Pinned LDAPS
Require port 636 and constant-time SHA-256 server-certificate pin validation.
Protect privileged directory changes with exact-action runtime authorization.
2AYE now registers certificate-pinned LDAPS connectors, confines changes to a configured base DN, prepares privacy-preserving exact-change fingerprints, consumes a single-use runtime authorization before LDAP execution, and records success or failure receipts.
- Pinned LDAPS
- Directory boundary
- Exact change authority
What you can evaluate
Runtime-enforced Active Directory group and account control through guarded APIs.
Directory boundary
Refuse target or member distinguished names outside the configured base DN.
Exact change authority
Bind add member, remove member, or disable account to the agent, environment, connector, and hashed exact target.
Connector enforcement
Redeem once before LDAP and record an execution receipt; replay and parameter substitution never reach the adapter.
Follow Active Directory defense from identity to evidence.
Each consequential action moves through the same six control points. See where 2AYE evaluates authority, requests human review, and preserves the outcome.
- 01IdentityWho or what is acting
- 02IntentSigned purpose and limits
- 03PolicyDeterministic evaluation
- 04ApprovalA named human when required
- 05ExecutionSingle-use grant, redeemed at the resource
- 06EvidenceReceipt joined to the audit chain
A practical adoption path
Start with one consequential workflow. Prove the boundary before expanding.
Scope
Identify tenant, identities, resources, and policy inputs.
Configure
Create the required records and immutable policy versions.
Enforce
Reject missing, stale, cross-tenant, or insufficient authority.
Review
Inspect audit evidence and improve the control.
What this includes
- Certificate-pinned LDAPS connector limited to its base DN
- Exact-change grants consumed before the directory change
- Execution receipts