Enable repository cross-domain roles

Overview

An Active Directory (AD) role that includes users from different domains (cross domains) can be mapped to an AVEVA Work Tasks role by using the AVEVA Work Tasks Role Provider.

Example:

Users John and Jim from domain TelematicsUS, and users Mike and Bob from domain TelematicsAU, are added to role Team HR in domain TelematicsMain. The role Team HR then contains all four users across domains.

Consider the following scenario:

• Child01: user Jim belongs to the role Team HR.

• Child02: user Mike belongs to role Team R & D. The Team R & D role includes:

  • Mike (Child02)

  • John (Parent)

  • Jim (Child01)  

With cross-domain enabled, Work Tasks should be able to:

• Fetch roles for a user across domains

• Fetch users for a role across domains

Enable cross-domain support for repository created without role provider

Prerequisites

1. Add all required Active Directory domains as providers for the repository.

2. Domain controllers must be in the same forest with a parent-child relationship.

3. Separate forests are not supported.

4. Set the IsCrossDomain property to True for all Active Directory role providers in the database:

   • Table: SKEntityDataSourceProvider

   • Column: DefinitionXml

Automatic sync

When users are added to or removed from an AD group that is used for cross-domain mapping, Work Tasks updates role/user mappings during the next scheduled sync.

Note: Updates are not immediate. Changes are reflected only after the next sync cycle completes based on the configured interval (for example, 24 hours or 4 hours).

Default and recommended intervals

• Default interval: every 24 hours (1 day) (recommended for production).

• Testing/development: interval can be reduced to 5–10 minutes for testing.

• Very low interval (1 minute): may not produce immediate or consistent updates due to LDAP delays or caching.

• Production minimum (lowest recommended): 4 hours.

View synchronization interval

The synchronization interval is stored in the SKAddInProviders table for the provider named SyncCrossDomain.

View current interval

SELECT Settings, *

FROM SKAddInProviders

WHERE Name = 'SyncCrossDomain';

Example value in Settings:

<FetchInterval>1.00:00:00</FetchInterval>

Format: Day.Hour:Minute:Second

Change synchronization interval

Example: set interval to 5 hours:

UPDATE SKAddInProviders

SET Settings = '<FetchInterval>0.05:00:00</FetchInterval>'

WHERE Name = 'SyncCrossDomain';

Where: 0.05:00:00 = 0 days, 5 hours, 0 minutes, 0 seconds

What changes after synchronization

• When a new user is added to an AD group that is part of SKCrossDomainUserRoles, the user will be synchronized and added to the SKCrossDomainUserRoles table during the next synchronization cycle.

• When an existing user is removed from an AD group that belongs to SKCrossDomainUserRoles, the user entry will be synchronized and removed from the SKCrossDomainUserRoles table in the next synchronization cycle.

  Note: The synchronization task is registered in the SWTaskList table. If you need to check when the next synchronization will occur, refer to the DueDateTime column (in UTC).

Manual sync

The Synchronize Roles list item is used to map cross-domain provider roles. This option is not available by default in the Enterprise Console menu and becomes available only after enabling cross-domain role provider. It is visible only to users with administrative privileges.

While creating a repository:

• Select Active Directory as the Resource Provider.

• Enable the IsCrossDomain Role Provider option.

After these settings are configured, the Synchronize Roles sub-menu becomes available under Enterprise Console > Tools. This menu is visible only to users with administrative privileges.

Synchronize roles manually

5. In the Enterprise console, select the menu icon.

6. Select Tools, and then select Synchronize Roles.

   The Synchronize Roles window appears.

7. In the Search Role text box, enter the role name and select Search.

   The available roles are listed in the Choose Roles section. For example, searching for team lists all roles that contain the word team.

8. Select the role or roles to synchronize.

9. Select Synchronize.

After the synchronization of the selected role(s) is complete, a confirmation message is displayed.