Keycyte PAM 3.2 · Administrator Guide

Syncing Domain Users

Domain users do not have to be created one by one. Keycyte PAM keeps them in step with the directory in two ways: users are created automatically at their first sign-in, and Synchronize Users refreshes the stored data of existing domain users.

Before you begin, make sure that the LDAP or Active Directory connection for each domain is configured in Settings > Authentication. See Authentication Settings.

Automatic Creation at First Sign-In

When a domain user signs in for the first time and has no Keycyte PAM account yet, Keycyte PAM checks the directory. The account is created automatically, with the USER role, if:

• the user is authorized directly in a server role or password role, or
• a group that the user belongs to is authorized in a server role or password role.

Otherwise, the sign-in is refused. Entra ID users are created the same way, based on their Entra ID groups.

To let a whole department sign in, authorize its directory group in a role. See Server Roles.

Keycyte PAM identifies a domain user by user name and domain, and by the security identifier (SID) of the directory object. If a user is renamed in Active Directory, the existing Keycyte PAM account is updated at the next sign-in instead of a new account being created.

Synchronizing Domain Users

Group memberships decide which roles apply to a domain user. Keycyte PAM stores the groups of each domain user and refreshes them at each sign-in. Synchronize Users refreshes them for all domain users at once, for example after you changed group memberships in Active Directory.

To synchronize domain users:

1. Select Users in the menu.
2. Click Synchronize Users (refresh icon) in the toolbar.

For each domain user, Keycyte PAM connects to the directory of the user’s domain, looks up the user and:

• replaces the stored group memberships with the user’s current groups,
• updates the user name if it was changed in the directory.

Synchronization does not create new users and does not delete users that were removed from the directory. Users whose domain has no directory configuration, or who are not found in the directory, are skipped.

You need the Add permission for Users to synchronize.