Keycyte PAM 3.2 · Deployment Guide
Connecting Directory Services
Keycyte PAM can authenticate users against your existing directories instead of, or in addition to, local accounts. You configure the connections on Settings > Authentication in the Admin Panel:
| Card | Purpose |
|---|---|
| LDAP Configuration | LDAP or Active Directory servers for domain user sign-in, user and group lookup, synchronization and discovery. Also used by password rotation for Active Directory accounts. |
| RADIUS Configuration | An external RADIUS server for RADIUS user sign-in. |
| Entra ID Configuration | Microsoft Entra ID for sign-in with a Microsoft account. |
For a description of every field and for the user synchronization options, see the Administrator Guide, section Settings > Authentication.
Note
Settings > Authentication configures the directories that Keycyte PAM uses as a client. The RADIUS and TACACS+ servers that Keycyte PAM itself provides to network devices are configured on Settings > Radius Server and Settings > TACACS+ Server.
Deployment Prerequisites
Before you configure a directory connection, check the following:
- Network. The Keycyte PAM host can reach the LDAP servers (usually port 389 for LDAP with StartTLS, or 636 for LDAPS) and, if used, the RADIUS server and Microsoft Entra ID. See Network Ports.
- DNS. The DNS servers you set during installation resolve the names of the domain controllers.
- LDAP certificates. The PAM server and the Password Manager verify LDAP server certificates against the CA certificates in
cacerts.pemand the system CA store. You can also add certificates from the Admin Panel: the LDAP certificate dialog offers Auto Discovery (reads the certificate from the server) and Manual Upload. See Certificates. - Service account. A directory account that Keycyte PAM can use to search users and groups. For password rotation of Active Directory accounts, the account needs the rights to reset passwords.