Difference between revisions of "AD links"
Line 46: | Line 46: | ||
==Troubleshooting== | ==Troubleshooting== | ||
+ | |||
+ | ===Failed logins=== | ||
If users are not able to log in using their AD details then click on the Activity Report link. This will open a window showing the most recent login attempts from AD linked users. This will provide more information as to why the login failed. <br> <br> | If users are not able to log in using their AD details then click on the Activity Report link. This will open a window showing the most recent login attempts from AD linked users. This will provide more information as to why the login failed. <br> <br> | ||
+ | |||
+ | ===Assigning SIMS database IDs to AD records=== | ||
If you want to allow staff to login using their Active Directory details, but have not given them trusted login accounts in SIMS, then the staff records in AD will need a field that hosts the staff members' SIMS database ID number. You can click the Staff Report link to download an XML file that contains all of the SIMS database ID numbers for staff with some other identifying fields (such as name and staff code). <br> <br> | If you want to allow staff to login using their Active Directory details, but have not given them trusted login accounts in SIMS, then the staff records in AD will need a field that hosts the staff members' SIMS database ID number. You can click the Staff Report link to download an XML file that contains all of the SIMS database ID numbers for staff with some other identifying fields (such as name and staff code). <br> <br> | ||
+ | |||
+ | Another solution is to use the [[AD import]], which is a script that will automatically update the AD records providing you have a correctly formatted CSV file. <br> <br> | ||
[[Category:configuration]] | [[Category:configuration]] | ||
[[Category:technical]] | [[Category:technical]] |
Revision as of 15:42, 29 July 2015
Additional Module |
Contents
Introduction
The AD links page is used to link Insight with your Active Directory. This allows students, staff and parents to log in to Insight using the Active Directory login details. This is the only method that allows students to log in. Once accounts are created, pupils can log in to Insight and have all the same role options as a standard parental account - which can be configured to suit your needs.
AD Links is an optional add-on for Insight and costs £175 p.a. You can check whether or not your school has purchased the AD links module by going to the licence details page.
Configuring AD links
You will first need to enter the details of your Active Directory into the fields on this page. Once this has been done, existing student, staff or parent accounts can be linked to the AD by performing a synchronisation.
Check in AD when logging in
If this is switched off, all AD logins will be disabled
Domain
Enter the domain to use when checking for AD accounts. The domain should be in the form: mydomain.local
User Container
Enter the containers of the users that you wish to grant access to. You should enter this in the following form: CN=Users,DC=mydomain,DC=local
Domain reading user and domain reading password
Enter the username and password of an account to use to check the Active Directory for logins
Use alternative AD field in place of EmployeeID
By default Insight will check the EmployeeID field for the SIMS database ID number to identify parents. This will also be required for staff if you want them to log in using the Active Directory details, but they do not have trusted login accounts in SIMS.
Switch this option on if you want to use a different field
Name of alternative field to use
When the above option is switched on, you will need to specify the name of the alternative field in AD that contains the SIMS database ID number
Use student email addresses from AD
The alternative is to use the email addresses in SIMS
Seamless login
An additional benefit of using this method to log in is that it supports Integrated Windows Authentication in supported browsers. This means that if the user is logged onto a computer within the domain, their account information can be used to log seamlessly into Insight, without requesting them to enter their account details by hand.
To enable this, all of the previous settings must be working correctly.
To implement seamless login, direct those users who you expect to be able to login to the ADSSO.aspx page initially. If the user is not already logged into the domain, they will be redirected to the normal login page, where they can still enter their Active Directory username and password. Otherwise, depending on their Security Group membership, they will be passed straight through to Insight.
If you do not expect a user to be able to log in this way, they should be directed to the normal login URL.
Troubleshooting
Failed logins
If users are not able to log in using their AD details then click on the Activity Report link. This will open a window showing the most recent login attempts from AD linked users. This will provide more information as to why the login failed.
Assigning SIMS database IDs to AD records
If you want to allow staff to login using their Active Directory details, but have not given them trusted login accounts in SIMS, then the staff records in AD will need a field that hosts the staff members' SIMS database ID number. You can click the Staff Report link to download an XML file that contains all of the SIMS database ID numbers for staff with some other identifying fields (such as name and staff code).
Another solution is to use the AD import, which is a script that will automatically update the AD records providing you have a correctly formatted CSV file.