Connecting to Active Directory

Connect Active Directory so that AuthNull can sync your users and groups and enforce MFA on domain authentications. Connecting a directory has two steps: Connect Active Directory and Install DC Sensor.

Step 1 - Connect Active Directory

1. Use Switch product to select Identity, then open Identity Sources.
2. Click Add identity source and select Active Directory.
3. Fill in the form:

Field	Description
Display Name	A label for this directory in AuthNull.
Domain Name	The AD domain, for example authnull.lab. It must contain a dot and cannot contain @.
Base DN	Derived automatically from the domain. Click Edit to override it.
Enforcement Mode	Monitor - logs authentication events without blocking anything. Start here. Enforce - applies MFA verdicts; users may be blocked.
Fallback if Authnull is unreachable	Allow - logins continue without MFA during an outage (recommended). Deny - logins are refused during an outage.
Sync scope	All users by default. Use Narrow scope to limit the sync with Sync Filter — Groups (plain group names, no CN= prefix) and Sync Filter — OUs (each value must start with OU=).

4. Click Save & Continue.

tip

Start in Monitor mode. You can move a directory between Monitor and Enforce later without reinstalling the sensor.

Step 2 - Install the DC Sensor

The DC Sensor runs on each Domain Controller, asks AuthNull for a decision on every authentication and applies it.

1. Step 1 — Download files - click Download sensor.yml and Download install.ps1. Place both files in the same folder on the Domain Controller.

2. Step 2 — Run as Administrator on the DC - open PowerShell as Administrator, cd into the folder, then run:

   .\install.ps1

3. Step 3 — Verify - confirm the service is running before clicking Done:

   Get-Service AuthnullDCSensor

Repeat the installation on every Domain Controller.

Step 3 - Set up MFA for users

Once users have synced, they need a way to approve push requests:

• Users enrol in Duo Mobile or Okta Verify through your Duo or Okta organization (the provider is set under Settings → MFA Provider). Their email address there must match their synced AuthNull account.
• No device registration is needed in AuthNull. (The AuthNull Authenticator app is coming soon.)

Then create policies under Policies in the Identity product to decide which authentications require MFA. See Policy based access control.

Adding users without a directory

Users can also be added manually (Users → Add Users → Add User) or imported from a CSV or LDIF file (Users → Add Users → Import Users). These users have no relationship with a connected directory and must be maintained manually. See Importing users and How to Add Users.