×

It's time to move from Web HMI to Proficy Operations Hub! Visit the Operations Hub web page, download a free trial or check out the datasheet.

Home
Set Up User Security
Configure Active Directory Authentication
Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.
Set User Defaults
Use the User Defaults section in the DirectoryServices page to define settings to help you manage and identify provisioned users.

Web HMI Products Documentation

Set Up User Security
- User Account Overview
  Users consist of both operators and GE administrators. In Application Assembler (ThingWorx), a GE administrator creates and maintains user and group accounts for access to Web HMI environments.
- Access the Application Assembler
  Set up security for Web HMI users and groups in the Application Assembler.
- Create User Accounts
  You create user accounts by duplicating the default user templates, GEAdmin and GEUser. All settings are inherited from these default user templates except for the password and group membership.
- Assign Users to a Group
  As a GE administrator, you assign users duplicated from the GEUser or GEAdmin user template to the appropriate group.
- Change User Passwords
  GE administrators can change existing user passwords when needed.
- Define LDAP Settings
  Use the LDAP Directory Services in Application Assembler (ThingWorx) to manually edit Web HMI users to exactly match the user names in Active Directory, and then assign them to groups.
- Configure Active Directory Authentication
  Application Assembler (ThingWorx) provides the ActiveDirectory template for you to duplicate to create a directory service for each one of your AD domain servers.
  - Set Up the AD Server Connection
    Use the Connection Settings section in the DirectoryServices page to define how to communicate with the AD server.
  - Define the AD Schema Mappings
    Use the Schema Mappings section in the DirectoryServices page to manage the mappings of the user and group objects used in the Active Directory authentication.
  - Map AD Groups with ThingWorx Groups
    Use the Group Mappings section in the DirectoryServices page to associate Active Directory groups with ThingWorx groups. Permissions are set by the ThingWorx groups and are used at Web HMI runtime.
  - Enable User Provisioning
    Use the User Provisioning section in the DirectoryServices page to enable the AD domain server to dynamically create, modify, and delete users in Web HMI. For example, by enabling user creation, the Active Directory automatically creates new users on first login to Web HMI.
  - Set User Defaults
    Use the User Defaults section in the DirectoryServices page to define settings to help you manage and identify provisioned users.
  - Exclude Users from Provisioning
    Use the User Provisioning Exclusion List section in the DirectoryServices page to specify which Web HMI users to exclude from all the user provisioning features.

Set User Defaults

Use the User Defaults section in the DirectoryServices page to define settings to help you manage and identify provisioned users.

Set these user defaults as needed:

Option	Description
Provisioned User's Default Domain Prefix	A domain prefix for user names to use when provisioning users. For example, if you connected this directory service to the mycompany.com domain, enabled user provisioning, and set this prefix to mycompany.com@, the first time a user, such as john, logs in to Web HMI as mycompany.com@john, the login request goes to the directory service to authenticate john, and then automatically creates mycompany.com@john as a new Web HMI user. AD views this user as john, but Web HMI identifies this user as mycompany.com@john. Setting a domain prefix allows you to explicitly control the domain server for users to log in to when these users may exist in several domains.
Provisioned User's Default Description	A description generated for all provisioned users, such as Auto-provisioned by domain server ge.local.
Provisioned User's Default Home Mashup	The name of a home mashup to appear when provisioned users log in.
Provisioned User's Default Mobile Mashup	The name of a mobile mashup to appear when provisioned users log in.
Provisioned User's Default Tags	A set of model tags that are set on all users provisioned by this directory service. When Workflow is integrated with Web HMI, you must add the domain as a tag term in the geActiveDirectoryDomain vocabulary, and then select this term in the Provisioned Users Default Tag box. Web HMI checks this vocabulary to see which domain a user is logged in to, and then passes the domain name to the Workflow server. For example, if your domain is mycompany.com, add the mycompany.com term to the geActiveDirectoryDomain vocabulary, as shown below. Then add the new mycompany.com term to the Provisioned Users Default Tag box, as shown below. Note: Use this setting for a single domain server. If a user exists in multiple domain servers, use the above Provisioned User's Default Domain Prefix setting.

Select Save.