×

It's time to move from Web HMI to Proficy Operations Hub! Visit the Operations Hub web page, download a free trial or check out the datasheet.

Home
Set Up User Security
Configure Active Directory Authentication
Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.

Web HMI Products Documentation

Set Up User Security
- User Account Overview
  Users consist of both operators and GE administrators. In Application Assembler (ThingWorx), a GE administrator creates and maintains user and group accounts for access to Web HMI environments.
- Access the Application Assembler
  Set up security for Web HMI users and groups in the Application Assembler.
- Create User Accounts
  You create user accounts by duplicating the default user templates, GEAdmin and GEUser. All settings are inherited from these default user templates except for the password and group membership.
- Assign Users to a Group
  As a GE administrator, you assign users duplicated from the GEUser or GEAdmin user template to the appropriate group.
- Change User Passwords
  GE administrators can change existing user passwords when needed.
- Define LDAP Settings
  Use the LDAP Directory Services in Application Assembler (ThingWorx) to manually edit Web HMI users to exactly match the user names in Active Directory, and then assign them to groups.
- Configure Active Directory Authentication
  Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.
  - Set Up the AD Server Connection
    Use the Connection Settings section in the DirectoryServices page to define how to communicate with the AD server.
  - Define the AD Schema Mappings
    Use the Schema Mappings section in the DirectoryServices page to manage the mappings of the user and group objects used in the Active Directory authentication.
  - Map AD Groups with ThingWorx Groups
    Use the Group Mappings section in the DirectoryServices page to associate Active Directory groups with ThingWorx groups. Permissions are set by the ThingWorx groups and are used at Web HMI runtime.
  - Enable User Provisioning
    Use the User Provisioning section in the DirectoryServices page to enable the AD domain server to dynamically create, modify, and delete users in Web HMI. For example, by enabling user creation, the Active Directory automatically creates new users on first login to Web HMI.
  - Set User Defaults
    Use the User Defaults section in the DirectoryServices page to define settings to help you manage and identify provisioned users.
  - Exclude Users from Provisioning
    Use the User Provisioning Exclusion List section in the DirectoryServices page to specify which Web HMI users to exclude from all the user provisioning features.

Configure Active Directory Authentication

Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.

You can set up user provisioning for each domain server.

In the SECURITY section of the Application Assembler page, select Directory Services.
Select the ActiveDirectory check box.
In the main navigation bar, select Duplicate.
A new entity is created, and the General Information page appears.
In the Name box, enter a new name for this entity, such as GE_WebHMI_AD_DomainX.
In the Description box, enter a description for the type of authentication, such as Active Directory Service for Domain X.
Select the Enabled check box.
Set the priority domain order for authenticating users. If an AD directory service with the lowest priority setting, such as 1, fails to authenticate a user, the next AD directory service in the priority order is used to authenticate a user, and so on.
Select Save.
In the Active Directory entity that you just created, select Configuration in the ENTITY INFORMATION section.
The Configuration for DirectoryServices page appears, displaying sections for completing the following tasks: