A wrong mapping here is not a cosmetic problem: it propagates to every user this connection imports, and correcting it afterwards means re-syncing and cleaning up the accounts already created.
{% endhint %}

Select **Add Connection**. The new connection appears in the connector's list.
{% endstep %}
{% endstepper %}

## A cloud connection — Azure AD

Directories and cloud identity providers use the same wizard with a different credential set. Azure AD is the common cloud case, and it is worth walking because it needs an app registration on the Azure side before anything can be done here.

Select **Azure AD** from the connector catalogue. Its connections list opens.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/nOrCbxMBhmkY6BMzfD40/assets/10.png)

Each row shows the connection name, its tenant and client IDs — masked, with only the first and last characters visible — who created and last modified it, when it last synced, and its status. Select **Add Connection**.

{% stepper %}
{% step %}

### Connection details

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/fqFLLyuiSRIQJeqjQIY1/assets/11.png)

| Field           | What to enter                                                 |
| --------------- | ------------------------------------------------------------- |
| Connection Name | A name for this connection. Required                          |
| Tenant ID       | The Azure AD tenant (directory) ID. Required                  |
| Client ID       | The application (client) ID of the app registration. Required |
| Client Secret   | That app registration's secret. Required                      |

All four come from the app registration in Azure. It needs Microsoft Graph permissions granted and consented before SECUREpass can read anything — without consent, the credentials are valid and the sync still returns nothing.
{% endstep %}

{% step %}

### Map attributes

Filling in the connection details reveals the **Attribute Mapping** section below them.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/2Lj8lnXGlGWIBaw07mQ6/assets/12.png)

Each SECUREpass IAM attribute is mapped to the directory attribute it should come from — first name to `givenName`, last name to `surname`, and so on down the list. Attributes you do not want to import are left as **Select Attribute**.

{% hint style="warning" %}
Check every row before continuing. A wrong mapping propagates to every user this connection imports, and correcting it afterwards means re-syncing and cleaning up accounts that have already been created.
{% endhint %}
{% endstep %}

{% step %}

### Test and save

Select **Test Connection**. A confirmation appears when SECUREpass can authenticate against the tenant.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/pP5HPoccBsybCMJhSurv/assets/13.png)

Do not continue until it passes. A failure here is the credentials or the Graph permissions, and neither gets better further along.

Select **Continue** to save. The connection is added and appears in the list, ready to sync.
{% endstep %}
{% endstepper %}

## The connections list

Each connector's list shows what has been configured against it.

| Column                           | Shows                                                        |
| -------------------------------- | ------------------------------------------------------------ |
| Name                             | The connection name                                          |
| Url / Access Key Id / equivalent | How the target is reached — this column differs by connector |
| Base DN, Region, or equivalent   | The scope of the connection                                  |
| Created By / Modified By         | Who set it up and who last changed it, with timestamps       |
| Last Synced                      | When data last came across. This is the column to watch      |
| Status                           | **ACTIVE** or inactive                                       |
| Actions                          | Edit, sync, or delete                                        |

## Syncing

Once a connection is saved, it can be synced. Select the sync action on the connection's row.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/uVAm5D33dz7OwpX2tgmA/assets/08.png)

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/gzGZkA7U1PYWTRzUNyPz/assets/09.png)

| Field         | What to choose                                                          |
| ------------- | ----------------------------------------------------------------------- |
| Recurrence    | **Yes** to repeat on a schedule, **No** for a one-off run               |
| Sync Type     | **Full** brings everything across; **Partial** brings only what changed |
| Date and Time | When the sync runs                                                      |

Select **Schedule**.

The sync runs in the background and you are notified by email when it completes.

{% hint style="info" %}
Use **Full** for the first sync of a new connection, and **Partial** on a recurrence. A full sync against a large directory is slow and there is no reason to repeat it nightly.
{% endhint %}

## Verifying the sync

Come back to the connector's connections list and check **Last Synced**. If it has not moved, the sync did not run or did not complete — check the email notification for the reason.

## Managing a connection

The actions on each row of a connections list are the same for every connector.

### Edit

The pencil icon reopens the connection.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/7fzrWvXu20qQ3h1gT4Zv/assets/14.png)

Connection details and attribute mapping can both be changed. **Test Connection** again after changing a credential, and remember that changing a mapping affects everything imported from the next sync onward, not what has already come across.

### Erase data or delete the connection

The bin icon offers two different things, and the difference matters.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/oByqQpAgfmpesTSdaD9S/assets/15.png)

| Action                | What it does                                                                                                           |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Erase Data**        | Removes the data this connection synced, but keeps the connection itself. Use it to clear a bad import and sync again. |
| **Delete Connection** | Removes the connection permanently and erases all its synced data.                                                     |

Erase Data is the recoverable one — the connection stays, so you can fix the mapping and re-sync. Delete Connection is not: the credentials, the mapping and the imported data all go, and setting it up again means going back to Azure for the client secret.

## Every other connector

Identity providers, SaaS applications, SIEM and data systems all follow the same path: select the connector, add a connection, fill in its credentials, test, map, save, sync.

What changes between them is the credential set on the connection form — an LDAP bind DN and password for a directory, an access key and region for AWS IAM, a token or client secret for a SaaS application.

The pattern is the same for every connector on the page. The two things worth being careful about are the attribute mapping, which is hard to unpick later, and the **Last Synced** column, which is the only evidence the connection is actually doing anything.