n8n-nodes-ad-admin

✨ Features

👥 User Management

• ✅ Create users with complete configuration
• ✅ Enable/Disable user accounts
• ✅ Reset Password with LDAPS security
• ✅ Set Attributes with dynamic dropdown selection
• ✅ Get User with all properties and account flags
• ✅ List Users with advanced filtering
• ✅ Find by sAMAccountName for quick searches
• ✅ Get User Groups with nested group detection
• ✅ Get User Activity (last login, password info)
• ✅ Unlock Account for locked users
• ✅ Check Password Expiry with policy detection

👬 Group Management

• ✅ Create security or distribution groups
• ✅ Get group details with member list
• ✅ List groups with type and scope filters
• ✅ Modify group attributes
• ✅ Delete groups
• ✅ Add Member to groups
• ✅ Remove Member from groups
• 🎯 Group Types: Security / Distribution
• 🎯 Group Scopes: Global / Domain Local / Universal

🗂️ Organizational Unit Management

• ✅ Create new OUs
• ✅ Get OU details
• ✅ List OUs with search filters
• ✅ Modify OU attributes
• ✅ Delete OUs

🎯 Advanced Features

• 🔐 Full LDAPS Support with custom certificates
• 🔍 Dynamic Dropdowns for groups, OUs, and attributes
• ⚡ Smart Attribute Selection - No more manual typing!
• 📊 Detailed Activity Tracking - Login times, password changes
• 🔒 Certificate Validation - System CA, skip, or custom certificate
• 🌐 DNS & IP Support - Flexible connection options
• ⚙️ Comprehensive Error Handling - Clear messages and reconnection logic

📦 Installation

Method 1: Via n8n Community Nodes (Recommended)

1. Open your n8n instance
2. Go to Settings → Community Nodes
3. Click Install
4. Enter package name: n8n-nodes-ad-admin
5. Click Install

Coming soon: Screenshot showing Settings → Community Nodes

Coming soon: Screenshot showing package installation

Method 2: Via npm

# For n8n installed globally
npm install -g n8n-nodes-ad-admin

# For n8n in a specific directory
cd /path/to/n8n
npm install n8n-nodes-ad-admin

# Restart n8n after installation

Method 3: Docker

# Add to your n8n Dockerfile
FROM n8nio/n8n
RUN npm install -g n8n-nodes-ad-admin

Or using docker-compose:

version: '3'
services:
  n8n:
    image: n8nio/n8n
    environment:
      - N8N_COMMUNITY_PACKAGES=n8n-nodes-ad-admin
    # ... rest of your config

⚙️ Configuration

Prerequisites

• Active Directory Domain Controller with LDAP/LDAPS enabled
• Service Account with appropriate permissions:
  • Create/modify/delete users
  • Create/modify/delete groups
  • Create/modify/delete OUs
  • Reset passwords
  • Manage group membership

Connection Modes

This node supports two connection modes:

🔗 Direct Mode (Default)

Connect directly from n8n to your Active Directory server using LDAP/LDAPS protocol.

Best for:

• On-premises n8n installations
• Direct network access to domain controllers
• Small to medium deployments

🐳 Collector Mode (Docker)

Use the official AD Collector Docker container as an API gateway to your Active Directory.

Best for:

• Cloud-hosted n8n instances
• Enterprise environments with network restrictions
• Multi-tenant deployments
• Better security isolation

📦 Docker Collector Links:

• Docker Hub: fuskerrs97/ad-collector-n8n
• GitHub: docker-ad-collector-n8n
• Full Documentation: COLLECTOR.md

Quick Start with Collector:

docker run -d \
  --name ad-collector \
  -e LDAP_URL=ldaps://dc.example.com:636 \
  -e LDAP_BASE_DN=DC=example,DC=com \
  -e LDAP_BIND_DN=CN=n8n-service,CN=Users,DC=example,DC=com \
  -e LDAP_BIND_PASSWORD=YourSecurePassword \
  -e LDAP_TLS_VERIFY=false \
  -p 8443:8443 \
  --restart unless-stopped \
  fuskerrs97/ad-collector-n8n:latest

See COLLECTOR.md for complete Collector Mode documentation.

Creating Credentials (Direct Mode)

1. In n8n, go to Credentials → New → Active Directory API
2. Configure the following:

TLS Certificate Options

• System CA Bundle: Use system-trusted certificates (default, recommended)
• Skip Validation: ⚠️ Ignore certificate errors (self-signed only, NOT for production)
• Custom Certificate: Provide your own Root CA certificate in PEM format

Example custom certificate:

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIQPTxrAJiCX4pIRFX3zmhqoDANBgkqhkiG...
-----END CERTIFICATE-----

📚 Operations Guide

User Operations

{
  "resource": "user",
  "operation": "create",
  "cn": "John Doe",
  "parentOuDn": "OU=Users,DC=example,DC=com",
  "samAccountName": "jdoe",
  "upn": "john.doe@example.com",
  "initialPassword": "TempPass123!",
  "pwdMustChange": true,
  "enableImmediately": true
}

{
  "success": true,
  "dn": "CN=John Doe,OU=Users,DC=example,DC=com",
  "sAMAccountName": "jdoe",
  "enabled": true,
  "mustChangePassword": true
}

{
  "resource": "user",
  "operation": "getUser",
  "getUserSAM": "jdoe",
  "includeAllProperties": true
}

{
  "resource": "user",
  "operation": "listUsers",
  "filterType": "contains",
  "searchValue": "john",
  "searchField": "displayName",
  "maxResults": 50
}

{
  "resource": "user",
  "operation": "getUserGroups",
  "getUserGroupsSAM": "jdoe",
  "includeNested": true,
  "groupDetails": "full"
}

{
  "groups": [
    {
      "name": "IT Staff",
      "distinguishedName": "CN=IT Staff,OU=Groups,DC=example,DC=com",
      "description": "IT Department",
      "inherited": false
    },
    {
      "name": "Domain Users",
      "distinguishedName": "CN=Domain Users,CN=Users,DC=example,DC=com",
      "inherited": true
    }
  ]
}

{
  "resource": "user",
  "operation": "getUserActivity",
  "getUserActivitySAM": "jdoe",
  "activityType": "all"
}

{
  "loginInfo": {
    "lastLogon": "2025-01-28T14:30:00.000Z",
    "lastLogonTimestamp": "2025-01-28T14:30:00.000Z",
    "logonCount": 42,
    "badPasswordCount": 0,
    "isLockedOut": false
  },
  "passwordInfo": {
    "passwordLastSet": "2025-01-15T09:00:00.000Z",
    "mustChangePassword": false,
    "passwordNeverExpires": false
  },
  "accountInfo": {
    "whenCreated": "2024-12-01T10:00:00.000Z",
    "whenChanged": "2025-01-28T14:30:00.000Z",
    "isEnabled": true
  }
}

{
  "resource": "user",
  "operation": "unlockAccount",
  "unlockAccountSAM": "jdoe"
}

{
  "wasLocked": true,
  "unlocked": true,
  "message": "Account unlocked successfully"
}

{
  "resource": "user",
  "operation": "checkPasswordExpiry",
  "checkPasswordExpirySAM": "jdoe"
}

{
  "passwordNeverExpires": false,
  "mustChangePassword": false,
  "expired": false,
  "daysUntilExpiry": 45,
  "expiryDate": "2025-03-15T09:00:00.000Z",
  "message": "Password expires in 45 day(s)"
}

{
  "resource": "user",
  "operation": "setAttributes",
  "dn": "CN=John Doe,OU=Users,DC=example,DC=com",
  "attributes": [
    {
      "name": "title",
      "values": ["Senior Developer"],
      "op": "replace"
    },
    {
      "name": "department",
      "values": ["IT"],
      "op": "replace"
    }
  ]
}

Group Operations

{
  "resource": "group",
  "operation": "create",
  "groupName": "IT Staff",
  "groupParentDn": "OU=Groups,DC=example,DC=com",
  "groupType": "security",
  "groupScope": "global",
  "groupDescription": "IT Department Staff",
  "groupSamAccountName": "IT-Staff"
}

{
  "success": true,
  "dn": "CN=IT Staff,OU=Groups,DC=example,DC=com",
  "name": "IT Staff",
  "samAccountName": "IT-Staff",
  "groupType": "security",
  "scope": "global"
}

{
  "resource": "group",
  "operation": "get",
  "groupDn": "CN=IT Staff,OU=Groups,DC=example,DC=com"
}

{
  "distinguishedName": "CN=IT Staff,OU=Groups,DC=example,DC=com",
  "name": "IT Staff",
  "samAccountName": "IT-Staff",
  "description": "IT Department Staff",
  "groupType": "security",
  "scope": "global",
  "memberCount": 5,
  "members": [
    "CN=John Doe,OU=Users,DC=example,DC=com",
    "CN=Jane Smith,OU=Users,DC=example,DC=com"
  ]
}

{
  "resource": "group",
  "operation": "list",
  "groupSearchFilter": "IT",
  "groupFilterType": "security",
  "groupFilterScope": "global",
  "groupMaxResults": 50
}

{
  "resource": "group",
  "operation": "modify",
  "groupDn": "CN=IT Staff,OU=Groups,DC=example,DC=com",
  "groupAttributes": [
    {
      "name": "description",
      "value": "Updated IT Department description"
    }
  ]
}

{
  "resource": "group",
  "operation": "addMember",
  "userDn": "CN=John Doe,OU=Users,DC=example,DC=com",
  "groupDn": "CN=IT Staff,OU=Groups,DC=example,DC=com",
  "skipIfMember": true
}

{
  "resource": "group",
  "operation": "removeMember",
  "userDn": "CN=John Doe,OU=Users,DC=example,DC=com",
  "groupDn": "CN=IT Staff,OU=Groups,DC=example,DC=com",
  "skipIfNotMember": true
}

Organizational Unit Operations

{
  "resource": "ou",
  "operation": "create",
  "ouName": "IT Department",
  "ouParentDn": "DC=example,DC=com",
  "ouDescription": "Information Technology"
}

{
  "success": true,
  "dn": "OU=IT Department,DC=example,DC=com",
  "name": "IT Department"
}

{
  "resource": "ou",
  "operation": "get",
  "ouDn": "OU=IT Department,DC=example,DC=com"
}

{
  "resource": "ou",
  "operation": "list",
  "ouParentDnList": "DC=example,DC=com",
  "ouSearchFilter": "IT"
}

{
  "resource": "ou",
  "operation": "modify",
  "ouDn": "OU=IT Department,DC=example,DC=com",
  "ouAttributes": [
    {
      "name": "description",
      "value": "Updated IT Department"
    }
  ]
}

{
  "resource": "ou",
  "operation": "delete",
  "ouDn": "OU=Old Department,DC=example,DC=com"
}

🎯 Use Cases

1. Automated User Onboarding

Create a workflow that:

1. Receives webhook with new employee data
2. Creates AD user account
3. Adds to appropriate groups
4. Sends welcome email with temp password
5. Creates calendar event for IT setup

2. Password Expiry Notifications

Create a scheduled workflow that:

1. Lists all users
2. Checks password expiry for each
3. Sends notification email 7 days before expiry
4. Generates report for IT team

3. Group Membership Audit

Create a workflow that:

1. Gets all security groups
2. For each group, gets members
3. Exports to Excel/CSV
4. Emails to security team monthly

4. Account Unlock Helpdesk

Create a webhook workflow that:

1. Receives unlock request from helpdesk
2. Verifies user identity
3. Unlocks account
4. Sends confirmation to user and helpdesk

5. Organizational Restructuring

Create a workflow to:

1. Create new OU structure
2. Create security groups
3. Move users to new OUs
4. Update group memberships
5. Generate migration report

🔒 Security Best Practices

1. Always Use LDAPS

• ✅ DO: Use LDAPS (port 636) in production
• ❌ DON'T: Use unsecured LDAP (port 389) for production

2. Certificate Validation

• ✅ DO: Use proper SSL/TLS certificates
• ✅ DO: Validate certificates in production
• ❌ DON'T: Skip certificate validation in production

3. Service Account Permissions

• ✅ DO: Use dedicated service account with minimal permissions
• ✅ DO: Enable account auditing
• ❌ DON'T: Use Domain Admin account

4. Password Security

• ✅ DO: Enforce strong password policies
• ✅ DO: Use n8n's credential system for passwords
• ✅ DO: Force password change at first logon
• ❌ DON'T: Store passwords in workflow data

5. Monitoring & Auditing

• ✅ DO: Monitor AD logs for suspicious activity
• ✅ DO: Enable n8n execution logging
• ✅ DO: Review failed operations regularly

🐛 Troubleshooting

Connection Issues

Problem: Cannot connect to domain controller

Solutions:

1. Verify DC hostname/IP is correct
2. Check firewall allows port 636 (LDAPS) or 389 (LDAP)
3. Test connectivity: telnet dc.example.com 636
4. Verify service account credentials

Certificate Issues

Problem: SSL certificate validation fails

Solutions:

1. Verify certificate is properly installed on DC
2. Check certificate chain is complete
3. Import Root CA certificate if self-signed
4. Use "Skip Validation" for testing only

Password Operations Fail

Problem: Cannot set or reset passwords

Solutions:

1. Use LDAPS: Password operations require encrypted connection
2. Verify password meets AD complexity requirements
3. Check service account has "Reset Password" permission
4. Ensure user account is not protected from password changes

Permission Denied

Problem: Operations fail with "Insufficient Access Rights"

Solutions:

1. Verify service account has required permissions
2. Check OU/object permissions
3. Review delegation of control settings
4. Ensure service account is not locked

Timeout Errors

Problem: Operations timeout

Solutions:

1. Increase connection timeout in credentials
2. Check network latency to DC
3. Verify DC is not overloaded
4. Test with smaller batch operations

📊 Version History

v0.2.0 (2025-01-29) - MAJOR UPDATE 🎉

NEW RESOURCES:

• ➕ Organizational Units (OU) - Full CRUD operations
• ➕ Enhanced Group Management - Full CRUD + advanced features

NEW OPERATIONS:

• ✨ OU: Create, Get, List, Modify, Delete
• ✨ Groups: Create (with type/scope), Get, List (with filters), Modify, Delete
• ✨ Users: Get User Groups, Get User Activity, Unlock Account, Check Password Expiry

IMPROVEMENTS:

• 🎯 Dynamic Dropdowns for Groups, OUs, and Attributes
• 🔍 Advanced Filtering for Groups (type, scope, search)
• 📊 Detailed User Activity Tracking
• 🔐 Group Type & Scope Management (Security/Distribution, Global/Domain Local/Universal)
• ✅ All text translated to English
• 🐛 Fixed checkPasswordExpiry timeout issue

v0.1.15 (2025-01-29) - SECURITY FIX

CRITICAL:

• 🔒 Removed test files containing credentials
• 🔒 Added .npmignore for security
• 🗑️ Unpublished vulnerable versions (0.1.0-0.1.14)

IMPROVEMENTS:

• 🌍 All French text translated to English
• 📝 Improved error messages
• 🐛 Bug fixes and stability improvements

Previous Versions

• 0.1.14 - Enhanced features (deprecated for security)
• 0.1.12 - Added Get User and List Users operations
• 0.1.11 - Custom SVG logo
• 0.1.10 - Fixed change.write is not a function error
• 0.1.0 - Initial release

💬 Support & Community

Get Help

• 📖 Documentation: You're reading it!
• 🐛 Bug Reports: GitHub Issues
• 💬 Discussions: GitHub Discussions
• 🌐 n8n Community: community.n8n.io

Show Your Support

If you find this node useful:

Other ways to support:

• ⭐ Star the project on GitHub
• 🐦 Share on social media
• 📝 Write a blog post about your use case
• 🤝 Contribute code or documentation

🤝 Contributing

Contributions are welcome! Here's how you can help:

Report Bugs

Open an issue with:

• Clear description of the problem
• Steps to reproduce
• Expected vs actual behavior
• n8n version and node version

Suggest Features

Open a discussion with:

• Description of the feature
• Use case and benefits
• Proposed implementation (if technical)

Submit Pull Requests

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests if applicable
5. Submit PR with clear description

Improve Documentation

• Fix typos or unclear sections
• Add examples or use cases
• Translate to other languages
• Create video tutorials

📄 License

MIT License - Copyright (c) 2025

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software.

See LICENSE file for full details.

🙏 Acknowledgments

• n8n Team - For creating an amazing automation platform
• ldapts - Excellent LDAP client library
• Community Contributors - Thank you for your feedback and support!
• You - For using this node! ❤️

🌐 Ecosystem

This node is part of a complete Active Directory automation solution:

📦 Core Package

• n8n-nodes-ad-admin - This npm package (n8n community node)
• GitHub Repository - Source code and documentation

🐳 Official Docker Collector (NEW!)

• AD Collector on Docker Hub - Official Docker image
• Collector Source Code - GitHub repository
• Image: fuskerrs97/ad-collector-n8n:latest (138 MB, Alpine Linux)
• Features: 26 REST API endpoints, JWT authentication, LDAPS support, connection pooling
• Documentation: COLLECTOR.md - Complete setup guide

🔗 Integration

┌─────────────┐         ┌──────────────────┐         ┌─────────────────┐
│   n8n       │ ──────> │  AD Collector    │ ──────> │ Active Directory│
│  Workflows  │  HTTP   │  Docker (8443)   │  LDAPS  │    Server       │
└─────────────┘         └──────────────────┘         └─────────────────┘
    (This node)          (Optional gateway)          (Domain Controller)

Choose your deployment:

• Direct Mode: n8n → Active Directory (LDAP/LDAPS)
• Collector Mode: n8n → AD Collector → Active Directory (HTTP + LDAPS)

🔗 Links

• npm: npmjs.com/package/n8n-nodes-ad-admin
• GitHub: github.com/Fuskerrs/n8n-nodes-ad-admin
• Docker Collector: hub.docker.com/r/fuskerrs97/ad-collector-n8n
• Collector Source: github.com/Fuskerrs/docker-ad-collector-n8n
• n8n: n8n.io
• Support: buymeacoffee.com/freelancerc5