> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Active Directory/LDAP SSO Troubleshooting

> Common questions and issues when configuring Active Directory/LDAP as your SSO provider for Connect AI, with suggested solutions.

<Note>
  Connect AI uses Auth0 as its managed identity broker. Active Directory/LDAP connections rely on the Auth0 AD/LDAP Connector, an on-premises agent that bridges your directory to the broker. CData installs and operates this connector on the broker side. Most of the diagnostics below are therefore handled by CData rather than configured by you. The one task on your side is making sure CData can reach your directory.
</Note>

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="What do I need to provide to enable Active Directory/LDAP SSO?">
    CData runs the AD/LDAP connector on the broker side, so you do not install or configure any software yourself. When SSO is provisioned, you do need to supply CData with the details needed to reach your directory: the host and port, a service (bind) account, and any firewall or VPN allowances. Contact [CData Support](https://www.cdata.com/support/submit.aspx) to coordinate this.
  </Accordion>

  <Accordion title="Can I limit which users are allowed to sign in?">
    Yes. Restrict access within your directory by scoping the relevant users, groups, or organizational units. Any additional filtering at the broker is configured by CData; contact [CData Support](https://www.cdata.com/support/submit.aspx) if you need it.
  </Accordion>
</AccordionGroup>

## Common Errors

<AccordionGroup>
  <Accordion title="Sign-in fails and the directory cannot be reached.">
    Connectivity is the one area you can check directly. Confirm that the connector host CData operates is allowed to reach your LDAP server: verify firewall rules, VPN routes, and that the LDAP port is open. If your network is correctly open and sign-in still fails, contact [CData Support](https://www.cdata.com/support/submit.aspx) so they can run the connector diagnostics.
  </Accordion>

  <Accordion title="Authentication fails even though the directory is reachable.">
    The remaining causes are on the broker side that CData manages, including:

    * Clock drift between the connector host and the broker.
    * A missing certificate in the connector's trust store.
    * Insufficient privileges on the service (bind) account.
    * Proxy settings on the connector host.

    Contact [CData Support](https://www.cdata.com/support/submit.aspx) to investigate these.
  </Accordion>
</AccordionGroup>

To enable SSO for your account or for additional help, contact [CData Support](https://www.cdata.com/support/submit.aspx).