Subject: Multiple Active Directory Applications in Pass Through Authentication – Any Impact in Production?
Hello Community,
I am working with a customer who has two Active Directory applications configured in SailPoint IdentityIQ:
A standard Active Directory application.
A PAM-related Active Directory application.
Some identities have two AD accounts:
One account in the standard AD application.
Another account in the PAM AD application.
The customer would like users to be able to authenticate using either account.
I tested this in my lab environment by configuring both AD applications under Pass Through Authentication (as shown in the screenshot), and authentication worked successfully in all tested scenarios.
Before implementing this in production, I would like to understand whether there are any known side effects or considerations when configuring multiple AD applications for Pass Through Authentication.
Specifically:
Is this a supported and recommended configuration?
Does IdentityIQ attempt authentication against all configured pass-through applications sequentially?
Are there any performance impacts when multiple AD applications are configured?
Has anyone implemented a similar setup in production, and were there any issues encountered?
Any guidance or best practices would be greatly appreciated.
I haven’t seen any major issues with this setup, but one thing I’d keep an eye on is authentication performance. If the first AD application doesn’t find the user, IIQ will likely try the next one, which could add a small delay. Since it’s working fine in your lab, I’d suggest doing some testing with production like user volumes before enabling it in production. Curious to hear if anyone has run this configuration in a live environment and what their experience was.
Multiple Active Directory applications can coexist in a Pass-Through Authentication environment. However, in a production setup, factors such as account correlation, authentication performance, provisioning workflows, and aggregation efficiency must be carefully considered. When correlation rules, provisioning policies, and authentication configurations are implemented correctly, multiple AD applications can operate without significant issues. Conversely, improper configuration may lead to duplicate account correlations, authentication delays, or incorrect provisioning actions. Therefore, thorough design, testing, and ongoing monitoring are critical to ensuring a stable and reliable implementation.
@IslamElkhouly AFAIK IIQ try to authenticatepass-through authentication applications sequentially. In your screenshot, first it’ll try with AD-Test and if user not exist, it’ll try with Active Directory. You might want to ensure that correlation rules are properly configured for both AD applications to avoid duplicate identity correlations.
I believe your regular AD will be frequently used, so make it as the first app and other PAM related AD as second app.
In short, this is a viable and commonly used configuration when identities have accounts across multiple AD instances. Just test it properly with production like data and then enable it.
