Enabling Active Directory Security Mode

GENESIS Security can synchronize its user accounts with Active Directory, so users can log into GENESIS with their Active Directory username and password. Permissions for users and groups are defined in the GENESIS Security database.

To synchronize security with Active Directory:

  1. (Optional) Set the security to testing mode to help keep you from getting locked out if something is configured incorrectly later.

    Do not make this change on a production system.

    • Open Workbench and in Project Explorer, expand your project > Security and double-click Global Settings to open the configuration dialog.

    • On the General tab, set Security active to Testing.

    • Apply the changes.

  2. Open Workbench and in Project Explorer, expand your project > Security > Global Settings . On the General Settings tab, set Security Mode to Active Directory . Additional settings for the Active Directory mode are displayed.

  3. Complete the Active Directory Settings section according to your domain settings.

    • In Initial administrator account, enter the Service Principal Name of the account that will be granted full permissions in the following form:

      user@example.com

    • In AD synchronization period, specify how often Security checks the Azure AD for changes. If any changes are detected, Security re-downloads all users and group information from Azure AD into memory.

      To download the Azure AD structure immediately, click Synchronize now.

    • In User authentication methods, select one of the following options:

      • Active Directory : Authenticates users by calling the Active Directory.

      • Active Directory (User-Principal-Name being translated to SAM-Account-Name) : When users are mapped from User-Principal-Name, Security tries to translate them into SAM-Account-Names by querying the Active Directory.

      • Active Directory (SAM-Account-Name being translated to User-Principal-Name) : When users are mapped from SAM-Account-Name, Security tries to translate them into User-Principal-Names by querying the Active Directory.

      • Local Logon: Calls the LogonUser function locally on the server, which allows the user to log in later, even when the Active Directory is not available.

        Instead of connecting directly to the Active Directory, this method connects through the local system function called LogonUser and caches the user's credentials, which allows the user to log in later, even when the Active Directory is not available.

        The Active Directory must be available during the FrameWorX Server startup, so that its structure can be cached.

        Using this method has the following limitations:

        • The server machine must be connected to the Active Directory domain.

        • The user must be allowed to log in to the server.

        • The Domain name field in Active Directory Settings must not contain the name of an actual domain controller. It must be the domain name only.

        • Caching does not seem to work when the user names are in the User-Principal-Name form (user@domain.com).

    • Show Managed Service Accounts: When checked, the Managed Service Accounts will show in the Security login dialog. By default, this box is cleared and these accounts are not available to select.

  4. (Optional) Enable automatic login and Windows integrated authentication.

    • In the Automatic Login section, select Enabled.

    • On the Tools ribbon, select FrameWorX Server Location, and in the dialog that opens, set Client Authentication to Integrated Windows Authentication.

    Alternatively, check that you have configured client certificates for authentication that map to the Active Directory.

  5. (Optional) To limit synchronization to the members of specific Active Directory groups, go to the Only Users from a specific Group section, select Enabled, and enter one or more group names in Group name. Only the listed groups and their members are synchronized into GENESIS Security, and only those users can log in.

    • Separate multiple group names with commas, and enter them all on a single line. For example: GENESIS Operators, GENESIS Engineers. Spaces around a comma are ignored.

    • Enclose a group name that contains a comma in double quotation marks. For example: "Operators, Plant 1", GENESIS Engineers.

    • Each entry must match the Active Directory group name exactly. Wildcards are not supported.

  6. In the Domain Connection Authentication section, enter the User Name and Password for the account used to authenticate access to the Active Directory.

  7. Click Apply , and then try to log in as an Active Directory user.

  8. If all tests succeeded, set the security back to active mode.

    • In Workbench, go to Security > Global Settings > General tab.

    • Set Security active to Active.

    • Apply the changes.