Ping Directory

Connect Ping Directory to Oleria to see the users and groups in your directory and, optionally, the directory access activity behind them. Oleria reads your directory through a read-only service account and an Oleria agent that you install on a Windows machine.

What Oleria discovers

Users - user entries in your Ping Directory.
Groups - static and dynamic groups, and group membership.
Organizational units and domain - your directory’s OU structure and base domain.
Permissions - access control instructions (ACIs) that grant users and groups access to directory entries.
Activity - directory access log events, forwarded to the Oleria PD Agent through Fluentd. Activity requires the log forwarder and Fluentd setup below.

Prerequisites

Admin access on the Oleria platform to add a new integration.
A Windows machine to install the Oleria PD agent on, and administrator permissions on it. The agent installs through a PowerShell script and runs as a Windows service.
Administrative access in Ping Directory to create a user.
If Ping Directory and the agent run on different machines, network access between them. Make sure no firewall rules block the connection.

Agent host requirements

The Oleria PD agent and its bundled Fluentd log collector run on the Windows machine you choose. Make sure that machine meets these requirements:

Requirement	Details
Operating system	Windows Server 2016 or later (2016, 2019, 2022, or 2025).
CPU architecture	64-bit (x64). The bundled Fluentd package is x64 only.
CPU and memory (recommended)	At least 2 CPUs and 8 GB of RAM.
Installation rights	Local administrator, to run the installer from an elevated PowerShell session. The agent then runs as a Windows service.
Outbound HTTPS (port 443)	Your Oleria API endpoint (`api.<your-tenant>.oleria.io`), Oleria authentication (`auth.prod.oleria.io`), and Amazon S3 regional endpoints (`.s3.<region>.amazonaws.com`, for example `.s3.us-west-2.amazonaws.com`), which the agent uses to download the installer and upgrades and to upload data. Contact us for the regions your tenant uses. Oleria never connects in to the agent from the internet.
Connection to Ping Directory	Your Ping Directory server on port `389` (`ldap://`) or `636` (`ldaps://`), matching the DomainUrl you enter during installation.
Activity (optional)	Inbound syslog from Ping Directory on UDP port `514`. Fluentd on the agent machine listens on this port for the log forwarder you configure below.

If you need to route the agent’s outbound traffic through a proxy, contact us at support@oleria.com before you install.

Create a service account in Ping Directory

This process involves creating an LDIF file to define the new service account and its permissions, then using the ldapmodify command to apply these changes to the directory.

Create the LDIF file

An LDIF (LDAP Data Interchange Format) file is a plain text file containing instructions for adding, deleting, or modifying entries in an LDAP directory. The file you’ll create, create_readonly_user.ldif, will:

Create the service account - a new user entry with UID readonlyoleriauser and common name Read Only User, using the inetOrgPerson object class.
Assign read-only access - an ACI (Access Control Instruction) granting the readonlyoleriauser account read and search permissions on all attributes within the entire directory subtree.

Replace <replace-with-your-base-dn> with your directory’s base distinguished name (for example, dc=example,dc=com) and <replace-with-a-secure-password> with a strong password for the service account.

# 1. Create the Service Account "readonlyoleriauser"
dn: uid=readonlyoleriauser,<replace-with-your-base-dn>
changetype: add
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
uid: readonlyoleriauser
cn: Read Only User
sn: User
userPassword: <replace-with-a-secure-password>

# 2. Assign Read-Only Access Control Instruction (ACI)
dn: <replace-with-your-base-dn>
changetype: modify
add: aci
aci: (target="ldap:///<replace-with-your-base-dn>")(targetattr="* || +")(targetscope="subtree")(version 3.0; acl "Read access for readonlyoleriauser"; allow (read,search) userdn="ldap:///uid=readonlyoleriauser,<replace-with-your-base-dn>";)

Execute the LDAP Modify command

After creating the LDIF file, use the ldapmodify command-line tool to apply the changes to your Ping Directory instance. Open a command prompt, navigate to the bat directory inside your Ping Directory installation, and run the following command as a single line:

ldapmodify -h <hostname> -p 636 --useSSL --trustAll -D "cn=Directory Manager" -w <password> -f <file-path>

<hostname> - the hostname or IP address of your Ping Directory server
"cn=Directory Manager" - the DN of the administrative user (the default administrative user)
<password> - the password for the administrative user
<file-path> - the path to the LDIF file you created

Configure the syslog-based log forwarder

This step uses the dsconfig command-line utility to configure a syslog-based log forwarder in Ping Directory. This forwards directory logs to a centralized log management system like Fluentd for monitoring and analysis. Open a command prompt, navigate to the Ping Directory installation’s bat directory, and run the following command as a single line. Replace <IP-ADDRESS-OF-AGENT-MACHINE> with the IP address of the machine where the agent is running.

dsconfig create-log-publisher --publisher-name "Fluentd Syslog Access Logger Remote" --type syslog-based-access --hostname localhost --port 389 --bindDN "cn=Directory Manager" --no-prompt --set enabled:true --set asynchronous:true --set auto-flush:true --set correlate-requests-and-results:true --set generify-message-strings-when-possible:true --set include-add-attribute-names:true --set include-connection-details-in-request-messages:true --set include-extended-search-request-details:true --set include-instance-name:true --set include-modify-attribute-names:true --set include-product-name:true --set include-replication-change-id:true --set include-request-controls:true --set include-request-details-in-intermediate-response-messages:true --set include-request-details-in-result-messages:true --set include-request-details-in-search-entry-messages:true --set include-request-details-in-search-reference-messages:true --set include-requester-dn:true --set include-requester-ip-address:true --set include-response-controls:true --set include-result-code-names:true --set include-search-entry-attribute-names:true --set include-startup-id:true --set include-thread-id:true --set log-assurance-completed:true --set log-client-certificates:true --set log-connects:true --set log-disconnects:true --set log-intermediate-responses:true --set log-requests:true --set log-results:true --set log-search-entries:true --set log-search-references:true --set log-security-negotiation:true --set suppress-internal-operations:true --set suppress-replication-operations:false --set server-host-name:<IP-ADDRESS-OF-AGENT-MACHINE> --set server-port:514 --set syslog-facility:1

Connect Ping Directory to Oleria

Open the integration

Name your agent

Provide a name for your agent and select Continue.

Oleria agent setup panel with the agent name field and Continue button

Copy the installation script

Oleria shows a PowerShell installation script. Copy it. You’ll run it on the Windows machine where you want to install the Oleria PD agent.

Oleria workspace showing PowerShell installation script for Ping Directory agent

Install the Oleria PD agent

Run the installation script

Sign in to the Windows machine, open PowerShell as an administrator, and run the script you copied in the previous section.

PowerShell terminal running Oleria Ping Directory agent installation script

Install Fluentd

The Fluentd installer opens. Accept the license terms and select Next.

Fluentd installer license agreement screen

Fluentd installer setup screen with the Next button

Follow any subsequent prompts to complete the installation.Before proceeding with the agent installation, update the Fluentd configuration file using the script below. This ensures environment variables are set correctly and logs are sent to the desired location.

####
## Fluentd Configuration File
####
<system>
  log_level debug
  <log>
    rotate_age 30
  </log>
</system>

#### SOURCES ####
<source>
  @type syslog
  port 514
  bind 0.0.0.0
  protocol_type udp
  tag ping.directory.access
</source>

#### OUTPUTS ####
<match ping.directory.access.**>
  @type file
  path "#{ENV['FLUENT_FILE_PATH']}/${tag}.logs_%Y%m%d%H%M%S.json"
  append true
  store_as json
  format json
  include_time_key true
  time_key time
  <buffer tag,time>
    @type file
    path "#{ENV['FLUENT_BUFFER_PATH']}"
    timekey "#{ENV['FLUENT_TIMEKEY']}"
    timekey_wait "#{ENV['FLUENT_TIMEKEY_WAIT']}"
    chunk_limit_size "#{ENV['FLUENT_CHUNK_LIMIT']}"
    timekey_use_utc "#{ENV['FLUENT_USE_UTC']}"
    flush_interval "#{ENV['FLUENT_FLUSH_INTERVAL']}"
    flush_at_shutdown "#{ENV['FLUENT_FLUSH_AT_SHUTDOWN']}"
  </buffer>
</match>

Install the Oleria PD agent

Accept the license terms and select Next.On the next page, provide the following:

Username - the bind DN of the service account you created, the dn from your LDIF file (for example, uid=readonlyoleriauser,dc=example,dc=com)
Password - the service account’s password
DomainName - your directory’s base DN, the same value you used for <replace-with-your-base-dn> (for example, dc=example,dc=com)
DomainUrl - the LDAP URL of your Ping Directory server, including the scheme (for example, ldaps://pd.example.com:636 or ldap://10.0.0.5:389)
Fluentd Path - the path where you installed Fluentd in the previous step
Enable Activity Logging - select this only if Fluentd is installed and you’ve entered its path in Fluentd Path

Select Next and follow the remaining prompts to finalize the installation.When the installation completes, the OleriaPingDirectoryConnectAgent service appears in the Windows services list.

Verify the integration

In your Oleria workspace, go to Integrations -> Connected -> Ping Directory and select View Details. The side panel shows the health status of the Oleria PD agent.

Oleria Connected tab with the Ping Directory View Details side pane showing agent health

Contact us

For questions about this integration, contact us at support@oleria.com.

Overview

Generic connectors

Identity providers

HR systems

Cloud infrastructure

Applications

Ticketing

Messaging

What Oleria discovers

Prerequisites

Agent host requirements

Create a service account in Ping Directory

Configure the syslog-based log forwarder

Connect Ping Directory to Oleria

Install the Oleria PD agent

Verify the integration

Contact us

​What Oleria discovers

​Prerequisites

​Agent host requirements

​Create a service account in Ping Directory

​Configure the syslog-based log forwarder

​Connect Ping Directory to Oleria

​Install the Oleria PD agent

​Verify the integration

​Contact us

What Oleria discovers

Prerequisites

Agent host requirements

Create a service account in Ping Directory

Configure the syslog-based log forwarder

Connect Ping Directory to Oleria

Install the Oleria PD agent

Verify the integration

Contact us