Who is this article for?

Ideagen Quality Management administrators managing the system.

Admin access is required.

LDAP is a lightweight protocol for enabling access to users, groups, and other resources within a network. Active Directory is Microsoft's centralized LDAP system providing services for both distributed and non-distributed network management. Ideagen Quality Management allows you to authenticate user accounts between your Active Directory domain setup and Ideagen Quality Management, allowing for easier user maintenance.

If you use Active Directory/LDAP to manage users across your domain, Ideagen Quality Management supports authenticating those same users against their domain credentials. For end uses, this means the same account they use to log into Windows is what they'll use to log into Ideagen Quality Management. In other words, it's one less password they need to remember.

Domain UserID, First Name, Last Name, and Email Address fields are pulled over when imported. If you enable Auto login, users only need to remember a single password and are taken directly to their Inbox.

Note: Removing an LDAP domain does not update Ideagen Quality Management users associated with the domain. The users still associated with the domain will not be able to login with their LDAP credentials or any previous Ideagen Quality Management credentials. The user accounts would need to be update to use a valid authentication method to re-gain access to Ideagen Quality Management.

1. How to Enable Active Directory Authentication

To enable the system to authenticate users with Active Directory, you must configure the following:

1. From the Administration > System Settings > Passwords tab, configure all domains users will authenticate against.

Note: A URL can be used instead of a Server Name in the Administration>system Settings>Passwords tab. The DNS server can handle these connections.

2. Create and configure user accounts with the LDAP Authentication setting enabled. User accounts may be manually created one by one, as needed. See Personnel for how to configure each account. Multiple user accounts may be created at once by using the User/Group Importer tool. Contact Ideagen Quality Management Support for help installing and using this tool.
3. If Auto Enrollment is enabled, be sure to set up an Email Action for the "Account Created" action so a Ideagen Quality Management administrator is notified to finalize the user setup by placing them in the correct groups and assigning any additional permissions.

Important Notes:

• If Auto Enrollment is enabled, be sure your on-boarding process for new hires prompts the individual to visit and log into your Ideagen Quality Management system to have their account automatically created.
• If a user is removed or Disabled from your domain, those users will not be allowed to authenticate and login. There is no notification to Ideagen Quality Management administrators that the user needs to be also Disabled in Ideagen Quality Management. Be sure your exit process includes notification to a Ideagen Quality Management administrator to disable the Ideagen Quality Management account.
• Changes in Ideagen Quality Management to users do not update their Active Directory equivalents. Nor do any changes to user information in Active Directory update Ideagen Quality Management accounts. Password changes in Active Directory are still applied to both systems.

2. How to Configure Auto-Login

If Active Directory authentication is enabled and you'd like those users authenticating against it to be automatically logged in when accessing the Ideagen Quality Management site, the following set up must occur:

1. From the Ideagen Quality Management web server, right-click My Computer > select Manage > expand to IIS > expand to the Ideagen Quality Management website > right-click the website > select Properties.

2. From the Directory Security tab, click Edit for Authentication and Access.
3. Uncheck the Enable Anonymous Access and select OK to return to the main IIS window.

4. From the IIS window, expand the Ideagen Quality Management site to find the Webservices folder > Right-click Webservices > select Properties.
5. From the Directory Security tab, select Edit for Authentication and Access.
6. Enable Enable Anonymous Access and click OK to close all windows.
7. Also under the Ideagen Quality Management site in IIS, expand the Document folder > Right-click the Documentproperties.aspx file.
8. From the File Security tab, enable Enable Anonymous Access.
9. Finally, from each user's Administration > Personnel > Profile, enable the Auto-Login setting.

3. LDAP Functionality Summary

The following information outlines specifically what Ideagen Quality Management does and does not support regarding LDAP.

What Ideagen Quality Management Supports:

• Microsoft's Active Directory is currently the only supported LDAP protocol.
• Authentication against multiple domains is supported.
• User setup can occur for multiple users at once via the user/group Importer tool, manually by a Ideagen Quality Management administrator, or on demand by the users themselves when the Auto Enrollment feature is enabled.
• Domain Passwords are not stored in Ideagen Quality Management.

Ongoing Management:

• The Auto Enrollment feature allows users to create their accounts in Ideagen Quality Management on demand.

What Ideagen Quality Management does not Support:

Generally:

• Other than authenticating user accounts during login, Ideagen Quality Management does not provide additional integration features with LDAP.
• All other user settings from LDAP, like Hire Date, permissions, roles, manager, etc., are not imported or synced.
• Ideagen Quality Management does not recognize permissions, management hierarchies, or any other group-related setting from LDAP.

Ongoing Management:

• If a user is removed or Disabled from your domain, those users will not be allowed to log into Ideagen Quality Management. Because there is no notification to Ideagen Quality Management administrators that the user needs to be also Disabled in Ideagen Quality Management, be sure your exit process includes notification to a Ideagen Quality Management administrator to disable the Ideagen Quality Management account.
• Changes in Ideagen Quality Management to user settings, like email address or last name, do not update their Active Directory equivalents. Nor do any changes to user information in Active Directory update Ideagen Quality Management accounts. Password changes in Active Directory are recognized automatically by Ideagen Quality Management.

Note: Ideagen Quality Management also supports user and group accounts that exist solely in the Ideagen Quality Management system. These are not synced with or derived from an LDAP configuration. If desired, the system supports these in conjunction with LDAP user authentication. In fact, this is the most common setup we provide, as some accounts like “Admin” and training accounts are often needed but not tied to actual domain users.