Active Directory Integration

CAS genesisWorld is integrated with Microsoft Active Directory services. Consequently, you can import user accounts and groups from the Active Directory in CAS genesisWorld and synchronize user accounts and groups. Additionally, you can use the authentication options from Active Directory user accounts for CAS genesisWorld.

Clicking the Active Directory Integration entry in the More toolbar options drop-down list in the User folder opens a window of the same name.

The button is only displayed if Active Directory is used to manage the domain.

The allocation of the CAS genesisWorld user to the respective users in the Active Directory can only take place within a company intranet.

First of all, import the Windows users or map the Windows users and their user accounts from CAS genesisWorld. For each procedure the respective server or servers from Active Directory will be available for CAS genesisWorld.

The tree view of the Active Directory also displays groups. In that way, you can assign the user accounts of CAS genesisWorld to the corresponding accounts in the Active Directory within a group.

• Importing Windows users
• Users: Authentication tab

Outside of the intranet, users can log on with CAS genesisWorld Web or the mobile apps via Active Directory, if you define LDAP access.

• Defining LDAP access

Introduction

Integrating Active Directory into CAS genesisWorld has the following effects.

• In CAS genesisWorld user accounts are authenticated via Active Directory.
• This removes the need to manage authentication in CAS genesisWorld, or having to manage authentication in 2 systems.

Multiple user cases are possible when deploying integration.

• You can transfer all or some of the user accounts and groups to CAS genesisWorld via an import.
• You can create individual user accounts in the Active Directory and then map them to the user accounts in CAS genesisWorld.
• You can synchronize all or some of the user accounts automatically using a service. This can have several consequences:

In the Active Directory newly created user accounts and/or groups are automatically created as user accounts in CAS genesisWorld.

User accounts which were deleted in the Active Directory are deactivated in CAS genesisWorld.

• Deactivated

If, after a synchronization, more user accounts than free licenses exist, then new users will not be able to log on to CAS genesisWorld. You will have to activate a license for the user accounts.

• Licenses area

You define the authentication of new user accounts and logging on to CAS genesisWorld using identical functions when; importing user accounts, when mapping an individual user account and when synchronizing.

• Users: Authentication tab

Using attributes as names for user accounts

• Select an attribute on the General tab of the Active Directory Integration window. The samAccountName value is entered by default.

The attribute is taken into account when importing Windows user accounts, during the synchronization with Active Directory, and when assigning user accounts from Active Directory and CAS genesisWorld.

• If the Never change the CAS genesisWorld user name option is activated in the synchronization settings for the Active Directory, the user name is not updated.

Please note the following characteristics depending on the authentication method:

• Use Windows logon data: The LoginName user name used for logon still corresponds with the samAccountName attribute in Active Directory. This is independent of the attribute which has been set for the UserName user name.
• Support integrated Windows authentication: The LoginName user name used during logon corresponds with the UserName user name.

• Users: Authentication tab

Configuring a synchronization

After an import or mapping of user accounts, the CAS genesisWorld Application Server can access the Active Directory server(s).

• In the Active Directory Integration window, you can select the server on the General tab.
• On the Synchronization tab, you start the synchronization using Activate service which is running over a Window service on the CAS genesisWorld Application Server.

If the option is deactivated, then the service will run, but the synchronization will not occur.

• You can also predetermine synchronizations at regular time intervals or configure a Daily synchronization at a fixed time.
• Using the Synchronize new groups and users option, new entries are created in the Active Directory and in CAS genesisWorld.

New groups or user accounts have read only rights in CAS genesisWorld, you can change these rights later if you wish.

• User/Group properties: Rights tab

During synchronization, user names, descriptions and e-mail addresses are transferred. The user name can deviate from that in CAS genesisWorld.

• User: General tab

• Never change the CAS genesisWorld user name means that the user name in CAS genesisWorld remains the same even if it differs from that in the Active Directory.
• Select the respective user account in the Groups and users to be synchronize area.

Both Windows groups and organizational units can be imported or synchronized as CAS genesisWorld groups with the corresponding user accounts as members. You can also transfer hierarchical groups from Windows. But you cannot display the corresponding hierarchy in CAS genesisWorld.