Authorizing with domain accounts
To enable users to complete authorization in the KUMA web interface using their own domain account credentials, you must complete the following configuration steps.
- Enable domain authorization if it is disabled.
Domain authorization is enabled by default, but a connection to the domain is not yet configured.
- Configure a connection to the domain controller.
You can connect only to one domain.
- Add groups of user roles.
You can specify an Active Directory group for each KUMA role. After completing authorization using their own domain accounts, users from this group will obtain access to the KUMA web interface in accordance with their defined role.
The program checks whether the Active Directory user group matches the specified filter according to the following order of roles in the KUMA web interface: operator → analyst → tenant administrator → general administrator. Upon the first match, the program assigns a role to the user and does not check any further. If a user matches two groups in the same tenant, the role with the least privileges will be used. If multiple groups are matched for different tenants, the user will be assigned the specified role in each tenant.
If you completed all the configuration steps but the user is unable to use their domain account for authorization in the KUMA web interface, it is recommended to check the configuration for the following issues:
- An email address is not indicated in the properties of the user account in Active Directory. If this is the case, an error message is displayed during the user's first authorization attempt and a KUMA account will not be created.
- There is already an existing local KUMA account with the email address indicated in the domain account properties. If this is the case, the user will see an error message when attempting authorization with the domain account.
- Domain authorization is disabled in the KUMA settings.
- An error was made when entering the group of roles.
- The domain user name contains a space.