> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/getting-started-guide/lifecycle/install-ad-connector.md).

# Install the AD connector

Install the Active Directory PowerShell connector on Windows and connect it to OpenIAM.

**Goal:** the AD PowerShell connector v5 running as a Windows service, connected to OpenIAM's RabbitMQ, listening on the right queue.\
**Time:** 30–45 minutes.\
**Prerequisites:** Windows host from [Prepare your lab](/getting-started-guide/prepare-your-lab.md) (.NET 4.8, PowerShell 5.1, **RSAT AD module**, network to OpenIAM:5672 and to a DC); `connector_AD_v5.exe` downloaded and checksum-verified.

First, open the AMQP port on the **OpenIAM host** — the installer opened only 80/443:

{% code overflow="wrap" %}

```bash
sudo firewall-cmd --permanent --add-port=5672/tcp && sudo firewall-cmd --reload
```

{% endcode %}

Confirm reachability from the Windows host: `Test-NetConnection <openiam-host> -Port 5672` must show `TcpTestSucceeded : True`.

{% stepper %}
{% step %}
**Get the connector queue name from OpenIAM**

The AD PowerShell connector is pre-registered out of the box. In the Webconsole go to **Provisioning → Connectors**, open **AD Powershell CONNECTOR**, and copy the **Connector Queue** value. You may replace it with any unique alphanumeric string (no spaces) — but whatever is in this field must exactly match what you enter in the installer.

{% hint style="warning" %}
A mismatched queue name is the classic silent failure: the connector connects fine and simply never receives work.
{% endhint %}

<figure><img src="https://2965242200-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0uHWHRgcad6P03ehqgmX%2Fuploads%2Fgit-blob-1a34e95be32b1bb2074780846118c89feacc1ef1%2Fconnector-queue-webconsole.png?alt=media" alt="The Provisioning Connector form in the Webconsole, with the Connector Queue value that must match the queue the connector was installed with"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Run the installer**

Run `connector_AD_v5.exe` as an administrator on the Windows host. The wizard screens, in order:

1. **SQL CE check** — installs SQL Server Compact 4.0 SP1 automatically if missing (used for connector log records).

   <figure><img src="https://2965242200-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0uHWHRgcad6P03ehqgmX%2Fuploads%2Fgit-blob-76c586052b6c48a8f47e70a8a8241924f68082de%2Finstaller-1-install.png?alt=media" alt="The first screen of the AD connector installer, offering Install and Close"><figcaption></figcaption></figure>
2. **Install directory** — default `C:\Connectors\<ConnectorName>`. Accept it.

   <figure><img src="https://2965242200-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0uHWHRgcad6P03ehqgmX%2Fuploads%2Fgit-blob-3ebe42107d1267473ae3d8647a792b859dd43ef4%2Finstaller-2-directory.png?alt=media" alt="The installer Destination Folder screen with the default path C:\Connectors\ADConnector"><figcaption></figcaption></figure>
3. **Log settings** — enable debug mode for the POC (you'll want the detail), and leave "Remove old logs" rotation on.

   <figure><img src="https://2965242200-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0uHWHRgcad6P03ehqgmX%2Fuploads%2Fgit-blob-4498c385ee986ece10352271e6e2bd1a689d9438%2Finstaller-3-logs.png?alt=media" alt="The installer Debug and test connection parameters screen, with Remove old logs and the end-to-end connection test both ticked"><figcaption></figcaption></figure>
4. **Connector configuration (RabbitMQ):**

   <figure><img src="https://2965242200-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0uHWHRgcad6P03ehqgmX%2Fuploads%2Fgit-blob-0ef8958c06bf3c622015acd5a966cf741c9af8d0%2Finstaller-4-rabbitmq.png?alt=media" alt="The installer Connector Configuration screen with the RabbitMQ host, username, queue, port 5672 and virtual host openiam_connector — the username and queue shown as placeholders, the password masked"><figcaption></figcaption></figure>

   | Field          | Value                                                                                                                                                |
   | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Connector Name | `ADPOC` (your worksheet value; no whitespace — it becomes part of the service name)                                                                  |
   | RabbitMQ Host  | your OpenIAM host DNS name                                                                                                                           |
   | Port           | `5672` (default)                                                                                                                                     |
   | Virtual host   | `openiam_connector` (default)                                                                                                                        |
   | Username       | `openiam`                                                                                                                                            |
   | Password       | the **current** RabbitMQ password — `passwd00` unless you changed it in [Verify health and log in](/getting-started-guide/verify-and-first-login.md) |
   | Queue          | the **Connector Queue** value from step 1                                                                                                            |
   | Use TLS        | **off** for this POC (see the TLS note below)                                                                                                        |
5. **Test connection** — validates host, port, and credentials (it does **not** validate the queue name — that's why step 1 matters).
6. **Install.**

   <figure><img src="https://2965242200-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0uHWHRgcad6P03ehqgmX%2Fuploads%2Fgit-blob-b7d366c661dc2ff7aa2bb1ec9dd09add658f9ad1%2Finstaller-5-finish.png?alt=media" alt="The installer Ready to install screen, with the Install button that begins the installation"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Verify the service and queues**

On the Windows host:

{% code overflow="wrap" %}

```powershell
Get-Service OpenIAM*
# Expect: OpenIAMADConnector<Name> and OpenIAMLogService<Name>, both Running
```

{% endcode %}

On the OpenIAM host, check the RabbitMQ management UI (user `openiam`) and confirm two quorum queues exist on vhost `openiam_connector`: `<Queue>_Request` and `<Queue>_Response`, with the request queue showing a consumer. Port **15672 is not opened in the firewall by the installer** — reach it with an SSH tunnel rather than exposing it:

{% code overflow="wrap" %}

```bash
ssh -L 15672:localhost:15672 root@<openiam-host>   # then browse http://localhost:15672
```

{% endcode %}

The connector's settings live in `C:\Connectors\<Name>\Connector.config` (RabbitMQ credentials are stored encrypted). Logs are in the installation folder; debug level and rotation are what you chose in step 2.
{% endstep %}
{% endstepper %}

## A note on TLS and queue types

* **TLS:** this POC uses plain AMQP on 5672 inside an isolated lab. For production: enable TLS on RabbitMQ (port 5671), set `IsTLSEnabled` to `true` in `Connector.config`, and ensure the broker's certificate chains to a CA the **Windows certificate store** trusts, with the RabbitMQ Host field matching the certificate's DNS name exactly (an IP address will fail validation). The connector supports TLS 1.2/1.3 and uses standard Windows trust — for self-signed certs, import the certificate into the machine's trusted store first. The installer's "Production instance" mode forces TLS on.
* **Queue type:** the connector defaults to **quorum** queues, which is correct for 2026.7.1 and required for HA/production. Only servers older than 4.2.1.9 — a legacy 4.x-series release; every 2026.x release is newer — need `classic` (edit `QueueType` in `Connector.config`; not applicable here).

## If it failed

| Symptom                                    | Likely cause                                                                                                           |
| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- |
| Installer blocks at start                  | .NET Framework 4.8 missing                                                                                             |
| Test connection fails                      | Wrong password (stack default `passwd00` unless changed), 5672 not opened in firewalld (command above), or wrong vhost |
| Service runs, but operations never execute | Queue name mismatch with **Provisioning → Connectors** — fix one side to match the other                               |
| Errors mentioning ActiveDirectory module   | RSAT missing: `Install-WindowsFeature RSAT-AD-PowerShell`, restart the service                                         |

## You know this worked when…

{% hint style="success" %}
Both Windows services are running and the `_Request` queue on vhost `openiam_connector` shows one consumer.
{% endhint %}

Next: [Connect OpenIAM to Active Directory](/getting-started-guide/lifecycle/connect-to-ad.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/getting-started-guide/lifecycle/install-ad-connector.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.