Active Directory Auto Module
The Active Directory Auto Module allows to connect to an Active Directory and synchronise groups including subgroups with existing groups Helmut.
This modules offers more flexibility (sync-triggering via HK/ Cron Job) and advanced user/access permissions compared to the older and more basic ActiveDirectory Module.
Limitations
The Active Directory Auto Module supports only a single AD.
Azure AD is not supported.
Multi-forest ADs and global catalogs are not supported.
Enable Switch
Enables/disables the module.
ActiveDirectory Host
Hosts must be added here, separated by a comma. After setting the security method, the port will be added automatically to the dns/ip when clicking the yellow refresh button.
When using DNS please make sure, that the server does have a proper DNS configuration in place!
ActiveDirectory Security
Dropdown to select the type of security: PLAIN (port 389), SSL (port 636), TLS (port 389)
ActiveDirectory Domain
The domain must be added here if the active directory toggle switch is enabled.
ActiveDirectory Password
The active directory password must be added here if the active directory toggle switch is enabled.
ActiveDirectory Username
The active directory username must be added here if the active directory toggle switch is enabled.
ActiveDirectory Groups
Displays the group within the Active Directory that will be synchronised with the selected groups in Helmut.
Helmut Groups
Dropdown to select one or multiple groups the synchronised users should be member of.
Helmut Products
Dropdown to select the products to which the synchronised users should be granted access rights.
FX
IO
CO
HK
Helmut Access Preset
Dropdown to select the access preset that the user should receive.
User Role
Define the role of the user
User
Admin (will have full access to all groups / ignores access presets)
Displayname Binding
Define how the user will be presented / show on top of the custom user actions
eg: moovit (username) - MoovIT Support (Displayusername) - support@moovit.de (Email)
Displayname
Username
Email
Actions
This defines the method which will be used when a synchronisation get triggered (manually or cron).
Add
This method will import only new users, which have been added to the AD group. Existing helmut users will be added, so access for this group will be granted. Add might be wise to be triggerd on typical onboarding days like 1st, 2nd, 15th and 16th of every month.
Update
This method will update all existing users within this group (which have already been imported into helmut) and set the rights according to the defined parameters: groups, products, preset, role and displayname binding Update might be wise to trigger on a weekly basis in case you are constantly updating your groups/access permissions.
Remove
This method will remove all users, which aren't part of the AD group anymore. The user/profile won't be deleted, as the user might still be member of another group. Users which don't belong to any group, can be found in the unassigned tab of the users section.
Test Button
The test button can be used to check whether and how many users are found.
Browse Button
The Active Directory can be searched via the Browse button and the group to be synchronised can be selected.
Synchronize Button
Synchronises the group.
Remove Group Button
Removes the link between the AD group and the Helmut group
Add Group Button
Adds another set of parameters to link another AD group with another Helmut group.
ActiveDirectory Single Sign On Switch
Enables Single Sign On for the Active Directory. This only works for Windows OS.
Importance during running AD sync
Please pay attention on the AD sync parameters. If you have added the same user to multiple AD groups (Action: Update), this will lead to multiple permission changes. At the end, the user will have the permission, which have been set in the last AD sync. The difference between Add vs Update is not trivial. Running "Add" will add new/existing users to a (new) group, not touching existing group access. Running "Update" will modify the rights, so all users will only be able to access the group(s), defined in this AD-helmut sync.
Last updated