According to the Forescout User Directory Plugin Configuration Guide and the RADIUS Plugin Configuration Guide Version 4.3, the "Use as directory" selection allows resolution of user information via LDAP. The documentation explicitly states:
"Use as directory: Select this option to use the server as a directory to retrieve user information. This option is not available for RADIUS and TACACS servers."
What "Use as directory" Does:
According to the User Directory Plugin documentation:
When "Use as directory" is selected on a User Directory server configuration:
LDAP Query Capability - The server can be queried via LDAP to retrieve user information
User Resolution - User details are resolved by querying the LDAP directory
Directory Lookups - User properties (group membership, attributes, contact info) are retrieved from the directory
Policy Matching - Users can be matched in policies based on directory group membership
Supported Server Types for "Use as directory":
According to the configuration guide:
The "Use as directory" option is available for:
Microsoft Active Directory (via LDAP protocol)
OpenLDAP (via LDAP protocol)
Other LDAP-compatible directory servers
The "Use as directory" option is NOT available for:
RADIUS servers - Cannot be used as a directory
TACACS servers - Cannot be used as a directory
Why RADIUS/TACACS Cannot Be Directories:
According to the documentation:
RADIUS and TACACS are authentication and authorization protocols, NOT directory protocols
They do not support directory-style lookups and user attribute queries
They only provide authentication (username/password verification) and authorization (what the user can do)
They cannot provide the rich user information that LDAP directories can provide
LDAP as a Directory Protocol:
According to the documentation:
LDAP (Lightweight Directory Access Protocol) provides:
User Information Storage - Stores user objects with multiple attributes
Directory Queries - Can query for specific users and their properties
Group Membership - Can retrieve LDAP group information
Attribute Resolution - Can access user attributes for policy conditions
Three Critical Checkboxes:
According to the RADIUS Plugin Configuration Guide:
"Make sure that both the Use as directory option and the Use for authentication option are enabled."
This indicates that a single User Directory server can have multiple roles:
Use as directory - For LDAP queries and user information resolution
Use for authentication - For user login authentication
Use for Console Login - For access to the Forescout Console
Example Configuration:
According to the documentation:
When you have an Active Directory server:
✓ "Use as directory" is CHECKED - Enables LDAP queries for user info and group membership
✓ "Use for authentication" is CHECKED - Allows users to authenticate with their AD credentials
✓ "Use for Console Login" is CHECKED - Allows administrators to log into Forescout Console with AD credentials
Why Other Options Are Incorrect:
B. It allows resolution of user information via TACACS - Explicitly NOT available for TACACS; TACACS cannot function as a directory
C. It allows for Guest Registration when Approvals are required - This is a separate User Directory feature unrelated to "Use as directory"
D. It enables HTTP authentication and resolves HTTP login status - This is not related to directory usage; HTTP authentication is a separate feature
E. It allows resolution of user information via RADIUS - Explicitly NOT available for RADIUS; RADIUS servers cannot function as directories
Referenced Documentation:
User Directory Plugin Configuration - Define User Directory Servers
User Directory Plugin - Name and Type Step documentation
RADIUS Plugin Configuration Guide Version 4.3 - User Directory Readiness section
