https://answers.axonivy.com/questions/1404/how-to-map-ad-group-to-ivy-role<p>We like to manage the rights for our ivy applications over the Microsoft Active Directory. According the AD groups, ivy roles should automatically added to the ivy user. We have in mind to build some technical processes to do that. But we have some questions...<br> <br><b>Is it possible to read (lower) OU's of a user?</b><br> If we have the OU "ivy" to import all users and there is a OU "admin" under the OU "ivy", can we find out which users are in the OU "admin"? How can we get this information. Maybe some how like reading AD attributes?<br> <br><b>Is it possible to listen to the LDAP synchronisation of the ivy server?</b><br> Every times when the user synchronisation is finished, our code should be executed to add specified ivy roles to the user based on the AD OU's.</p> <p>Thank you for your support</p>enThu, 23 Jul 2015 16:26:57 -0400https://answers.axonivy.com/questions/1404/how-to-map-ad-group-to-ivy-role/1407<p>If you read the User.getExternalSecurityName() you get the fully qualified LDAP Name like: CN=User Name,CN=Users,OU=Management,OU=Swiss,DC=company,DC=com</p> <p>This means the user is "under" the Organisation Units "Management" and "Swiss".</p>Christian StrebelThu, 23 Jul 2015 16:26:57 -0400https://answers.axonivy.com/questions/1404/how-to-map-ad-group-to-ivy-role/1407https://answers.axonivy.com/questions/1404/how-to-map-ad-group-to-ivy-role/1406<p>You can map either an group or an Organisation Unit (OU) to an ivy role.</p> <p>See dokumentation about <a href="http://developer.axonivy.com/doc/latest/EngineGuideHtml/administration.html#N23141">External Security Name</a>:</p> <p>If you are using an external security system (e.g. Microsoft Active Directory) then you can link an Axon.ivy role to a group or another structural node (e.g. Organisation Unit) on the directory server. If a group is selected then all users that are members of this group will automatically receive the associated Axon.ivy role. If a structural node is selected then all users located below the structural node will automatically receive the associated Axon.ivy role.</p> <p>Press External security name to edit or browse the name of the group or structural node whose users should receive the selected Axon.ivy role.</p>Christian StrebelThu, 23 Jul 2015 16:18:25 -0400https://answers.axonivy.com/questions/1404/how-to-map-ad-group-to-ivy-role/1406