Skip to main content
Frowne10-Marble
10-Marble
Apr 11, 2024 12:32 PM UTC
Solved

Mapping for AD Users based on Group ID over Group Name

Good day everyone,

 

Today we changed the name of a group in our Active Directory and as a consequence we locked all users relying on that group out of the system for a while until we figured out where the problem is coming from - apparently, the connection between AD & Thingworx is based on the AD Group's name rather than its unique SID. For organisations where names can change frequently, this is quite the issue - is there any way around this currently?

 

Kind regards,

Martin

TonyZhangAnswer
Support
Dec 4, 2024 7:40 AM UTC

Hi @Frowne 

I think it is possible to map ThingWorx Group to AD Group by specifying attributes other than the common name.

Simply change the Group Attribute Name in AD configuration in ThingWorx.

For example:

I want to use E-mail attribute as the identifier for AD security group and never change this value

Then in ThingWorx AD configuration, set the Group Attribute Name to mail

In GroupMappings, specify the mail value of the Security Group instead of the common name.

 

Thanks,

View in thread

10 replies

nmutter17-Peridot
17-Peridot
Apr 11, 2024 3:24 PM UTC

You need to configure your AD to send the "group-id" as claim instead of the "display name". Then in TWX you need change the mapping to use the ids to TWX groups (in the ThingworxSSOAuthenticator).

What kind of AD are you using? AAD?

Translate
Frowne10-MarbleAuthor
10-Marble
Apr 12, 2024 7:52 AM UTC

We're only synching to Azure, we're using an in-house one with Windows Domain Controller. Generally, I do believe it's set up properly from our side specifically, I'm just wondering about how to properly implement it on Thingworx' side of things.

 

I'm assuming you are talking about the ThingworxSSOAuthenticator's "Identity Provider Group Name"? 

Translate
nmutter17-Peridot
17-Peridot
Apr 12, 2024 8:05 AM UTC

Yes, I was referring this section. But I assumed that you are already using this section to map your "ad group name" to twx groups. From what I understand you don't do that? So most likely I have misinterpreted your setup (I thought some Single Sign-on setup is in place).

Translate
    Terms & ConditionsAccessibility statement