The context:
A client environment: SharePoint Foundation 2010
He wants to have a timerjob to update users profiles with data in active directory. Everything OK, I developed the timerjob that gets a catalog from active directory & updates selected fields for every user in the SharePoint hidden users list, that way I can keep a daily update for every user.
The problem: the client has used (as i should have thought) an active directory group that he have to manage permissions in SharePoint something like "All authenticated users".
Now i have no clue on how to update the profiles inside that group because they don't exist in the list.
Any ideas on where to update those profiles ?
Is it possible that the SP site was upgraded from an earlier flavor - specifically 2007 - and this is an artifact of that- NT Authority All Authenticated Users..... This is a catch-all reference sometimes dropped into a group or a listing pointing towards the SP site admin for user access requests. You can control access on it by having it in one group and then setting the permissions of that group as low as possible. But as for reading anything back into your scheme from Active Directory - there's nothing to grab. It's only a flag that tells SharePoint that an ID authenticated within the windows domain and nothing more. It's a default gateway of sorts to allow domain users into the SharePoint site, usually, for read only access or access to request SharePoint unique permissions, or, on some sites, access at a basic visitor level.
Related
I am building a web application for a client, where I will have to set it up on their Windows Server via IIS. I will have to integrate their base of users into my application via Active Directory (not Azure Active Directory). I have already included Windows authentication into my application and it seems to work on my local computer.
What I want to know is:
How to change the login prompt into my custom login page?
How to change the username of the authenticated user (right now when I sign in, I have to write down the name of the device and the name of the user. for example: _device/_user). What I want is for the user to simply be able to only write their username, not device name.
How to manage the access of the users, and how to add roles to them inside the application. Since the user is signed In. I now want to know how do I assign this user a certain role, so I can restrict access to certain pages based on that.
I have been looking through some documentation but not much is mentioned about Active Directory integration or the questions that I have listed above.
Steps;
You need to have System.DirectoryServices and System.DirectoryServices.AccountManagement references in your project, if you want to access AD.
Configure AD name and AD Organizational Units in appsettings.js ActiveDirectory": { "ActiveDirectoryDomainName": "Your Domain", "ActiveDirectoryOrganizationalUnits": "Your AD units" }
In your class method:
Fill your user object with AD values like userPrincipal.EmailAddress,userPrincipal.GivenName,userPrincipal.Guid.Value and etc.
If you want to manage users with roles, then take the GUID from AD (userPrincipal.Guid.Value) and store it another table and map that GIUD with required roles.
Note: If you can share some images and codes
I have installed SonarQube 5.2 and the LDAP plugin 1.5 a few hours ago. I am really happy about the easy configuration of the LDAP plugin in an Active Directory domain.
But I experience something which looks like a huge problem.
1) An AD user loads the web page of the SonarQube instance
[behind the scenes] a user is being created (starting up from the headers of the HTTP request and the information present in the Active Directory)
2) An administrator of the platform (e.g. admin, default administrator of the platform) gives her some rights (e.g. add her to the sonar-administrators group)
the web interface shows an updated set of rights for this user
3) The user starts a new session
!!! The user has lost all of its rights. She doesn't belong anymore to the sonar-administrators group
(expected behavior) the user gets an updated interface, with the menus reserved to the sonar-administrators group
Am I missing some important part of the documentation?
You have configured SonarQube to use an external system to manage security, in this particular case Active Directory. So the default (and expected) behaviour is to delegate both the authentication and the authorizations to this system.
In your example, if you want the user to belong to some specific group, you have to configure this in your Active Directory. Next time the user logs in, he will be associated to this(those) group(s).
Note that the groups must exist in SonarQube otherwise this won't work (i.e. you have to manually add them in the "Security > Groups" ).
To elaborate on Fabrice's answer, when you have a user or group in the AD that you want to have administration permissions to the SonarQube instance, go to:
<your sq instance>/roles/global
and add the user or the group to the Administer System global permission.
I am using the following project: https://github.com/OfficeDev/O365-ASPNETMVC-Start
I set the configurations as requested in the documentation but I am receiving an error after sign in.
Cause Action
AdalException This exception is thrown when either you have a stale O365 access token that can cause authentication errors, or you attempted to access a resource that you don't have permissions to access.
Make sure the app is configured with the correct service permissions in the Services Manager menu. If any of these permissions are not configured, or configured incorrectly, some parts of the app may throw an error. For example Right click the project, select Connected Service..., and ensure the following permissions are set for this app:
(Calendar) – Have full access to users’ calendar and Read users' calendar
(Contacts) – Have full access to users’ contacts and Read users' contacts
(Mail) - Send mail as a user, Read and write access to users' mail, and Read users' mail
(Users and Groups) – Enable sign-on and read users’ profiles.
The permissions are set correctly:
How can I solve this problem?
You are missing the Send permission under the Mail API.
I fixed the problem...I was logging with the developers account without an assigned license. You have to create a new user and ensure that it has the Microsoft Office 365 Developer set as Assigned license.
If not this error would occur:
When making a request as an account that does not have a mailbox, you must specify the mailbox primary SMTP address for any distinguished folder Ids.
Using the Jenkins OpenID plugin I'm able to configure Jenkins to use my Google Apps OpenID as a provider. Anonymous users are still able to access that application (they have read access only), but I want to have it so that users are forced to login using the Google App domain or they are denied access.
I'm currently using the Jenkins Authorization setting of "Logged in users can do anything", I've tried using the "Matrix based authentication" and denying anonymous users, assuming logged in users would still have permissions, is there a special group value I can use for "logged in users" in matrix based authentication?
It seems like "Matrix-based security" will only work for specific users when using Google Apps OpenID (I don't believe Google apps for domains has support for OpenIDTeam extension
Yes there is a special group you can use to do this but finding the information about how to do it isn't obvious.
If you hover over the 'Overall - Read' column on the Matrix-based security table you'll get the solution.
It states
The read permission is necessary for viewing almost all pages of Jenkins. This permission is useful when you don't want unauthenticated users to see Jenkins pages - revoke this permission from the anonymous user, then add "authenticated" pseudo-user and grant the read access.
I use the following technique in combination with the OpenID plugin which allows me to specify a Google Apps for Business domain to secure Jenkins with
Warning: Make sure you've got a backup of your installation before you start because if you get something wrong you may lock yourself out of your Jenkins. Unpicking the plugins and settings would take longer than just restoring from a backup.
Ensure your choice of OpenID provider is still working ok with your current 'Logged in users can do anything' setting
Select the 'Matrix based-security' mode for Authorization
Add a new 'authenticated' group (lower case 'a') to the Matrix-based security table.
Use the 'check all' icon at the right hand end of the new 'authenticated' row to tick all the permission boxes.
Use the 'check all' icon at the right hand end of the 'Anonymous' row to untick all the permission boxes.
Save the settings
Reload Jenkins
Now each time a user wants to see Jenkins they have to be already signed into their Google Account and no-one can get to see any Job names or views without login.
Hope this helps.
I'm developing an intranet web app and I'm learning how to hook VB into the Active Directory. We're going to be doing some location specific permissions, and my boss wants (if possible) me to hook into the Active Directory to get the users location.
I think that all I need to do is get the user name, but I'm not sure what is the best way to do that. We're a Microsoft only shop, so IE and IIS are the order of the day. To access the intranet you have to log on to the computer using our domain, so that's one level of security, but then I need to authenticate and make sure that user has permissions to make the changes. I'm thinking we'll either have a modifier (if there's not one already) in the AD info, or keep a permissions table in a database, but the former is probably preferred.
I know that IIS has a feature that allows/requires authentication but I'm not exactly sure how that's supposed to work.
So what's the best/easiest/somewhat(most?) secure way to get the users credentials? I could always do a login page but it would be much nicer if I could just get their AD credentials in the background.
Thanks!
you need to disable anonymous auth for your IIS site and enable windows-auth instead.
now go to your web.config and change the following
<authentication mode="Windows">
...
</authentication>
see http://msdn.microsoft.com/en-au/library/532aee0e(v=VS.80).aspx
&
if neccesary
<identity impersonate="true" />
see http://msdn.microsoft.com/en-us/library/aa292118(VS.71).aspx
now you should be able to get the current user with
HttpContext.Current.User.Identity.Name
to check if the user is in a specific group you can use
HttpContext.Current.User.IsInRole("YourActiveDirectoryGroup")
IIS can be configured to use Integrated Authentication which will give you access to the samaccountname (pre-Windows 2000 logon) of the user. With that you can do an LDAP query against AD and check group membership. If the user is a member of the CanModifyStuffGroup (that you have created within AD and added users to) then let them make changes, otherwise give them the read-only version - or whatever.