KB Article
Issue
A client has a forest of multiple domain names for their Active Directory.
Resolution
The Directory Lookup Username: setting in FactoryLogix Office Settings must use the UPN name (username@domain) of an account that has the rights to browse all the domains.
Use this guide when FactoryLogix must authenticate users across a forest containing multiple Active Directory domains.
Required settings in FactoryLogix Office
Configure the following fields under the Directory Lookup settings in FactoryLogix Office Global Options:
|
Setting |
Value |
Description |
|---|---|---|
|
Directory Lookup Username |
username@domain (for example, jsmith@corp.local) |
UPN of an account with rights to browse all domains in the forest |
|
Directory Lookup Password |
Password for the lookup account |
Password corresponding to the Directory Lookup Username |
|
Active Directory Domain |
Domain the server is joined to |
The domain to which the FactoryLogix server computer belongs |
|
Active Directory Use Principal Context |
True |
Must be set to True for multi-domain environments |
Authentication behavior
-
Users from any trusted domain can log in to FactoryLogix using <Domain>\<Username> or <Username>@<Domain> format.
-
Users or the groups they belong to must be pre-configured in FactoryLogix Users and Roles before they can log in.
-
The Location field for Active Directory objects in FactoryLogix can be edited to reflect whichever domain the user belongs to.
-
If no domain is specified in Global Options and no domain is included in the login username, FactoryLogix uses the domain of the currently logged-in Windows user on the client machine.
-
If a domain is specified in Global Options but the user does not include a domain in their login username, FactoryLogix uses the domain from Global Options and the client Windows user's domain is ignored.
Important
The domain of the client computer is irrelevant. The domain of the logged-in Windows user on the client is what matters when no domain override is configured.
Warning
FactoryLogix does not support two separate domain accounts that share the same base username across different domains (for example, UserA@domain1.com and UserA@domain2.com within the same FactoryLogix instance.
Adding users from multiple domains
To browse and add users from multiple domains in the Users and Roles area of FactoryLogix Office, one of the following must be true:
-
An Active Directory admin account is configured in Global Options (those credentials are used to browse the directory).
-
If no admin account is configured in Global Options, the credentials of the currently logged-in Windows user on the client machine are used to browse the directory (not the logged-in FactoryLogix user).
Important
To add users from multiple domains, the Global Options must include a username and password for an account with authority to access all required domains (typically, an Enterprise Admin account has this authority).
Additional considerations
-
Only Active Directory groups within the user's own domain are evaluated for group membership. Including groups from other domains may cause performance degradation or errors.
-
Badge-based sign-in bypasses password authentication and therefore bypasses Active Directory entirely.