Skip to content

Authentication Server Management

To manage authentication servers, navigate to Settings > Configure > Authentication.

A configured authentication server can be used to authenticate or authorize users in an organization. Refer to the authentication domain section for more details.

By default, every organization has one built-in authentication server. This server is also set as the default authentication and authorization server in the organization's authentication domain, and can be updated as required.

HyWorks supports the following types of authentication servers:

  • Microsoft Active Directory

  • OpenLDAP/Novell eDirectory

  • Built-in Database

HyWorks provides multiple engines for communicating with AD and LDAP servers. The HyWorks Controller also supports authentication and authorization using the LDAP directory searcher method, which offers the following benefits:

  1. Faster authentication and authorization of users.

  2. Improved support for configuring AD.

  3. Better support for special characters used in AD usernames, group names, and OU names.

  4. The Controller service remains stable even after long periods without a restart.

The LDAP directory searcher method can be configured from the HyWorks Controller Management Console > Settings > General > Advance Configuration > Active Directory options. Refer to the Active Directory option descriptions in the Authentication section for details.

  • Set the value to six (6) to use the LDAP searcher.

  • LDAP Searcher (option 6) is the default engine for HyWorks Controllers.

Add new authentication server

  1. Log in to the HyWorks Controller Management Console.

  2. Navigate to Settings > Configure > Authentication.

  3. Click Add to open the Add Authentication Server dialog.

  4. For Microsoft Active Directory:

    1. Select Active Directory as the Server Type.

    2. Enter a display name.

    3. Enter the server IP address or FQDN, for example, 192.168.1.1 or exampledc.com.

    4. Enter the Domain name. This can be the NetBIOS name of the domain, and is used to sign in to remote sessions.

    5. Enter the port number used to communicate with the authentication server (the default is 389).

    6. Enable SSL if the Active Directory server supports secure communication.

    7. Enter the Base DN information to fetch users, groups, or OUs. If left blank, all users, groups, and OUs are fetched.

    8. Provide Administrator credentials (domain user DN, username, and password) with read and write access for user account management.

    9. Login Attribute: Specify which HyWorks field is used for user authentication. The username entered by the user is mapped to this field. Login Attribute supports the following settings:

      1. User ID: Maps the entered username to the User ID field in HyWorks.

      2. User Principal Name (UPN): Maps the entered username to the User Principal Name field in HyWorks. HyWorks forms the UPN using one of the following methods, depending on how the user logs in:

        1. Username only, without a domain name: HyWorks generates the UPN using the domain name configured for the authentication server. Example: john.test becomes john.test@domain.com.

        2. Domain name\username: HyWorks generates the UPN from the provided domain name and username. Example: domain.com\john.test becomes john.test@domain.com.

        3. Full UPN in the format username@domain-name: HyWorks uses the provided credentials. Example: john.test@domain.com stays john.test@domain.com.

      3. Mail ID: Maps the entered username to the Mail ID field in HyWorks.

      4. Phone Number: Maps the entered username to the Phone Number field in HyWorks.

    10. Log Attributes in the Log: Specify the AD attributes to log with each user login event. Use this to include additional details in the log file, which can help when generating reports.

    11. Skip Login Attribute Verification: When unchecked, HyWorks checks all four underlying attributes in AD during configuration, regardless of whether they are present. When checked, HyWorks skips this check; if an attribute is later found missing in AD, an error is reported when the user logs in. For example, if the Phone Number attribute is mapped to the AD attribute telephoneNumber, but that attribute does not exist in AD, the user sees an error during login.

    12. Add secondary authentication server: Adds another authentication server to use if the primary server is unavailable.

  5. For OpenLDAP/Novell eDirectory:

    1. Select Novell Directory/OpenLDAP as the Server Type.

    2. Enter the server IP address or FQDN, for example, 192.168.1.1 or exampledc.com.

    3. Enter the Domain name. This can be the NetBIOS name of the domain, and is used to sign in to remote sessions.

    4. Enter the port used to communicate with the authentication server (the default is 389).

    5. Enable SSL if the server supports secure communication.

    6. Enter the Base DN information, for example, o=qa.

    7. Provide Administrator credentials with read and write access for user account management.

    8. Login Attribute: Specify which HyWorks field is used for user authentication. The username entered by the user is mapped to this field. Login Attribute supports the following settings:

      1. User ID: Maps the entered username to the User ID field in HyWorks.

      2. User Principal Name (UPN): Maps the entered username to the User Principal Name field in HyWorks. HyWorks forms the UPN using one of the following methods, depending on how the user logs in:

        1. Username only, without a domain name: HyWorks generates the UPN using the domain name configured for the authentication server. Example: john.test becomes john.test@domain.com.

        2. Domain name\username: HyWorks generates the UPN from the provided domain name and username. Example: domain.com\john.test becomes john.test@domain.com.

        3. Full UPN in the format username@domain-name: HyWorks uses the provided credentials. Example: john.test@domain.com stays john.test@domain.com.

      3. Mail ID: Maps the entered username to the Mail ID field in HyWorks.

      4. Phone Number: Maps the entered username to the Phone Number field in HyWorks.

    9. Custom Filter: Provide a custom LDAP search filter to search for and authenticate the user account.

    10. Log Attributes in the Log: Specify the attributes to log with each user login event. Use this to add extra information to the log file, which can help when generating reports.

    11. Disable Password Management: Disables the Change Password function for the LDAP server.

    12. Skip Login Attribute Verification: When enabled, all attributes must be present for the user at login. If a default search attribute is missing, an error is reported.

  6. For HyID as an authentication provider: Follow the detailed steps in the HyID as Auth document.

  7. Click Test Connection to check server reachability.

  8. Once a message confirms a successful connection, click Add.

The authentication server is now configured and ready for use.

Important

In HyWorks v3.3 or later, Workgroup support has been removed. The Built-in directory server can be used instead of the Workgroup authentication server and offers several improvements.

Modify authentication server

The Administrator can modify a configured authentication server; however, it's important to understand which fields can be updated and the impact of changing them.

Modifiable fields and impact

The following fields in the authentication server configuration are critical. Misconfiguring any of them could cause the deployment to fail, so the Administrator should be extra cautious when changing them:

  • Address

  • Domain

  • Port Number

  • Enable SSL

  • Base DN

  • User DN

  • Username

  • Password

  • User Search Attribute

How to modify a configured authentication server

  1. Navigate to Settings > Configure > Authentication.

  2. Select the authentication server and click Edit.

  3. Update the required values.

  4. Click Test Connection to verify.

  5. Click Update to save the changes.

Delete authentication server

The built-in authentication server cannot be deleted. Only authentication servers configured by an Administrator can be deleted, and only if they are not used in the authentication domain of the current organization or any child organization.

To delete a configured authentication server:

  1. Select the authentication server to delete, then click Delete.

  2. Confirm by clicking Delete again.

The authentication server is deleted and no longer appears in the Management Console.

Important

The current version of HyWorks does not remove user entitlements when an authentication server configured as the authorization server is deleted. However, users will not be able to authenticate until the same authentication server is added again and configured as the authorization server.

Advanced configurations

Advanced configurations can be set up in the HyWorks Controller under Management Console > Advance Configuration. Refer to this section for the list of configuration settings available for the authentication server, including descriptions and available options. Changing these settings alters the behavior of the authentication server.