Connecting Domain User

Foresight Analytics Platform uses information from domain directory service or global directory for working with domain security subjects. A domain user can be connected if the following supported DBMS: PostgreSQL/Postgres Pro, Oracle, Microsoft SQL Server.

Domain users can be connected by the users who have the Changing User Permissions, Distributing Roles, Changing Policy and Creating and Deleting Users privileges.

TIP. Before connecting domain users it is recommended to check if LDAP settings are identical in the settings.xml files located in different environments. If the settings are identical, ensure correct work of domain users by connecting them within the same application: either in the web application or in the desktop application.

NOTE. When roles of information security administrator and application administrator are separated, only the application administrator can connect domain users.

For details about how to work with dialogs of domain user selection, go to the Selecting Users and Groups section.

NOTE. When selecting domain user, the Subject Type and Arrangement radio buttons are disabled in dialog boxes.

After the required users are determined, click the OK button, after which the account creation dialog box opens:

NOTE. The Create Accounts dialog box is not displayed for the users who have already been created in the repository.

To avoid DBMS Oracle errors, user name length is limited to 30 Latin characters or 15 Cyrillic characters in UTF-8 encoding.

In the Short Name field enter an additional user short name which will be used on granting permissions at the DBMS level.

NOTE. The field is available only in desktop application on adding domain user to Oracle DBMS with violation of limitation on name length.

On entering the short name, the numeric format is available only after the text, for example, USERTEST123.

After adding a domain user to DBMS Oracle, all queries will be executed via the short name, which is linked with the full one in Foresight Analytics Platform and it is displayed in user properties.

When adding a domain user to Oracle DBMS, name length limitation is checked. In Foresight Analytics Platform, the user with full name SIDOROV_IV is sent to the DBMS Oracle taking into account the SIDOROV_IV@DEV.FS.FSIGHT.DOMAINTEST domain, so it violates name limitation defined at 30 characters. It is required to add the SIDOROV short name to the user in order to provide a communication between DBMS Oracle and Foresight Analytics Platform without any errors.

When the Create on DB Server checkbox is selected, the user to be added is created on the database server and the system requests credentials of the user, who has permissions to create users. If a domain user is connected in the repository based on PostgreSQL DBMS, the administrator should have the CREATEROLE privilege on the DBMS level.

When the Grant Rights on DBMS Level checkbox is selected, permissions for the added user are distributed at database level, and the system requests credentials of the user, who has permissions to create tables.

If the checkbox is deselected, after adding the user and changing his privileges, or granting permissions for repository objects the user is not granted corresponding permissions on DBMS server.

On selecting the Apply in All Similar Cases checkbox, for all domain users to be added to platform repository, the selected actions will be applied without any additional requests.

NOTE. Domain users are also added to the user list if they have been added to a group or to a privilege holders list.

Features of Connecting Domain Users for Different DBMS

If the repository is working via PostgreSQL DBMS, to add a domain user set the SSPI or GSS API authentication type: