Setting up Active Directory (AD) Server Authentication

Updated on 27 Nov 2024
5 Minutes to read

Print
Share
Dark
Light

Article summary

Did you find this summary helpful?

Thank you for your feedback

Overview

A successful Active Directory Server Authentication setup and implementation rest heavily on experienced client-side technical resources. Decisions' Support Team will help but may not be able to solve AD issues specific to the organization.

An Active Directory (AD) server synchronizes users, computers, groups, and/or organizational units to the Portal's account base.

When an AD account (person or machine) is used, the account's AD credentials are authenticated to gain access to the Portal. Furthermore, AD authentication works in conjunction with Single Sign-On (SSO). Please review the article on Enabling SSO with Azure AD for more information.

Before starting server authentication, it is recommended to have the domain name, default email domain, and the user name and password for an active user connecting to AD. The Portal user connecting to AD does not need to be an administrator, i.e., the user can be an essential "Domain User" in AD.

However, the List Contents permission is required on the user account before proceeding. This is usually granted by default to a basic user. For more information, please visit Microsoft's AD support article.

Listed below are additional common caveats when syncing with an AD server:

For AD Groups, Decisions only sync with security groups, not with distribution groups. Please ensure that groups are configured as security groups.
For AD Accounts, account passwords cannot be edited in the Portal. This is to preserve data integrity.
To set up AD in a Tenant Environment, perform the configuration inside the tenant to sync the tenant with an AD server. The account used to sync AD must have administrator credentials.

Configuration

In the Designer Studio, navigate to System > Settings and click on Active Directory Settings.
To configure a new AD server, click ADD under the Servers box.The Add Servers window has Portal Settings, Server Settings, and Synchronization Settings options. All of the Server Settings are required, and a Synchronization option must be selected; settings for each section are outlined below.

Portal Settings

Setting Name	Default Value	Description
Auto-Create Users on Initial Login	False	Toggles if a user receives immediate access to the Portal when the account is created in the AD server. When true, the user does not need to wait for the next sync cycle to log in using AD; the AD account is automatically added to the Portal's account base upon first logging into the Portal. For this to work, a user must first log in with their username instead of their email to create the account. Future logins may then use either username or email.
Sync Only Users	False	Toggles, if only users, will sync to the Portal's account base, thus ignoring groups, organizational units (OU), and computers. If using this setting, ensure the Synchronization Option under Synchronization settings is set to EntireDomain. Otherwise, user accounts will be deactivated after the next sync.
Default Groups	Blank	Allows selection of which Portal group(s) the synced AD account will belong to by default. For example, if wishing all synced AD accounts to have Portal admin privileges, set the default group to Administrators. Note that the group's name must be entered manually; only one group can be entered per line. This group must already exist within the Portal.
Create New Users Even if Disabled in AD	False	Toggles overriding AD settings that prevent the creation of new AD accounts for Portal users.

Server Settings

All of the Server Setting fields are required. It is recommended to have the domain name, default email domain, user name for an account with admin rights, and password information before beginning.

Settings available after selecting OpenLDAP for the LDAP Schema are denoted with an * after their name,

Setting Name		Default Value	Description
LDAP Schema		Active Directory	Allows selection of which AD type to use for the server
	Active Directory	--	Selects Active Directory as the AD type
	OpenLDAP	--	Selects OpenLDAP as the AD type; selecting this spawns new settings
LDAP Authentication Type		--	Allows selection for LDAP Authentication
	Anonymous, Basic, Negotiate, Kerberos, NTLM	Negotiate	For information on all the authentication types, refer to Microsoft's official documentation.
Enable LDAPS		False	LDAPS (LDAP over SSL) is a secure version of LDAP that encrypts the authentication process. For more information, refer to Microsoft's official documentation. Note: This option will be absent in the non-Windows environments.
Server*		Blank	Prompts for the name of the OpenLDAP server to connect
Domain Name		Blank	Prompts for the domain or IP address of the server
Base DN*		Blank	Prompts for the base of the domain name
Use No Login Prefix		False	Toggles the requirement of login prefix for users to log in Note: This should be marked as false when the platform is hosted in containers. For more information, refer to Active Directory Setup in Containers.
Domain Login Prefix		Blank	Prompts for domain login prefix that must be added when users log on
Default Email Domain		Blank	Prompts for the default email domain for the server
Elevated User Name		Blank	Prompts for a Portal user with AD server access to connect to the server
Elevated User Password		Blank	Prompts for the password of the provided Elevated User Name's AD credentials to allow connection
Query Timeout (In Seconds)		100	Sets the time-out value for the query to the AD server
Connection Timeout (In Seconds)		100	Sets the time-out value for the connection to the AD environment during a sync
Logon By*		Uid	Allows for selection of how users log in via the OpenLDAP server
	Uid	--	Select login via user ID credentials.
	Email Address	--	Selects login via email credentials
Use Cloud To Site Agent		False	Allows AD to connect to a setup agent via the cloud. This allows the AD server to communicate with the Decisions service.
	Agent to Handle Requests	Blank	Prompts for which agent to use

Synchronization Settings

Setting Name		Default Value	Description
Sync Managers for Users		True	Toggles if AD user managers automatically sync for users
Sync Only Groups From Users Having Logged In		False	Toggles syncing only groups with active users logging on
Synchronization Option		Entire Domain	Allows selection of how synchronization is conducted between the Portal and AD
	EntireDomain	--	Everything is synchronized in AD to the Portal account base, including all users, groups, and organizational units. If the Sync Only Users checkbox is true, then only users within the domain will be synced. Proceed with caution when using this method.
	SelectedOrgUnits	--	Synchronizes only the specified organizational units to the Portal account base.
	SelectedGroups	--	Synchronizes only the specified groups to the Portal account base.
Ignore Managers if not in Group		False	If this setting is marked as true, the synchronization process will not include the managers of users who are not part of the selected group. For instance, if John is in the selected group, but his manager Will is not, enabling this setting will result in Will not being synced as John's manager. Note: This setting is exposed if the Synchronization Option is set to Selected Groups.

For further information on Modules, visit the Decisions Forum.

Was this article helpful?

What's Next

Active Directory Module Steps

Table of contents

Overview
Configuration
Portal Settings
Server Settings
Synchronization Settings