Add additional user providers

AVEVA Work Tasks allows a Repository to be associated with more than one User Provider. This enables a single Repository to authenticate users from multiple identity sources, such as Active Directory domains in different environments.

When to use this configuration

Use this approach when a Repository must authenticate users from multiple identity providers, for example:

• Integrating users from multiple Active Directory domains

• Supporting users across different organizational identity systems

Example scenario

A repository named Main Repo must authenticate users from two Active Directory domains:

• Workflow Management

• NG

The repository is initially configured with one Active Directory domain. You must extend it to support the second domain.

Create a repository with the first Active Directory

1. Create a new repository.

2. In the User Provider drop-down, select Active Directory.

3. Provide the Active Directory connection details.

4. Select Test LDAP to verify the connection.

   If the AD details are not automatically displayed, enter them manually. You can use the AVEVA Work Tasks Active Directory Tool to retrieve the required LDAP details.

5. Once created, the system automatically adds entries in SKEntity table and SKEntityDataSourceProvider table.

Add the second Active Directory to the same repository

To associate an additional Active Directory:

1. Open the Repository Database. Navigate to the AVEVA Work Tasks Repository database associated with your repository.

2. Verify existing entries in SKEntity table -

• Open the SKEntity table.

• Locate the entries related to the Repository.

• Identify the rows for:

  • UserEntity

  • RoleEntity

The DefinitionXML column contains the authentication provider schema.

Example (UserEntity):

<entity type="user">

<properties>

<property name="UserName" displayname="Name" type="string"/>

<property name="UserId" displayname="Id" purpose="identifier" type="string"/>

<property name="UserDisplayName" displayname="Display Name" purpose="name" type="string"/>

<property name="UserEmail" displayname="Email" purpose="email" type="string"/>

</properties>

</entity>

Example (RoleEntity):

<entity type="role"></entity>

Add a new entry in SKEntityDataSourceProvider table

6. Open the SKEntityDataSourceProvider table.

7. Add two new rows for the new Active Directory provider.

   • Provide the details of the new Active Directory in XML format.

   • Enter the details in the SKEntityDataSourceProvider, before making the new AD entry. The columns, EntityId are mapped with SKEntity ID column.

   • The DisplayName column has the display value. The Definition XML will have the XML schema of attributes used to identify users from the AD.

Configure DefinitionXML for the new AD

The new entry will have a similar XML structure as the existing Active Directory entry. You must modify:

• LDAPServer

• LDAPSearchBase

• DomainName

• Authentication credentials

Ensure:

• The DisplayName has the value to be displayed in the Enterprise Console site.

• The Provider value has the same value as the other row entry (in this case, activedirectory).

Verify configuration

8. Navigate to Central Configuration and select Repository Provider List.

9. Select the repository.

10. Under User Entity, verify that two Active Directory providers are listed (Workflow Management and NG).

11. Select DefinitionXML to confirm correct configuration.

12. Open Enterprise Console.

13. Verify that users from both Active Directory domains can log in and access the Repository.

Manage users in both domains

If users exist in both Active Directory domains and share common attributes, you must use the <mappingfields> element in the DefinitionXML.

A sample schema with <mappingfields> element is as below:

<mappingfields>

<mappingfield mappedfromprovider="activedirectory">

<fields mappedtoprovider="ngactivedirectory">

<field name="sAMAccountName" mappedto="sAMAccountName"/>

</fields>

</mappingfield>

</mappingfields>