​

Active Directory Integration

Integrate SafeSquid with Active Directory (AD) to enable centralized user management, group-based access policies, and seamless Single Sign-On (SSO) for domain-joined users.

​

Problem statement

Large Windows environments need proxy policy and reporting tied to Active Directory identities and groups. Without that linkage, audit evidence degrades into IP addresses and generic browsing records.

​

Active Directory Integration Workflow

​

Which AD authentication method to use?

:::tip Recommendation Most enterprises use SSO Authentication for corporate domain-joined workstations to provide the best user experience, and Simple Authentication as a fallback for guest or non-domain devices. :::

​

Critical dependencies

Active Directory integration depends on:

• directory reachability
• correct DNS
• correct time synchronization for Kerberos
• correct client assumptions for domain-joined and non-domain devices

If DNS or NTP is wrong, AD authentication can fail even when the proxy itself is healthy.

​

Verification

After completing the integration:

1. Fetch Entries: Verify that AD users and groups appear in the SafeSquid LDAP Entities section.
2. Test Rule: Create an access rule that requires AD authentication.
3. Log Check: Confirm identity.log shows the correct AD username in DOMAIN\user or UPN format.

​

Troubleshooting

Symptom: Domain users still see browser prompts.
Likely cause: Kerberos SSO prerequisites are not satisfied, or the device is not eligible for transparent auth.
Isolation: Check DNS, NTP, and domain-join assumptions.
Remediation: Fix the dependency or use the simple-auth path for that device class.
Retest: Retry the same flow and confirm transparent or expected authentication behavior. Symptom: Users authenticate but group-based policy does not apply.
Likely cause: Group retrieval or rule mapping is incomplete.
Isolation: Confirm group visibility in SafeSquid and compare rule matching.
Remediation: Refresh directory entities and correct the rule scope.
Retest: Compare users from different AD groups against the same policy target.

​

Source register

​

Next steps

• Start with Setup Active Directory Integration to establish the initial connection.
• Configure Access Restriction to apply policies based on AD groups.