Active Directory Integration

With PolicyStat, you can integrate with your organization’s existing Active Directory (AD) infrastructure, simplifying user and group management for your site administrators.
A PolicyStat site can integrate with one Active Directory server at a time.

What AD Integration Provides

Active Directory integration offers four primary benefits:

1. AD Username and Password Login

Users log in to PolicyStat using their existing AD usernames and passwords.

2. User Provisioning

User accounts that are created, updated, or deleted in AD automatically have those actions mirrored in PolicyStat.

3. User Group Synchronization

Email distribution groups (Exchange/Outlook groups) are mirrored as User Groups in PolicyStat.
These can be used for assigning policy acknowledgments or collaboration.

4. Password Policy Enforcement

All passwords are managed through your existing AD infrastructure.
Any password complexity, expiration, or reuse rules are automatically enforced by AD.
PolicyStat does not store or process user passwords.

What AD Integration Does Not Provide

AD integration does not synchronize permissions. Permissions must still be managed within PolicyStat through the User Management screen.

Most users will have read-only access to approved, active policies.
Only a small subset of users—typically editors, approvers, and administrators—will require elevated permissions.

Because PolicyStat’s permission structure does not directly align with AD security groups, attempting to manage permissions in AD can complicate setup and maintenance.

Connectivity Option

PolicyStat now supports a single, secure connectivity method for AD integration:

Secure Lightweight Directory Access Protocol (LDAPS)

With LDAPS, your IT department provides an LDAP account with read-only access to your user directory and exposes an SSL-secured LDAP port to each of PolicyStat’s six IP addresses.

This connection is encrypted using your organization’s SSL certificate.
A self-signed certificate may be used if preferred.

LDAPS is the fastest and most secure option for organizations that already use LDAP over SSL for other applications.

FAQ

Do we need to perform AD integration before go-live?

No. You can integrate with AD at any point.
If manually created PolicyStat usernames match AD usernames, there’s no additional work required.
Even if they differ, our merge utility makes alignment simple.
We recommend using AD usernames from the start to minimize confusion later.

What types of groups are synchronized?

PolicyStat syncs email distribution groups (Exchange/Outlook).
These are typically department mailing lists such as “Human Resources.”
The LDAP filter for groups can be customized by your IT department if needed.

Does PolicyStat support SSO?

Yes. PolicyStat supports SAML 2.0 Single Sign-On (SSO).
AD integration and SSO can be used together or separately.
AD handles provisioning and deactivation, while SSO handles authentication.
Using both provides the best experience and management control.

When does synchronization occur?

PolicyStat automatically syncs users and groups every evening at 8:12 PM Eastern Time.
Site administrators can also perform manual syncs on demand through the User Management screen.

Does PolicyStat store user passwords?

No. PolicyStat never stores or logs password information.
Authentication requests are securely forwarded to your LDAP server in real time.

What happens if our LDAP service is unavailable?

If your LDAP service becomes unavailable, staff will continue to have read-only access to approved documents via the guest access link.
You can also temporarily disable AD integration and use the Forgot Password feature to set temporary passwords until service is restored.

Technical Integration Details

Overview

We recommend completing your integration setup first in your sandboxed training PolicyStat instance.
Once you’ve verified a successful configuration, you can replicate those settings to your production site.

Integration process:

Enable LDAPS connectivity
Test LDAPS connectivity
Create a PolicyStat LDAP synchronization account
Configure LDAP options
Copy verified configuration to production

Tip:
Do not check Enable Active Directory Integration on your production site until you’ve fully validated the setup in your training environment.

Enable LDAPS Connectivity

To enable LDAPS, follow these steps:

1. Enable LDAPS on your LDAP endpoint

In most environments, LDAPS can be enabled on your domain controllers.
Consult your vendor or Microsoft documentation for details.
A self-signed certificate is sufficient.

2. Configure firewall rules

Allow inbound traffic on TCP port 636 from each of PolicyStat’s six IP addresses to your LDAP endpoint.

3. Disable insecure LDAP

We recommend disabling port 389 to prevent accidental non-secure LDAP connections.

4. (Optional) Use a Read-Only Domain Controller (RODC)

Using an RODC for LDAPS provides added security by allowing read-only queries and filtering out sensitive attributes.

Test LDAPS Connectivity

Once LDAPS is configured, test connectivity through your training PolicyStat instance.

Log in to your training site using the provided administrator account.
Navigate to Admin → Configuration → Active Directory.
Enter your Server URI (for example: ldaps://ldap.yourorg.com:636).
Click Test This Configuration to verify the connection.

If successful, proceed to the next step.

Troubleshooting Tip:
If the test fails, verify that your firewall allows inbound LDAPS connections and that your server’s certificate is valid.

Create a PolicyStat LDAP Synchronization Account

All integrations require a Bind DN account with read-only access to your AD user tree.
This service account allows PolicyStat to query user and group data.

Important:
Exclude this account from password rotation policies to prevent sync interruptions.

To test:

Enter the Bind DN and password on the Active Directory Configuration page.
Click Test This Configuration to verify authentication.

Configure LDAP Options

Once connectivity is verified, configure your synchronization settings:

1. Define User Search Criteria

Specify the User Search DN to identify which users to synchronize.
Example:
OU=HOSPITAL,DC=MY-HOSPITAL,DC=ORG

2. Define User Attributes

Map AD attributes to PolicyStat fields (e.g., givenName, sn, mail, title).

3. Optionally Define Group Search Criteria

If you choose to sync groups, specify the Group Search DN.
Only distribution or mail-enabled groups can be synchronized.
Security and dynamic groups are not supported.

Filtering Users

PolicyStat provides two filtering options:

Filter by Organizational Unit (OU)

Limit synchronization to users within a specific OU by setting your User Search DN to that OU’s distinguished name.

Filter by Attribute

Use an LDAP filter to include only users meeting certain criteria (for example, memberOf or a custom attribute).

Example:

Filter Attribute: memberOf
Filter Value: CN=GRP-POLICYSTAT\2cOU=Groups\2cDC=myorg\2cDC=com

PolicyStat IP Addresses

Allow LDAPS traffic (TCP 636) from the following PolicyStat IPs:

Sandboxed/Training Environment

174.129.226.255
174.129.250.147

Production/Live Environment

184.72.224.151
184.72.224.167

Beta Environment

184.72.236.214
184.72.237.166

Sandboxed Training Instance

Your training instance is completely separated from production, allowing safe testing of AD connectivity and sync configuration.

Data is refreshed from production every other Sunday, so treat the training environment as temporary.

If you experience login issues or need a password reset, contact RLDatix Support at
877-201-4847 and include the training site URL.

LDAP Configuration Reference

Setting	Description	Example
Server URI	URL of your LDAP server	`ldaps://ldap1.example.com:636`
Bind DN	LDAP credential used for synchronization	`CN=policystat,OU=Service Accounts,DC=myorg,DC=com`
User ID Attribute	Attribute used for username	`userPrincipalName`
User First Name	AD attribute for first name	`givenName`
User Last Name	AD attribute for last name	`sn`
Email Attribute	AD attribute for email	`mail`
Title Attribute	Optional; maps job title	`title`
Filter Attribute/Value	Filters users included in sync	`(department=Human Resources)`
Validate LDAPS SSL Certificate	Recommended to prevent spoofing	Enabled
Certificate Authority Public Certificate	Required if using self-signed cert	N/A
Group Search DN	Directory path for groups	`OU=Groups,DC=myorg,DC=com`