×

It's time to move from Web HMI to Proficy Operations Hub! Visit the Operations Hub web page, download a free trial or check out the datasheet.

Home
Set Up User Security
Configure Active Directory Authentication
Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.
Set Up the AD Server Connection
Use the Connection Settings section in the DirectoryServices page to define how to communicate with the AD server.

Web HMI Products Documentation

Set Up User Security
- User Account Overview
  Users consist of both operators and GE administrators. In Application Assembler (ThingWorx), a GE administrator creates and maintains user and group accounts for access to Web HMI environments.
- Access the Application Assembler
  Set up security for Web HMI users and groups in the Application Assembler.
- Create User Accounts
  You create user accounts by duplicating the default user templates, GEAdmin and GEUser. All settings are inherited from these default user templates except for the password and group membership.
- Assign Users to a Group
  As a GE administrator, you assign users duplicated from the GEUser or GEAdmin user template to the appropriate group.
- Change User Passwords
  GE administrators can change existing user passwords when needed.
- Define LDAP Settings
  Use the LDAP Directory Services in Application Assembler (ThingWorx) to manually edit Web HMI users to exactly match the user names in Active Directory, and then assign them to groups.
- Configure Active Directory Authentication
  Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.
  - Set Up the AD Server Connection
    Use the Connection Settings section in the DirectoryServices page to define how to communicate with the AD server.
  - Define the AD Schema Mappings
    Use the Schema Mappings section in the DirectoryServices page to manage the mappings of the user and group objects used in the Active Directory authentication.
  - Map AD Groups with ThingWorx Groups
    Use the Group Mappings section in the DirectoryServices page to associate Active Directory groups with ThingWorx groups. Permissions are set by the ThingWorx groups and are used at Web HMI runtime.
  - Enable User Provisioning
    Use the User Provisioning section in the DirectoryServices page to enable the AD domain server to dynamically create, modify, and delete users in Web HMI. For example, by enabling user creation, the Active Directory automatically creates new users on first login to Web HMI.
  - Set User Defaults
    Use the User Defaults section in the DirectoryServices page to define settings to help you manage and identify provisioned users.
  - Exclude Users from Provisioning
    Use the User Provisioning Exclusion List section in the DirectoryServices page to specify which Web HMI users to exclude from all the user provisioning features.

Set Up the AD Server Connection

Use the Connection Settings section in the DirectoryServices page to define how to communicate with the AD server.

Define the following connection settings:

Option	Description
URI Scheme	The protocol to communicate with the AD server. The default is LDAP.
Server FQDN or IP Address	The AD server name or IP address that is targeted for directory queries. The default is localhost. Example: W2012R2
Server Network Port	The AD server port. Do not change the default value of 389 unless another port was set.
Domain Distinguished Name	The domain distinguished name of the top-level directory used for user group lookup. Example: DC=ge,DC=local
Administrative Principal Name	The user name with administrative read access to the specified domain. This name is dependent on the specified User ID Attribute Name in the Schema Mappings section of the DirectoryServices page. Example: CN=John Smith,CN=Users,DC=ge,DC=local
Administrative Password	The password for the above Administrative Principal Name.