ts directory-service

Show, create, rename, test, or remove an Active Directory or LDAP directory service. Reach for test first when directory users suddenly cannot sign in.

Usage

ts directory-services
ts directory-service <name>
ts directory-service test <name>
ts directory-service new <name> [--type=ad|ldap] [--login-prefix=PREFIX]
ts directory-service set <name> <property> <value>
ts directory-service delete <name> [--force]

Description

A directory service is an Active Directory or generic LDAP source that Turbo Server authenticates users against. ts directory-services lists the configured ones with their type, login prefix, how many users have come from each, and when it was created.

There is no sync action, and its absence is deliberate. Directory users and groups are reconciled just-in-time at login rather than by a background sweep, so there is nothing to trigger and nothing to wait for — an account edited in AD is correct the next time its owner signs in. If you are used to running a sync to prove the directory is reachable, run ts directory-service test instead: it probes the directory with the stored binding and tells you whether it answered. A failed test exits -3 and prints the directory's own error, which is usually enough to tell a bad credential from an unreachable host.

Every command that takes a <name> also accepts the login prefix, which is convenient because the prefix is what you see in front of a user's login name.

ts directory-service <name> prints the service and, when a binding is configured, its LDAP host, base DN, and how it binds. The bind password is never printed — you see only whether one is set.

new creates the record and stops there. It reports that the LDAP binding still has to be configured, and that is accurate: host, port, base DN, and bind credentials are edited in the Administration site under Identity → Directory Services, not from ts. --type defaults to ad.

set handles the three properties that are safe to change from a terminal: name, description, and login-prefix. Anything else is rejected with the list of what is allowed. Changing login-prefix changes how users from that directory type their login name, so treat it as a change that affects everyone who signs in through it.

delete removes the service from the configured list after confirming. Built-in directory services cannot be deleted; the server refuses the request. Creating, changing, and deleting a directory service are all recorded in the operator audit log with the acting administrator, so ts audit can answer who changed the directory configuration and when. Running test is not an audited event.

Options

Flag	Description	Default/Values	Notes
--type	Directory type for a new service.	Default ad; ldap	new only. Anything else is rejected.
--login-prefix	Login prefix for a new service.		new only. Change it later with set <name> login-prefix <value>.
--force, -f	Delete without confirming.		delete only. Required when there is no terminal.

Examples

# What directories are configured, and how many users came from each?
ts directory-services

# One directory in full, including its LDAP binding
ts directory-service CORP

# Directory logins are failing — is the directory answering?
ts directory-service test CORP

# Register a generic LDAP directory, then finish the binding in the Administration site
ts directory-service new Partners --type=ldap --login-prefix=PTNR

# Rename it without touching anything else
ts directory-service set Partners name "Partner LDAP"

# Remove one
ts directory-service delete Partners --force

# Untruncated, for piping somewhere else
ts directory-services --csv

# There is no sync action. An unrecognized first word is read as the service
# name, so this looks up a directory called "sync" and reports -6, not a
# bad-argument error. Nothing is synced, because nothing needs to be.
ts directory-service sync CORP

Output

NAME       TYPE             PREFIX  USERS  CREATED
CORP       ActiveDirectory  CORP    482    2026-01-14T09:22:31.0000000Z
Partners   GenericLdap      PTNR    17     2026-06-02T15:04:00.0000000Z

Name:         CORP
Type:         ActiveDirectory
Login prefix: CORP
LDAP host:    dc01.corp.example.net:636
Base DN:      DC=corp,DC=example,DC=net
Binding:      Simple as svc-turbo (password set)

Exit Codes

0 on success, including a test that connects. -1 when --type is not ad or ldap, when set is given a property that is not settable, or when the server refuses the change — deleting a built-in service, for example. -3 when the connection test fails, and when the server itself cannot be reached. -4 when no account is signed in. -5 when the account is not a Server Administrator. -6 when no directory service matches the name or login prefix.

Related Commands

• ts user — The accounts a directory service produces.
• ts group — Directory groups reconcile at login alongside users.
• ts auth-provider — SSO providers, the other way users reach the server.
• ts audit — Who changed the directory configuration.