Runtime Association of AD Groups to Roles

When commissioning a machine, there's a good chance the developer won't know the proper name of the groups that the domain administrator will use in the Active Directory or LDAP server. To overcome this issue, this example uses the Roles of FactoryTalk Optix to enable some UI elements, then when the project is deployed to the target device, an administrator can create the list of groups coming from the domain controller, and assign them one or more roles.

Disclaimer

Rockwell Automation maintains these repositories as a convenience to you and other users. Although Rockwell Automation reserves the right at any time and for any reason to refuse access to edit or remove content from this Repository, you acknowledge and agree to accept sole responsibility and liability for any Repository content posted, transmitted, downloaded, or used by you. Rockwell Automation has no obligation to monitor or update Repository content

The examples provided are to be used as a reference for building your application and should not be used in production as-is. It is recommended to adapt the example for the purpose, of observing the highest safety standards.

Usage

Important

This project requires an Active Directory server to be reachable

Configuring the Active Directory server

1. Make sure the server has some valid certificates
2. Create some users
3. Create some groups
4. Assign users to groups (for example: user1 to Line1_User)

Configuring of the project

1. Navigate to Optix_Sample_AssignRolesToGroupsAtRuntime/Authentication/DefaultDomainName and set the default domain name
2. Navigate to Optix_Sample_AssignRolesToGroupsAtRuntime/Authentication/DomainServerAddress and set the IP Address (or DNS) of the Active Directory server
3. Navigate to Optix_Sample_AssignRolesToGroupsAtRuntime/Authentication/CACertificateFile and import the CA certificate of the Active Directory server
4. Make sure the machine can ping the Active Directory server address/DNS

Running the project

1. Navigate to the RolesToGroups page
2. Create the groups with the same Group name as shown in the Active Directory server console (for example: Line1_User, Line1_SuperUser)
3. Select one of the created groups from the ListBox and select which roles to assign (for example: Line1_User to Role1)
4. Hit Apply to save the changes
5. Navigate to the Permissions page
6. Login with one of the users from the AD (for example: user1 which was assigned to Line1_User)
7. Check that Role1 LED turns on