Search

User Manual

GETTING STARTED


MODULES AND PLATFORM


APPENDIX


TUTORIALS & HELPFUL TRICKS


GLOSSARY


STRATEGIC PARTNER LINKS

Sepasoft - MES Modules
Cirrus Link - MQTT Modules

RESOURCES

Inductive University
Ignition Demo Project
Knowledge Base Articles
Forum
IA Support
SDK Documentation
SDK Examples

ALL MANUAL VERSIONS

Ignition 8.1
Ignition 7.9
Ignition 7.8

Deprecated Pages

Skip to end of metadata
Go to start of metadata


AD/Database User Source

This AD/Database Hybrid User Source is not manageable from within Ignition. Users/passwords must be administered through Active Directory, and roles, contact info, and so on, must be administered directly through the database. The way AD/Database Hybrid works, is it has all the same information requirements as the other authentication profiles, but it also has a number of Database properties. You need to specify a database (i.e., MySQL) to store information, and set up queries that you want to use. You must also specify the host that is acting as your primary domain controller, and a secondary domain controller in case the primary is unavailable. You'll also need to specify the name of the domain and credentials for the Gateway itself to use for authentication when it queries the list of roles.

This feature is new in Ignition version 8.0.10
Click here to check out the other new features

AD/Database  User Sources now support SASL (Simple Authentication and Security Layer). SASL is a framework for authentication and data security in Internet protocols such as LDAP.

Property Reference

This User Source shares many properties with both the AD User Source and Database User Source.

On this page ...


IULocgo


AD Database Hybrid



Creating an AD/Database Hybrid User Source

  1. On the Gateway Webpage, under the Config tab, go to Security > Users, Roles.  
    The User Sources page will be displayed. Click the blue arrow, Create new User Source.

  2. Choose the AD/Database Hybrid authentication type, and click Next

     

    May need to contact your internal IT Department for..

    When using AD/Database Hybrid User Source, you may need to consult with your internal IT Department to get the required information to complete your user source setup.

  3.  The New User Source window will open.  Some properties are optional depending on how you set up your profile. Details on the Main Properties can be found on the User Sources page. The Active Directory Properties and Database properties are listed in the tables below. 

  4. Click Create New User Source to save the new user source.

Active Directory Properties

Name

Description

Domain

The Windows Domain your active Active Directory server is running on. If you aren't sure of your domain, ask your network administrator.

Leave blank to set advanced properties manually.

Primary Domain Controller HostThe IP address or hostname of your primary domain controller. Example: "192.168.1.4" or "MainServer"
Primary Domain Controller PortThe port number for the primary domain controller's LDAP interface.
List Users from Active DirectoryIf true, Active Directory will be queried for the list of all users. If false, users must be added manually. (Default is true.)
Gateway UsernameThe login name for the Gateway to use when querying Active Directory. Used for retrieving the list of users and roles via LDAP.
PasswordThe password for the above username.
PasswordRe-type password for verification.
SSO Enabled

Whether or not to use Single-Sign-On (SSO) to authenticate AD users. Note that projects must also have this option enabled for SSO to work. (Default is false.)

SSO DomainThe domain that Windows users must match in order to use SSO. If blank, the main "Domain" property will be used.

Database Properties

Name

Description

Database

Dropdown list. Choose the database connection this authentication profile will use.

User Properties Query

A query that returns the basic properties for a single user. Supported return columns are [username, firstname, lastname, schedule, language, notes].

Role List QueryA query that returns all possible roles that any user could have. The role names must be returned in the first column of the query's results
User's Roles QueryA query that returns all of the roles that the provided user belongs to. The roles must be strings (i.e., the role names), and must be in the first column of the query's results. The username will be inserted into this query as a parameter.
Contact Info QueryA query that returns all of the contact info for the user. The first column must be the contact type, the second column the contact value, and the third column the name of a schedule. Optional, may be blank.
Schedule Adjustment QueryA query that returns the upcoming schedule adjustments for the user. Columns must be Start(date), End(date), Available(boolean), Note(string). Optional, may be blank.
Extra Properties QueryA query that returns name, value pairs of extra properties for the user. Will be run with one parameter: the username. Optional, may be blank.
List Users QueryA query that returns a row containing each username. Only used if "List Users from Active Directory" is false. There must be at least one column: the username. Other columns are optional, supported columns are: [username, firstname, lastname, schedule, language, notes].

This feature is new in Ignition version 8.0.10
Click here to check out the other new features

SSL Properties

NameDescription
Mechanism

 An ordered list of space-separated mechanism names. The LDAP provider will use the first mechanism for which it finds an implementation. A blank value will leave this setting unspecified. (Default is DIGEST-MD5 CRAM-MD5.)

RealmA realm defines the namespace from which the user is selected. A blank value will leave this setting unspecified. This setting will only be used by mechanisms which support it. (Default is blank.)
Quality of Protection A comma-separated list of Quality-of-Protection (QoP) values, the order of which specifies the preference order. There are three well-known values: "auth" (authentication only), "auth-int" (authentication with integrity protection), and "auth-conf" (authentication with integrity and privacy protection). A blank value will leave this setting unspecified. This setting will only be used by mechanisms which support it. (Default is auth-conf,auth-int,auth.)
Protection Strength A comma-separated list of privacy protection strength values, the order of which specifies the preference order. The three possible strength values are "low", "medium", and "high". A blank value will leave this setting unspecified. This setting will only be used by mechanisms which support it. (Default is high,medium,low.)
Mutual AuthenticationEnable or disable mutual authentication. This setting will only be used by mechanisms which support it. (Default is disabled.)




  • No labels