Technical Reference Manual - InduSoft

Project Security
To make this option work, you must first extend the server's LDAP schema to contain additional
information about the project security system. See Extending the LDAP schema to allow saving
of security rights.
Once that is done, click Modify to provide your LDAP server credentials and then select Enable.
In the LDAP Query Customization tab of the dialog, you can further customize how LDAP server queries are
formed:
LDAP Query Customization
By default, the LDAP server provides a list of all registered users and groups, so in a large or complex network
environment, that can result in an impractically long list to manage when you're configuring your project
security system. To restrict the list of users and groups, you may customize the LDAP query to eliminate
anyone who should never have access to your project: click Modify to provide your LDAP server credentials,
select Enable, and then configure the Search Base and Filter Query settings. For the proper syntax, consult the
LDAP server documentation.
Also, some non-standard LDAP implementations — such as Linux-based LDAP servers and Active Directory
Application Mode (ADAM) in Windows Server 2003 — use different entity identifiers and attributes. Those can
be customized in this dialog, but again, it should only be done by an experienced LDAP administrator.
Example of alternate attributes in ADAM
LDAP Server User name attribute Group name attribute User lock attribute
Active Directory sAMAccountName sAMAccountName userAccountControl
Active Directory Application Mode (ADAM) Name Name userAccountControl
Extending the LDAP schema to allow saving of security rights
In order to save IWS project security rights back to a Domain (LDAP) server, the server's LDAP schema must
be extended to contain the additional information.
The server must already be configured and running on your network, and you must have sufficient privileges
to make changes to the server configuration.
In this procedure, you will create a new attribute called "proprietarySCADAInfo" to contain the IWS project
security rights, and then you will add the attribute to the "person" and "group" classes in the server
configuration. These classes correspond to users and groups in the project security system.
Please note this procedure only shows how to extend the schema in Microsoft Active Directory running on
Windows Server 2003. The exact procedure is different for other LDAP servers and operating systems, but the
basic steps should be essentially the same. Please consult your LDAP server documentation.
Page 380
InduSoft Web Studio