It's time to move from Web HMI to Proficy Operations Hub! Visit the Operations Hub web page, download a free trial or check out the datasheet.

Home
Set Up User Security
Configure Active Directory Authentication
Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.
Map AD Groups with ThingWorx Groups
Use the Group Mappings section in the DirectoryServices page to associate Active Directory groups with ThingWorx groups. Permissions are set by the ThingWorx groups and are used at Web HMI runtime.

Web HMI Products Documentation

Set Up User Security
- User Account Overview
  Users consist of both operators and GE administrators. In Application Assembler (ThingWorx), a GE administrator creates and maintains user and group accounts for access to Web HMI environments.
- Access the Application Assembler
  Set up security for Web HMI users and groups in the Application Assembler.
- Create User Accounts
  You create user accounts by duplicating the default user templates, GEAdmin and GEUser. All settings are inherited from these default user templates except for the password and group membership.
- Assign Users to a Group
  As a GE administrator, you assign users duplicated from the GEUser or GEAdmin user template to the appropriate group.
- Change User Passwords
  GE administrators can change existing user passwords when needed.
- Define LDAP Settings
  Use the LDAP Directory Services in Application Assembler (ThingWorx) to manually edit Web HMI users to exactly match the user names in Active Directory, and then assign them to groups.
- Configure Active Directory Authentication
  Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.
  - Set Up the AD Server Connection
    Use the Connection Settings section in the DirectoryServices page to define how to communicate with the AD server.
  - Define the AD Schema Mappings
    Use the Schema Mappings section in the DirectoryServices page to manage the mappings of the user and group objects used in the Active Directory authentication.
  - Map AD Groups with ThingWorx Groups
    Use the Group Mappings section in the DirectoryServices page to associate Active Directory groups with ThingWorx groups. Permissions are set by the ThingWorx groups and are used at Web HMI runtime.
  - Enable User Provisioning
    Use the User Provisioning section in the DirectoryServices page to enable the AD domain server to dynamically create, modify, and delete users in Web HMI. For example, by enabling user creation, the Active Directory automatically creates new users on first login to Web HMI.
  - Set User Defaults
    Use the User Defaults section in the DirectoryServices page to define settings to help you manage and identify provisioned users.
  - Exclude Users from Provisioning
    Use the User Provisioning Exclusion List section in the DirectoryServices page to specify which Web HMI users to exclude from all the user provisioning features.

Map AD Groups with ThingWorx Groups

Use the Group Mappings section in the DirectoryServices page to associate Active Directory groups with ThingWorx groups. Permissions are set by the ThingWorx groups and are used at Web HMI runtime.

When a user is auto-provisioned to an AD group, that user is automatically added to its mapped ThingWorx group.

You must have created and configured the ThingWorx groups to use for AD authentication.

Select Add.
In the Active Directory Group Name box, select the AD group, such as WebHMIAdmins, that you want to map with a ThingWorx group.

Note: If a red circle with a line through it appears when selecting an AD group (not connected to AD domain), select Save, and then try closing and reopening the DirectoryServices page. You should now be connected.
In the ThingWorx Group Name box, select to choose the ThingWorx group, such as Web HMIAdmin, to map with the specified AD group.