---
title: Destination Systems
description: Add Destination Systems in OpenLM Platform Directory Sync to send the user and group changes it detects to an Amazon S3 bucket or SQS FIFO queue.
product: OpenLM Platform
---

To hand the user and group changes that Directory Sync detects over to your own AWS infrastructure, add a destination system. A destination system is an Amazon S3 bucket or an Amazon Simple Queue Service (SQS) queue that receives directory update data from the OpenLM Directory Synchronization Service (DSS). SQS queues must be first in, first out (FIFO) queues.

When DSS detects changes to users and groups in your LDAP or Active Directory, Directory Sync automatically sends that data to your configured AWS destinations.

:::note[The LDAP Connector tile]
**Destination Systems** replaces the separate **LDAP Connector** service. The **Navigation** menu has an **LDAP Connector** tile that opens that earlier service. It works with the same destination systems. This page documents the **Destination Systems** page of Directory Sync.
:::

## Before you begin

Confirm these prerequisites:

- An active OpenLM Platform account with the LDAP Connector product activated.
- The **Admin** role for the LDAP Connector product. Account administrators always see the page. Without the role, the sidebar hides the **Destination Systems** entry, and opening the page by its address returns you to **Agents**.
- [Directory Synchronization Service (DSS)](https://www.openlm.com/documentation/cloud/users/directory-sync/index) configured with at least one sync definition.
- In your AWS account, at least one destination configured: an **Amazon S3** bucket, to receive the changes as files, or an **Amazon SQS** FIFO queue, to receive them as messages. You can add both.
- AWS credentials (**Access key** and **Secret access key**) for the destination. Use a service account for machine-to-machine authorization rather than personal credentials.
- Permissions for those credentials: `s3:ListBucket` and `s3:PutObject` for a bucket, or `sqs:ListQueues` and `sqs:SendMessage` for a queue. The **Add Destination System** page lists the minimum permissions.

To open Destination Systems, select **Navigation** (the grid icon in the OpenLM Platform header), then **Users**, then **Directory Sync**, then **Destination Systems** in the sidebar.

Destination Systems is available only in the cloud-hosted OpenLM Platform. On-premises installations don't include it.

## Activate the LDAP Connector

The LDAP Connector is a separate product in **OpenLM Products**. To activate it:

1. Open **Products** in OpenLM Platform.
2. Find the **LDAP Connector**.
3. Activate the **LDAP Connector**.
4. Give each user who needs the page the product's **Admin** role.

For more information, see [Users management](https://www.openlm.com/documentation/cloud/openlm-administration/identity#manage-users) in Identity.

After you activate the product, **Destination Systems** appears in the Directory Sync sidebar for users who have the **Admin** role, and for account administrators. The **LDAP Connector** tile also appears in the **Navigation** menu.

## Check destination systems

To see where your directory changes go, and whether the last delivery worked, open **Destination Systems**. On each destination system card, check:

- Its **Name** and its **System** (**Amazon S3** or **Amazon SQS**).
- The fields that identify the target: **Bucket name** and **Path prefix** for Amazon S3, or **Fifo queue url** for Amazon SQS.
- A status line: **No syncs yet**, **Last sync** followed by the date and time of the last successful sync, **Sync in progress**, or **Last sync failed**.

Select a card's header to open the destination system's details. The list refreshes every 10 seconds.

The following screenshot shows the card list.

*Each destination system is a card. Select its header to open the details.*

## Configure destination systems

The following sections cover adding, editing, testing, and deleting destination systems.

### Add an Amazon S3 destination

To add an Amazon S3 destination:

1. In the sidebar, select **Destination Systems**.
2. Select **Add System**. If you have no destination systems yet, select the **Add Destination System** card instead.
3. In **System**, select **Amazon S3**.
4. Fill in the fields:
   - **Name**: A display name for this destination. It must be unique among your destinations of the same system.
   - **Bucket name**: The name of your Amazon S3 bucket.
   - **Path prefix**: (Optional) A folder path inside the bucket. Directory Sync writes each sync event as an object named `<path prefix>/<UTC timestamp>.sync`.
   - **Access key**: Your AWS access key.
   - **Secret access key**: Your AWS secret access key.
   - **Region**: The AWS region of your bucket. You select it from a list.
5. Select **Check Connection** to test the settings.
6. Select **Save**.

For the connection test, see [Check connection](#check-connection). For help with the AWS side, read the setup instructions that the page shows for the system you selected.

The following screenshot shows the form for an Amazon S3 destination.

*Adding an Amazon S3 destination.*

### Add an Amazon SQS destination

To add an Amazon SQS destination:

1. In the sidebar, select **Destination Systems**.
2. Select **Add System**. If you have no destination systems yet, select the **Add Destination System** card instead.
3. In **System**, select **Amazon SQS**.
4. Fill in the fields:
   - **Name**: A display name for this destination. It must be unique among your destinations of the same system.
   - **Fifo queue url**: The full URL of your Amazon SQS FIFO queue (obtained from the AWS console). The queue must be a FIFO queue. Directory Sync sends messages with the message group ID `default-group`.
   - **Access key**: Your AWS access key.
   - **Secret access key**: Your AWS secret access key.
   - **Region**: The AWS region of your queue. You select it from a list.
5. Select **Check Connection** to test the settings.
6. Select **Save**.

For the connection test, see [Check connection](#check-connection).

### Edit a destination system

To edit a destination system:

1. Select the card header of the destination system to open its details.
2. Select **Edit System** to modify the configuration.
3. Update the required fields.
4. Select **Save**.

The saved **Access key** and **Secret access key** appear as masked password fields. Leave them as they are to keep the stored keys, or enter new values to replace them.

### Check connection

To verify that Directory Sync can reach the configured AWS resource with the provided credentials, select **Check Connection** on the **Add Destination System** or **Edit Destination System** page, or on the details page of a destination system. The check works as follows:

- On a new destination system, the check uses the values you entered. If a required field is empty, the button only highlights it.
- On an existing destination system, the check uses the saved configuration, not unsaved edits. Save your changes first, then check again.
- A successful check leaves a test item behind.
- For **Amazon S3**, the check writes a small text file named `openlm-connection-test-<UTC timestamp>.txt` under the path prefix.
- For **Amazon SQS**, the check sends one test message to the queue.
- The check needs write permission on the bucket, or permission to send messages to the queue.
- Delete the test file or message if you don't want to keep it.
- The result appears under the button: "Connection tested successfully." (shown in green) or "Check connection failed." (shown in red), followed by "Unable to connect. Check the platform settings and credentials, then try again." The check shows no progress indicator, so wait for the result.

### Delete a destination system

To delete a destination system:

1. In the card list, select the trash icon on the destination system's card.
2. In the **Delete Destination System** dialog, select **Confirm**.

The details page has no **Delete** button. Delete a destination system from its card.

## Review the sync history of a destination system

To check whether deliveries to a destination are working, select the card header of the destination system to open its details. Check the saved configuration (read-only, with the keys masked) and the history grid, which lists the outcome of each sync event for this destination. The grid has these columns:

- **Sync Status**: **Successful**, **In Progress**, or **Failed**.
- **Sync Date**: When the sync event ran.

Select **Refresh** to reload the grid, or use **Search** to filter by status or date. This grid is not the **Sync History** page of Directory Sync, which lists directory sync runs.

The following screenshot shows the details page of an Amazon S3 destination.

*Destination system details and its sync history.*

## How synchronization works

DSS and the LDAP Connector service deliver directory changes in this order:

1. DSS detects changes in the configured LDAP or Active Directory source (user creation, updates, or deletions).
2. DSS publishes the changes as events to Kafka.
3. The LDAP Connector service receives these events and forwards the data to all configured destination systems.
4. New files appear in the Amazon S3 bucket and new messages are available in the Amazon SQS queue.

## Troubleshooting

The following table lists symptoms, likely causes, and fixes:

| Symptom | Likely cause | How to fix |
|---------|--------------|------------|
| **Destination Systems** is missing from the sidebar | The LDAP Connector product is not active, you don't have its **Admin** role, or the deployment is on-premises | Activate the product in [OpenLM Products](https://www.openlm.com/documentation/cloud/openlm-administration/products/), and ask an account administrator to assign you the role. On-premises deployments don't have the page. |
| A card shows **Last sync failed** | The last delivery to this destination failed | Open the destination system and select **Check Connection** to test the saved configuration. If it fails, check the bucket name or queue URL, the region, the keys, and their permissions. |
| "Check connection failed." right after you edited a destination system | The check tests the saved configuration, not your unsaved edits | Select **Save**, then select **Check Connection** again. |
| A test file or message appears in your bucket or queue | **Check Connection** writes one when it succeeds | Delete it if you don't want to keep it. |