ePO - On-prem can simplify the process of managing users by automatically creating Windows authentication users based on their Active Directory group membership.
If Active Directory User Login is enabled when an unknown user tries to log on, ePO - On-prem checks to see any permission sets mapped to Active Directory groups for which the user is a member. If there are, ePO - On-prem creates a Windows authentication user and assigns the mapped permission sets to it.
To enable this feature, you must do the following:
Active Directory User Login must be enabled
At least one permission set must be mapped to the user's Active Directory group
A registered LDAP server must be configured for the domain, so that ePO - On-prem can determine the user's group membership
Active Directory User Login
You can enable the Active Directory User Login server setting from the Server Settings page, which allows user records to generate automatically when the following conditions are met:
Users provide valid credentials, using the
<domain\name>format. For example, a user with Windows credentialsjsmith1, who is a member of the Windows domain namedeng, supplies these credentials:eng\jsmith1, with the appropriate password.An Active Directory server that contains information about this user has been registered with ePO - On-prem.
The user is a member of at least one Domain Local or Domain Global group that maps to a ePO - On-prem permission set.
Support for Universal Groups
ePO - On-prem partially supports Active Directory Universal Groups.
It restricts its communication to one domain when retrieving group information.
It supports these features when retrieving group memberships for a Universal Group:
Direct membership lookup in a Universal Group
Indirect membership lookup through a nested Universal Group
Indirect membership lookup through Global or Domain Local Groups, if that group resides in the same domain as the Global Catalog being used to perform the lookup
Finally, it does not support indirect membership when that group resides on a different domain from the Global Catalog being used to perform the lookup.
Register an LDAP server
You must register LDAP servers with your ePO - On-prem server to permit dynamically assigned permission sets for Windows users. Dynamically assigned permission sets are permission sets assigned to users based on their Active Directory group memberships.
Note
Users trusted via one-way external trusts are not supported.
The user account used to register the LDAP server with ePO - On-prem is trusted through a bidirectional transitive trust. Otherwise, it must physically exist on the domain that the LDAP server belongs to.
Map a permission set to the Active Directory group
Assign at least one permission set to an Active Directory group other than a user's Primary Group. Dynamically assigning permission sets to a user's Primary Group is not supported, and results in application of only those permissions manually assigned to the individual user. The default Primary Group is Domain Users.
Users attempting to log on to a ePO - On-prem server with Windows authentication need a permission set assigned to one of their Active Directory groups.
Consider these items when determining how permission sets are assigned:
Permission sets can be assigned to multiple Active Directory groups.
Permission sets can be dynamically assigned only to an entire Active Directory group. They can't be assigned to just some users in a group.
If you want to assign special permissions to an individual user, create an Active Directory group that contains only that user.
Advanced Windows authentication
Users can authenticate with Windows credentials from the domain that the ePO - On-prem server uses. They can also authenticate by using any domain that has a two-way trust relationship with the ePO - On-prem server's domain. If you have users in domains that don't meet that criteria, enable and configure advanced Windows authentication.