Dabacon project active directory authentication in Unified Engineering

For Dabacon projects with Active Directory Authentication enabled, it is possible to define project User (Group) Membership Authentication based on Connect Group membership.

With this approach, Connect Group and user memberships are synchronized to a corresponding Active Directory Group in the Unified Engineering environment. This can be specified to manage access in the Active Directory User Creation form which is in AD Configuration of AVEVA Administration.

In some cases, the synchronization process between Connect and Unified Engineering Active Directory can result in group name mis-matches which adversely affects Group name checking in the form and user access.

If you want to use of this feature, following are the prerequisites:

• Assign the Standard Customer Connect Role for the respective Unified Engineering Service to the Connect Group. This will ensure the Connect Group (and membership) is synchronized to the Unified Engineering environments’ Active Directory.

  

• Connect group Naming convention requirements:

  • Should not be longer than 20 characters in length

  • Should not contain any "_" (underscores)

  • Should not contain any " " (spaces)

• Use "-" (hyphen) as separator in Connect Groups names.

To create Connect Groups for Active Directory Authentication that do not adhere to the points above, note that:

• The synchronization affects the resulting Active Directory group names:

  • Curtails the Connect group name to 20 characters long (tail removed)

  • Replaces "_" (underscores) and " " (spaces) with "-" (hyphen)

• The Check button in the Active Directory User Creation form will return a Could not find group for the modified Active Directory group. However, the authentication control works.