When enabled, it is no longer necessary to configure users, when a user logs in, EnvisionSCADA will send an authentication request to the AD. The AD will return whether the credentials were correct, or not.
If the credentials were correct, EnvisionSCADA will match the users AD Groups with the internal EnvisionSCADA UserGroups and log in this user with the rights of the corresponding UserGroup. If the user has no matching UserGroups, the user will be rejected.
You can set a corresponding AD Group name for each UserGroup in the UserGroup Settings. You can also set a default HomePage and DefaultLanguage. Users containing the Administrators group, will never be authenticated against the AD, and can always log into the system regardless. When an AD user’s password is expired, or the user is disabled, or any other problem, the system will give the message “Invalid Credentials”. The user in this case, needs to contact his IT support, and/or use his regular computer or Windows system to take the necessary steps. In the UserGroups Settings, configure the following:
In the Parameters menu, you need to configure an LDAP/LDAPS (Active Directory) connection:
LDAP Host address (DNS or IP Address)
LDAP Port (389 LDAP / 636 LDAPS / something else)
Use Secure Socket Layer (Enable SSL)
Search Base
Should be enabled in LDAPS, can be disabled for LDAP or testing Verify Server Certificate Should be enabled in LDAPS, can be disabled for LDAP or testing
EnvisionSCADA supports the UserPrincipalName (UPN), not the Pre-Windows 2000 sAMAccountName (SAM) name. So, a user typically logs in with user.name@domain.com + password.
When AD is enabled, the ‘Change Password’ field disappears, and the user needs to change the password on the windows computer. Note: When using Verify Server Certificate, please note that the root certificate needs to be present in the “Trusted Root Certification Authorities” store of the EnvisionSCADA server. When the certificate was rejected, the Admin user can find the reason in the SystemLog Viewer:
The user will get the following error message:
In this case, it says RemoteCertificateNameMismatch, which means that the name on the certificate does not match the host name (IP or DNS) which is being used. Another common one is RemoteCertificateChainErrors, which means that there is no corresponding root certificate installed on the EnvisionSCADA server, or the certificates don’t match. The computer or iPC does not need to be put in the domain for LDAP to work. For users that wish to access the EnvisionSCADA client from their own already authenticated Windows machine, we’re working on Single-Sign On (SSO).