How to synchronize users from Active Directory using Directory Sync

Last updated on September 9, 2026

Starting with Rublon Authentication Proxy 3.2.0, Directory Sync allows you to synchronize users from Active Directory (AD) with the Rublon Admin Console. You can run Directory Sync manually or automatically. Automatic synchronization runs every 12 hours at a randomly chosen time. Starting with version 3.11.0, Directory Sync can also detect changes in Active Directory and trigger additional full synchronizations when changes are detected. Your scheduled synchronization time is displayed in the Rublon Authentication Proxy log file.

Note that the Rublon Authentication Proxy can work as a Directory Sync feature alone. You do not need to configure the proxy server feature at all.

Note that the Directory Sync can be performed regardless of whether the Rublon Authentication Proxy is installed on Windows or Linux.

Prerequisites

You need to install the latest version of the Rublon Authentication Proxy. The Directory Sync feature is available starting from version 3.2.0.

Configuration

You can configure the Directory Sync feature by adding a new directory_sync section to your current Rublon Authentication Proxy configuration file. You will also need a configured auth_source of type “LDAP” so that Directory Sync knows where to fetch users from and a rublon section so that it knows where to send those users.

To run Directory Sync automatically, set enabled to true. Directory Sync will then perform a full synchronization every 12 hours.

Real-Time Active Directory Sync Configuration

Starting with Rublon Authentication Proxy 3.11.0, you can also use the following Active Directory-specific options:

• exclude_disabled_users: When set to true, Active Directory accounts that are disabled are skipped and are not sent to the Rublon Admin Console. When set to false (default), disabled users are synchronized with the Denied status.
• change_detection: When set to true, Directory Sync polls Active Directory for changes and triggers a full synchronization when a user is added or modified and, optionally, when a user is deleted. The default is false.
• detect_deletes: When change_detection is enabled, specifies whether Directory Sync also detects deleted users in CN=Deleted Objects. The access_user_dn account must have read/list access to CN=Deleted Objects. The default is true.

For the full list of Directory Sync configuration options, refer to the Rublon Authentication Proxy documentation.

Example Directory Sync Configuration

An example configuration (of just Directory Sync) may look like this:

directory_sync:
  enabled: true
  auth_source: EXAMPLE_AD
  source_type: ad
  change_detection: true
  detect_deletes: true
  group_dns:
    - cn=some-group,dc=example,dc=org
    - cn=some-group2,dc=example,dc=org
  user_alias1: mail
  user_alias2: userPrincipalName

auth_sources:
  - name: EXAMPLE_AD
    type: LDAP
    ip: localhost
    port: 636
    transport_type: ssl
    search_dn: dc=example,dc=org
    access_user_dn: cn=admin,dc=example,dc=org
    access_user_password: some-very-hard-password

rublon:
  api_server: https://core.rublon.net
  system_token: ABC
  secret_key: def

User Search, Group Membership, and Username Aliases

Keep in mind that users are first searched using the auth source’s search_dn and then a membership check is conducted to check if they belong to the groups specified in group_dns. This means that users might not be found even though the group exists, so make sure your search_dn is correct.

You can also synchronize Username Aliases from Active Directory by adding user_aliasX options to the directory_sync section, where X is a unique number from 1 to 9, for example user_alias1 or user_alias2. Each user_aliasX option should point to an Active Directory attribute whose value will be imported as a Username Alias for the synchronized user in the Rublon Admin Console. You can define multiple aliases as long as each uses a different number.

If you use Directory Sync together with Rublon MFA for Windows Logon and RDP, make sure the username format imported by Directory Sync matches the username format sent by Rublon MFA for Windows. This is especially important when choosing between sAMAccountName, userPrincipalName, and NTLM/down-level logon names. For detailed recommendations, refer to How to Choose the Username Format for Rublon MFA for Windows and Directory Sync.

Authentication Source Names and Multi-Domain Environments

Note that the authentication source name (such as EXAMPLE_AD in the preceding example) that will be used in the directory_sync section to specify which AD users will be synchronized with the Rublon Admin Console must be unique globally. So, if you have multiple Rublon Authentication Proxy instances, each using a different auth source for directory_sync, ensure each source has a unique name across your entire organization.

In multi-domain environments, also make sure the selected username attribute is unique across all synchronized domains. If different domains can contain users with the same short username, refer to How to Choose the Username Format for Rublon MFA for Windows and Directory Sync before choosing the username format.

For more information about the configuration of Directory Sync and Rublon Authentication Proxy, visit Rublon Authentication Proxy – Configuration.

Running Directory Sync

Manual

After creating/updating your configuration file, you are ready to run your synchronization:

Windows

1. Navigate to your Rublon Authentication Proxy installation directory (C:\Program Files\Rublon Auth Proxy on Windows).

2. Open the bin/ directory.

3. Double-click the rublon-directorysync.exe file to run your AD synchronization. In case of errors, follow the instructions written in the logs.

Linux

1. Navigate to your Rublon Authentication Proxy installation directory (rublonauthproxy/).

2. Open the bin/ directory.

3. Run the rublon-directorysync script to start your AD synchronization. In case of errors, follow the instructions written in the logs.

Automatic (scheduled sync)

Set the enabled option to true and run the Rublon Authentication Proxy. Directory Sync will perform a full synchronization automatically every 12 hours. The synchronization time is displayed in the logs.

For instructions on how to run the Rublon Authentication Proxy, click here.

Active Directory Change Detection

Starting with Rublon Authentication Proxy 3.11.0, Directory Sync can detect changes in Active Directory and trigger a full synchronization without waiting for the next scheduled synchronization.

To enable this feature, set change_detection to true in the directory_sync section. Directory Sync detects added and modified users. To also detect deleted users, keep detect_deletes set to true, which is the default.

Detecting deleted users requires the account specified in access_user_dn to have read/list access to CN=Deleted Objects. If the required access is not available, Directory Sync logs a warning and continues detecting additions and modifications. Deleted users are then removed during the next 12-hour scheduled synchronization.

The regular 12-hour scheduled synchronization continues to run when change detection is enabled.

Change detection does not apply when you run Directory Sync manually using rublon-directorysync.

Reviewing the Synchronization Result in the Rublon Admin Console

1. Sign in to the Rublon Admin Console.

2. Go to the Users tab.

3. Explore the user list, looking for users from Active Directory. Users synchronized from Active Directory will have a DS badge next to their usernames. You can also look for a specific user by entering their username in the search field and pressing Enter.

4. Clicking the link in the Username column will show the Edit User view with more information about the user, including the groups this user is a member of. Groups synchronized from the Active Directory will have a DS badge. You can browse and edit groups synchronized from AD in the Groups tab. Note that Username Aliases from Active Directory will also be synchronized if you configure user_aliasX attributes in the directory_sync section.

Troubleshooting

If you have a problem or question, refer to Active Directory Sync – FAQ first.

If your issue is related to username formats, Rublon MFA for Windows Logon and RDP, duplicate users, multi-domain Active Directory environments, or Username Normalization, refer to How to Choose the Username Format for Rublon MFA for Windows and Directory Sync.

If you encounter any issues not described in our FAQ, please contact Rublon Support.

Related Posts

Active Directory Sync – FAQ

Rublon Authentication Proxy – Documentation

Rublon Admin Console – Documentation

How to synchronize users from OpenLDAP using Directory Sync

How to synchronize users from Entra ID using Directory Sync

How to Choose the Username Format for Rublon MFA for Windows and Directory Sync