When you first deploy the Evo LDAP Agent, it will initiate a scan to confirm if there are any users to be connected (synced) with Evo. Some users have experienced an issue where users were not appearing in Evo as expected.

• Service failures
• Users not syncing
• Partner portal SAML *
• Firewall SAML *

* We’re actively working on investigating the best solution for both items to ensure a better installation experience.

Service failures

Although there should be no failures with the service, we want to be certain that the service is running as expected and hasn’t encountered any errors.

The first thing to check is to be sure the Evo LDAPS Authentication service is running, let’s proceed over to the service manager to confirm the current running state of the service.

1. From the Windows server, type WindowsKey+R to open the Run dialog.
2. Type services.msc 
3. In the list of services locate the Evo LDAPs Authentication service.
4. If the service doesn’t appear to be running. Right-click on the service and click Start.

The next item to check the service is generating events by checking events within Event Viewer > Log Summary > EvoSecurity. If an error was recorded, please contact us and we’re happy to help.  

Users not syncing

Users will only sync from your local Active Directory to your instance of Evo under the following conditions:

• User exists in Active Directory.
• User was created with a unique email address and password.
• User is a member of a group expected to sync.

Before we check Active Directory, let’s confirm if the user appears in the sync logs.

From the server that the Evo LDAP Service was installed, browse to C:\ProgramData\EvoSecurity\LDAPs. Open the failedpayload.json file in your favorite text editor. 

If the user does appear in the logs, but doesn’t appear in your instance of Evo, please contact our team so that we can investigate further.

If the user doesn’t appear in the logs, let’s check the user details in Active Directory.

1. From your server, open Server Manager.
2. From the Tools menu, click Active Directory Users and Computers.
3. From Users, locate the user that hasn’t synced into your instance of Evo.
4. Double click on the user to open the user properties.
5. General tab, confirm that the user has a unique email address.
   1. If yes, move on to step 6.
   2. If no, enter a unique email address for the user.
6. Member Of tab, confirm the groups that the user is a member of. Does the user reside under a group that was selected to sync?
   1. If yes, let’s proceed to the next scenario > Firewall rules
   2. If no, click Add… to add the user to the appropriate group(s). Click OK.

Now that we’ve confirmed the user profile settings are set as expected. Let’s go ahead and restart the service to sync the user, otherwise it will happen on the next scan window.

1. From the Windows server, type WindowsKey+R to open the Run dialog.
2. Type services.msc.
3. In the list of services locate the Evo LDAPs Authentication service.
4. Right-click on the service and click Restart.

If you’re still experiencing issues with users syncing, please contact our team so that we can investigate further.

Partner portal (SAML)

If you’ve configured a partner portal (such as K15t Viewport), and are experiencing issues logging in, we need to confirm the SAML details are correct.

Open your partner portal to the SAML provider settings details. Let’s confirm the following:

• Relying party identifier
• Assertion consumer service URL
• Metadata

If the details don’t mention your instance of Evo, please contact our team and we’ll be more than happy to help

Firewall settings (SAML)

If your firewall is interfering with sync or login, let’s confirm the authentication server settings.
 We want to specifically confirm the following field values:

• Server ID
• Authentication service URL
• Logout service URL

Note that the above field names are from a SonicWALL device. The field names could be different for the firewall you have.

If the details don’t match your instance of Evo, please contact our team and we’ll be more than happy to help.

LDAP Agent "Connection Test" fails or Elevated Access does not work

It could be the LDAP token is out of sync. You just simply re-download and re-install the new LDAP Agent. Please make sure to uninstall the broken LDAP Agent and delete EvoSecurity folder in C:\ProgramData before installing the new one.

Note: If your on-prem AD Virtual Machine is hosted on Azure, there could be a possibility the timeout values of the VM is blocking the connection between Evo and the LDAP Agent, please follow the link below to change those values.
On-prem AD Virtual Machine hosted on Azure (timeout settings) – Evo Support (evosecurity.com)