Directory authentication | Pathfinder

Overview

Pathfinder authenticates directory users through a connected BeyondTrust product instead of connecting directly to Active Directory or LDAP. The connected product acts as the proxy site: Pathfinder sends the credentials to the site through a Resource Broker, the site checks them against your directory, and it then returns the result.

These products can serve as the proxy site:

• Password Safe
• Privileged Remote Access
• Remote Support

You choose one proxy site and product for each directory provider you register.

Prerequisites

Before you begin, make sure you have:

• Administrator access to Pathfinder.
• The directory domain and any required connection details.
• A connected BeyondTrust product configured with an Active Directory or LDAP provider.
• A non-directory (local or SSO) admin account. AD/LDAP-authenticated admins can't configure a directory proxy. The proxy must exist before their accounts can sign in at all.

Register the directory provider

1. Log in to Pathfinder as an administrator.
2. From the tenant dropdown, select Administration.
3. Open the navigation menu and click Directory Authentication.

4. On the Directory Authentication page, you can add a new directory provider or edit an existing one.

5. When adding a provider, configure:

   • Label
   • Provider type
   • Domain or server
   • Proxy site
   • Product

Sign in with a directory account

Directory users sign in at your organization's sign-in URL, not the standard Pathfinder login page. The URL carries your organization ID, which routes the user to the right provider:

https://login.beyondtrust.io/signin/signIn?orgId=your-org-id

Replace your-org-id with your organization's ID. Your organization ID also appears at the top right of every Administration page.

Share this URL with your directory users before they try to sign in. At that URL, users enter:

• Their username in username@domain format, for example [email protected].
• Their directory password

Pathfinder creates Active Directory and LDAP accounts automatically the first time a user signs in. Invite users manually only if you want to set up their access before their first sign-in.

In Pathfinder, a directory account shows as username@domain.<Org ID>. The organization ID suffix is what makes the account a directory account.

The directory sign-in page has no Forgot password link. Directory users reset their passwords through their own organization's IT process.

Multi-factor authentication for directory users

Directory users can set up Pathfinder-native MFA on top of directory validation, the same way local users do.

• MFA is opt-in for each user. Users enroll from their own profiles after they sign in.
• Once a user enrolls, Pathfinder challenges them for a code at each sign-in.
• Pathfinder can't require MFA for any user type, so you can't mandate it for a group or for your organization.
• Pathfinder can't read MFA settings in the source product. Factors already set up there — TOTP, RADIUS, or Duo — are not migrated, reused, or reported. A directory user starts with no MFA in Pathfinder.

Verify a directory sign-in

Directory sign-ins appear in the Pathfinder audit log.

1. Sign in as an administrator and open Administration.
2. Open the navigation menu and select Audit Logs.
3. Filter by date, or search the User Email or Action columns.
4. Select the plus icon on a row to see the detail.

A successful directory sign-in records three events, in this order:

• AD/LDAP directory-auth service token minted
• AD/LDAP directory validate-credentials outcome
• User signed in using AD/LDAP directory authentication

If the first two events appear without the third, the directory rejected the credentials. Expand the validate-credentials row for the reason.

Troubleshoot directory sign-in