You can use this article before installing the connector to confirm that the Rainbow tenant, Windows host, network access and AD/LDAP environment are ready. Validating these points early helps avoid activation, synchronization and LDAPS issues later in the deployment.
Rainbow prerequisites
- You must be a Rainbow administrator of the target company.
- You must have a Business or Enterprise license. Essential is not sufficient.
- Single Sign-On must be configured at company level and activated for at least some members. The connector does not synchronize passwords.
- A default Business or Enterprise subscription should be selected for synchronized users.
- Only one AD/LDAP connector can be active per Rainbow company. Reinstalling on a new host requires revoking the previous connector first.
Network prerequisites
| Flow | Endpoint | Protocol / port | Purpose |
|---|---|---|---|
| Connector to Rainbow | *.openrainbow.com | HTTPS / 443 | SDK connection, OAuth, configuration, synchronization and reports. |
| Connector to update server | web.openrainbow.com/downloads | HTTPS / 443 | Automatic connector update. |
| Connector to AD/LDAP | Your AD/LDAP server | LDAP / 389 or LDAPS / 636 | Directory search and bind. |
| Administrator to connector | http://localhost:<port> | HTTP / 3000-3019 | Local connector console from the Windows host. |
Windows host prerequisites
- Use a Windows host located inside your network, with network access to AD/LDAP and Rainbow Cloud.
- Run the installer with Windows administrator rights.
- Ensure the local console port is available. The default instance uses port 3001; additional instances use the 3000-3019 range.
- If you use a corporate proxy, prepare proxy host, port and credentials before activation.
AD/LDAP prerequisites
- Prepare an LDAP service account with read access to the selected users, contacts, groups and attributes.
- For LDAPS with a private PKI, prepare a PEM-encoded CA certificate or full certificate chain.
- Identify the Base DN and LDAP filters for user synchronization and business directory synchronization.
- Identify a stable immutable identifier for mapping. For Microsoft Active Directory, the default is objectGUID. For generic LDAP, use uid, entryUUID or another stable attribute.
Warning: If the LDAP server is not Microsoft Active Directory, review the default attribute mapping before any dry run. Keeping
objectGUID as ldap_id on a generic LDAP server causes records to be rejected.