Create and edit directory credentials | PS Pathfinder

What is a directory credential?

A directory credential is a username and password (or other authentication data) that provides access to an account within a directory service, such as Microsoft Active Directory (AD), LDAP, or Azure AD.

How is it useful?

Directory credentials make it easier and safer to control who can access what within an organization, while enabling automation and compliance through integration with products like Password Safe.

A directory credential is required for querying Active Directory (AD), Entra ID, and LDAP. It is also required for adding AD, Entra ID, and LDAP groups and users in BeyondInsight. Follow the steps below for creating each type of directory credential.

Create a directory credential in Password Safe

1. At the top left of the page, click > Password Safe > Configuration.
   The Configurationpage displays.

2. Under Role Based Access, click Directory Credentials.

3. Click + Create New Directory Credential.

4. Select the Directory Type and follow the steps below that are applicable for that type.

   

Create an Active Directory credential

1. Select Active Directory for the Directory Type.
2. Provide a name for the credential.
3. Enter the name of the domain where the directory and user credentials reside.
4. Enable the Use SSL option to use a secure connection when accessing the directory.

5. Enter the credentials for the account that has permissions to query the directory.
6. Click Test Credential to ensure the credential can successfully authenticate with the domain or domain controller before saving the credential.
7. Click Create Credential.

Create an LDAP credential

1. Select LDAP for the Directory Type.
2. Provide a name for the credential.
3. Enter the name of the LDAP server where the directory and user credentials reside.
4. Enable the Use SSL option to use a secure connection when accessing the directory.

5. Enter the credentials for the account that has permissions to query the directory.
6. Click Test Credential to ensure the credential can successfully authenticate with the domain or domain controller before saving the credential.
7. Click Create Credential.

Create an Entra ID credential

1. Select Microsoft Entra ID for the Directory Type.
2. Select a credential scope: Public or US Government (supports Azure GCC High). The scope cannot be changed after the directory credential is created.
3. Provide a name for the credential.
4. Paste the Client ID, Tenant ID, and Client Secret that you copied when registering the application in your Entra ID tenant.

5. Click Test Credential to ensure the credential can successfully authenticate with the domain or domain controller before saving the credential.
6. Click Save Credential.

Edit a directory credential

1. At the top left of the page, click > Password Safe > Configuration.
   The Configurationpage displays.
2. Under Role Based Access, click Directory Credentials.
3. Locate the credential in the grid.
4. Click > Edit.
5. Make the changes required.

6. Click Test Credential to ensure the edited credential can successfully authenticate with the domain or domain controller before saving the credential.
7. Click Save Credential.

Sign in to Password Safe on Pathfinder

Pathfinder supports four kinds of Password Safe users:

• Local BeyondTrust accounts
• SAML users (such as Microsoft Entra ID)
• Active Directory users
• LDAP users

Each type signs in a little differently.

This topic shows administrators how to check the configuration, shows users how to sign in, and explains how to confirm a sign in in the audit logs.

How sign in works

Each user type signs in at a different place and enters different information.

Active Directory and LDAP users must use the AD/LDAP sign in URL. That URL includes your Org ID, which sends directory users to the correct Pathfinder instance. The standard sign in page does not work for them.

After a user signs in, their group roles and features control what they see in Password Safe.

Prerequisites

Make sure you have the following:

• You have a Pathfinder administrator account.
• Your SAML identity provider is already added in Pathfinder.
• The groups and users you want to give access to are already added in Password Safe, with the roles and features they need.

Part 1: Check the configuration (administrators)

Open Administration

1. Sign in to Pathfinder with your administrator account.

2. Select the tenant menu in the top right corner.

3. Select Administration.
   

   

Check your SAML provider

1. In Administration, click Identity & Authentication Providers.
   The SAML Providers page displays.
2. Find your provider in the list. Open the row menu and select Edit provider.
3. Review the settings. If you have set up SAML in Microsoft Entra ID before, these fields look familiar:
   • SAML single sign-on URL
   • Service provider entity ID
   • Identity provider entity ID
   • Identity provider sign-on URL
   • Signing certificate
4. Select Save Changes to keep your edits, or Discard to close the panel without saving.

Get the AD/LDAP sign-in URL

Directory users need this URL. Send it to them before they try to sign in.

1. In Administration, open the menu and select Directory Authentication.

2. Review the provider list. Each row shows the label, the type (Active Directory or LDAP), the domain or server, the proxy site, and the product.

3. In the AD/LDAP sign-in URL panel, select Copy link.

4. Share the link with your Active Directory and LDAP users. It looks like this:
   https://login.beyondtrust.io/signin?orgId=<your Org ID>
   

   

Check groups and users in Password Safe

1. Open the tenant menu and select your tenant to return to Pathfinder Home.
2. Select the Password Safe tile.
3. Select Configuration, then select User Management under Role Based Access.
4. On the Groups tab, confirm that your Active Directory, LDAP, and SAML groups appear. Directory groups use the format domain\group.
5. Select a group to review its roles and features. Or open the Users tab to see the users from those domains.

Part 2: Sign in (users)

Sign in with Entra ID (SAML)

1. Go to the standard Pathfinder login page at login.beyondtrust.io.
2. Enter your work email address and select Next.
3. Pathfinder sends you to the Microsoft sign-in page. Enter your Microsoft password and select Sign in.
4. If Microsoft asks whether to stay signed in, choose the option you prefer.
5. Pathfinder Home opens. Select the Password Safe tile.

To check which account you are using, select the profile icon in the top right corner. Pathfinder shows your Entra ID email address.

Sign in with Active Directory or LDAP

1. Open the AD/LDAP sign in URL your administrator sent you. Do not use the standard login page.

2. Enter your username in username@domain format. For example, [email protected].

3. Enter your directory password and select Sign in.

4. Pathfinder Home opens. Select the Password Safe tile.

5. Password Safe shows only the areas your groups give you permission to use.
   
   

   

To check which account you are using, select the profile icon. Pathfinder shows your directory username with your Org ID added to the end. For example, [email protected].<Org ID>.

Part 3: Check sign-ins in the audit logs (administrators)

Two logs record a Password Safe sign-in. Pathfinder Audit Logs record the sign-in to the platform. Password Safe User Audits record the sign-in to the product.

Pathfinder Audit Logs

1. Sign in as an administrator and open Administration.

2. Open the menu and select Audit Logs.

3. Filter by date, or search the User Email or Action columns.

4. Select the plus icon on a row to see more detail.
   

   

Each user type records a different action:

Password Safe User Audits

1. Select the Password Safe tile, then select Configuration.

2. Under General, select User Audits.

3. Find the Login entry for the user and select the information icon at the end of the row.

4. The Login Details panel shows the username, user type, and the group used for authentication.
   

   

These fields in Login Details are the most useful:

Troubleshooting

An Active Directory or LDAP user says their account is not recognized

This is the most common issue. Check these causes in order.

The sign-in page shows "Authentication service unavailable"

The outcome metadata shows ServiceUnavailable or ProxyUnavailable. The BeyondTrust Authentication API sends the credential check to the product instance through the configured proxy site, so both the proxy site and the Password Safe instance must be reachable. Check that they are online.

A directory user signs in but cannot find their organization or data

Compare the Org ID in the link the user opened with the Org ID in the top right corner of your Administration pages. They must match.

A user signs in but sees only some areas of Password Safe

Group roles control this. In User Management, confirm the user's group appears in the list and has the roles they need.

A directory user's sign-in does not appear as successful in Audit Logs

If you see service token minted and validate-credentials outcome but no User signed in using AD/LDAP directory authentication, the directory rejected the credentials. Expand the validate-credentials row for details, then ask the user to confirm their password with their IT team.

An Entra ID user cannot finish signing in at Microsoft

Compare the entity IDs, the sign-on URL, and the certificate in SAML Providers with the enterprise application in Microsoft Entra ID. They must match.

A directory user wants to reset their password

The user's own organization manages directory passwords. Send the user to their IT team.

Contact BeyondTrust Support

To help Support resolve your case faster, include:

• Your Org ID
• The user type: local, SAML, Active Directory, or LDAP
• The username exactly as the user entered it
• The time of the sign in attempt, in UTC
• The matching entries from Audit Logs