KB article
Overview
FactoryLogix supports two modes for Active Directory (AD) integration: Group Mode and User Mode. The mode chosen determines how users are granted access and how FactoryLogix roles are assigned.
Group Mode
In Group Mode, only AD Group objects are maintained in FactoryLogix — no individual AD user objects are required. Any AD user who is a member of a group configured in FactoryLogix can log in, even if no explicit user object exists for them. These users inherit all FactoryLogix roles associated with the group. If a user belongs to more than one configured AD group, they inherit all roles from all matching groups.
Note: Hidden user records are created automatically in the FactoryLogix database the first time a group member logs in. These users are not visible in the Users and Groups list.
Group Mode advantages
-
Users do not need to be configured individually in FactoryLogix.
-
FactoryLogix roles and permissions can be managed centrally at the group level.
-
Access to FactoryLogix can be controlled by modifying AD group memberships outside of FactoryLogix.
Group Mode limitations
-
Features that require individually configured users, such as Certifications, are not available because user records are hidden and their individual properties cannot be edited.
User Mode
In User Mode, each AD user is added explicitly to FactoryLogix. This grants that user direct access to FactoryLogix regardless of their AD group memberships. Removing a user from all AD groups does not revoke their FactoryLogix access if they have been added explicitly.
Role assignment in User Mode
When an AD user logs in under User Mode, FactoryLogix assigns them the combination of all applicable roles:
-
All roles directly associated with the AD user in FactoryLogix.
-
All roles associated with any FactoryLogix groups the user is a member of.
-
All roles associated with any AD groups the user is currently a member of at the time of login.
Note: FactoryLogix updates a user's AD group memberships only when that user logs in. The member list in Users and Groups is also refreshed for that user at login time. All group memberships are evaluated and enforced at the time of each sign-in.