Single Sign-on

Single Sign-on in SYSPRO provides a simple to setup and robust method of using Microsoft Active Directory (AD) to control SYSPRO users.

Once configured, it enables a complete single sign-on experience as SYSPRO users are authenticated by Windows and then simply use a shortcut to run SYSPRO without being prompted for a user name and password at the login screen.

It means that a SYSPRO site can use Microsoft Active Directory (AD) to add, change, disable and delete operators virtually seamlessly. Any changes to user attributes automatically reflect against the SYSPRO operator without manual intervention.

PDF version

Exploring

The programs related to this feature are accessed from the Program List pane of the SYSPRO menu:

  • Program List > Administration > Security

Microsoft Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks.

It consists of several services that run on Windows Server to manage permissions and access to networked resources.

An organizational unit (OU) is a subdivision within Microsoft Active Directory (AD) into which you can place the following objects:

  • Users
  • Groups (e.g. Security groups)
  • Computers
  • Other organizational units

You can create organizational units to mirror your organization's functional or business structure, and each domain can implement its own organizational unit hierarchy.

Security groups provide an efficient way to assign access to resources on your network. They enable the following:

  • Assign user rights to security groups in Microsoft Active Directory (AD).

  • Assign permissions to security groups for resources.

Topics

Multi-Factor Authentication

SYSPRO Supply Chain Portal

Request for Quote System

Programs

Active Directory User Management

Add Operator and Link to AD User

Active Directory Link Operator

Operator Maintenance

System Setup

System Audit Query

Services

SYSPRO 8 Active Directory Sync Service

PDF and Video Resources

Feature Guides

Starting

The following setup options must be configured to use this feature:

Setup Options > System Setup > Login

Single Sign-On

  • Active Directory sync required
  • AD sync service endpoint
  • Review email required
  • Failure email required
  • Success email required

Setup Options > System Setup > Connectivity

Email/SMTP settings

  • SMTP server IP address
  • Outgoing email address
  • Username
  • Password
  • Server port
  • Use SSL

You can secure this feature by implementing a range of controls against the affected programs. Although not all these controls are applicable to each feature, they include the following:

  • You restrict operator access to activities within a program using the Operator Maintenance program.
  • You can restrict operator access to the fields within a program (configured using the Operator Maintenance program).
  • You can restrict operator access to functions within a program using passwords (configured using the Password Definition program). When defined, the password must be entered before you can access the function.
  • You can restrict access to the eSignature transactions within a program at operator, group, role or company level (configured using the eSignature Setup program). Electronic Signatures provide security access, transaction logging and event triggering that gives you greater control over your system changes.
  • You can restrict operator access to programs by assigning them to groups and applying access control against the group (configured using the Operator Groups program).
  • You can restrict operator access to programs by assigning them to roles and applying access control against the role (configured using the Role Management program).

  1. Install the SYSPRO 8 Active Directory Sync Service using the SYSPRO Installer application.

    This requires you to define an endpoint for the SYSPRO 8 e.net Communications Load Balancer, which is used to communicate with your SYSPRO instance.

  2. From the Setup Options program:

    • Ensure that your SMTP configuration is defined within the Email/SMTP settings section (Setup Options > System Setup > Connectivity).

    • Enable and configure the integration between SYSPRO and Microsoft Active Directory (AD) within the Single Sign-On section (Setup Options > System Setup > Login).

      You must define the AD sync service endpoint which indicates the location of the SYSPRO 8 Active Directory Sync Service.

      This is the same endpoint that was configured when the service was installed. Use the Test Connection function once you have entered the endpoint to ensure the entry is correct.

  3. From the Operator Maintenance program (SYSPRO Ribbon bar > Setup > Operators) define an operator template.

    This is required when using the Add operator option in the Active Directory User Management program as a template operator is used when creating a new operator for assignment to an Active Directory user.

  4. In Microsoft Active Directory (AD) add the appropriate users to the SYSPRO.ERP security group.

    Once the SYSPRO 8 Active Directory Sync Service is running, any Active Directory users that are added to the SYSPRO.ERP security group are added to the AdmSsoUsers table.

    Either wait for the SYSPRO 8 Active Directory Sync Service to run (this defaults to running every 12 hours) or select the Sync Now option in the Active Directory User Management program to force an immediate synchronization with Microsoft Active Directory (AD) to update the operator list.

    An email notification will be sent indicating that there are one or more Active Directory users that can be reviewed and linked to an existing or new SYSPRO operator.

  5. From the Active Directory User Management program (Program List > Administration > Security) assign SYSPRO operators to Active Directory users accordingly.

    New {Unassigned} Active Directory users can be managed as follows:

    • Link to an existing SYSPRO operator.

      An informational icon clearly indicates when an existing user has a network user name matching the Active Directory network user name.

    • Add a new SYSPRO operator.

      You select a template, define the new operator code, location and default company and the operator is then added and linked to the Active Directory user.

    • Mark as 'hidden'.

      Optionally hide one or more Active Directory users from the list of items for later review.

      You can use the filter options to see the hidden Active Directory users.

  • SYSPRO operators cannot be enabled for simultaneous use of Multi-Factor Authentication and:

    • Single Sign-on (i.e. the operator is defined as an Active Directory user)
    • Concurrent usage (i.e. the Allow concurrent use of this operator option is enabled against the operator in the Operator Maintenance program)

  • The Single Sign-on feature is intended to work with the SYSPRO Windows client only and is not available for SYSPRO Avanti, SYSPRO Espresso and the SYSPRO Supply Chain Portal. Therefore, an operator that is configured to use Single Sign-on won't have access to these environments.

    The SYSPRO Windows client reads the currently logged in and authenticated Windows user and then performs a look-up on the link between the Active Directory name (authenticated Windows user) and the SYSPRO operator code (as defined in the Active Directory User Management program). Therefore, Single Sign-on with Active Directory integration is not intended for environments where you don't have to be ‘logged into’ a windows client.

    For example:

    When using the SYSPRO Avanti user interface, the platform is running via a browser, which can be running on any operating system (including a phone or tablet). Which means that the concept of being authenticated via Microsoft Active Directory (AD) is not available in SYSPRO.

    Similarly, SYSPRO Espresso, which can also run on a browser, phone or tablet also is not designed for Microsoft Active Directory (AD) Authentication.

Solving

You can rename the SYSPRO.ERP security group in Microsoft Active Directory (AD) by adding a suffix to the group name.

For example:

SYSPRO.ERP.ACCOUNTS

When you install the SYSPRO 8 Active Directory Sync Service (using the SYSPRO Installer app) ensure that you enter this suffix at the Security Group Suffix parameter field.

If required, you can update the suffix after installing the SYSPRO 8 Active Directory Sync Service:

  1. Create a custom.config file:

    To create a custom.config file, make a copy of the SYSPRO.AD.Sync.Service.exe.config file and rename it to custom.config.

    The custom.config file can then contain the entry you want to modify and the startup node. Any entries not contained in the custom.config file are retrieved from the original SYSPRO.AD.Sync.Service.exe.config file.

    You should ideally stop the service while you do this, otherwise the configurations will be picked up at the next poll interval.

  2. Update the ADSecurityGroup key's value with the new security group name.

None.

The synchronization between SYSPRO and Microsoft Active Directory (AD) is a one-way service.

SYSPRO operators defined as AD Managed are managed by Microsoft Active Directory (AD) and updated accordingly in SYSPRO automatically when the SYSPRO 8 Active Directory Sync Service runs.

The following operator attributes are managed by Microsoft Active Directory (AD) and cannot be maintained in SYSPRO for Active Directory operators:

  • Operator name
  • Operator email address
  • Network user name
  • Operator status (i.e. Active, Disabled or Removed)

A user who is removed from the SYSPRO.ERP security group in Microsoft Active Directory (AD) is automatically disabled within SYSPRO when the SYSPRO 8 Active Directory Sync Service synchronizes with Microsoft Active Directory (AD).

The SYSPRO 8 Active Directory Sync Service must be run as a named user that has READ permission to access Microsoft Active Directory (AD).

If you have configured receiving emails in the System Setup program (Review email required, Failure email required, Success email required) the following variables are passed to the email templates when the Microsoft Active Directory (AD) synchronization takes place:

  • $SsoUserCount$

    Count of users added for review.

  • $SsoOpChanged$

    Count of operators with changes (e.g. email, name).

  • $SsoOpActivated$

    Count of operators whose status has changed to active from disabled or removed.

  • $SsoOpDisabled$

    Count of operators whose status has changed to disabled.

  • $SsoOpRemoved$

    Count of operators whose status has changed to removed.

  • $FailedMsg$

    If the synchronization fails, then this contains the message as written to the log file.

The PollInterval is set to default every 12 hours, but can be changed if required.

The minimum setting is 0.30 minutes.

An operator Template is required when adding a new SYSPRO operator for an Active Directory user in the Active Directory User Management program.

  1. Open the Operator Maintenance program.

    Reset your toolbar to ensure all the latest options are visible.

  2. From the Edit menu, select Maintain templates.

  3. Enter the template code in the Template field on the toolbar and press tab.

  4. Enter details for the following mandatory fields on the Operator Details pane:

    • Operator name (this becomes the template description)
    • Operator group

  5. Configure any security groups, roles and other attributes that you require against the template.

  6. Enter any remaining information that you require as defaults for the operator template, or accept the defaults provided.

  7. Save the operator template.

    Template operator codes are prefixed with __Template_ and their operator type records as Template.

The following functions become available in the Active Directory User Management program after linking an Active Directory user to a SYSPRO operator:

  • Delink operator

    This delinks the operator from the Active Directory user but retains the SYSPRO operator code.

  • Delete operator

    This completely removes the SYSPRO operator.

An operator who is delinked in the Active Directory User Management program remains visible in the program as they are still part of the AdmSsoUsers table.

If you don't want to see delinked operators in the Active Directory User Management program, highlight the operator and select the Hide Users option from the toolbar menu.

SMTP details are required if you have configured any of the following email options from the Connectivity System Setup form of the Setup Options program (Setup Options > System Setup > Connectivity):

  • Review email required
  • Failure email required
  • Success email required

The Single Sign-on feature is intended to work with the SYSPRO Windows client only and is not available for SYSPRO Avanti, SYSPRO Espresso and the SYSPRO Supply Chain Portal. Therefore, an operator that is configured to use Single Sign-on won't have access to these environments.

The SYSPRO Windows client reads the currently logged in and authenticated Windows user and then performs a look-up on the link between the Active Directory name (authenticated Windows user) and the SYSPRO operator code (as defined in the Active Directory User Management program). Therefore, Single Sign-on with Active Directory integration is not intended for environments where you don't have to be ‘logged into’ a windows client.

For example:

When using the SYSPRO Avanti user interface, the platform is running via a browser, which can be running on any operating system (including a phone or tablet). Which means that the concept of being authenticated via Microsoft Active Directory (AD) is not available in SYSPRO.

Similarly, SYSPRO Espresso, which can also run on a browser, phone or tablet also is not designed for Microsoft Active Directory (AD) Authentication.

Using

The synchronization process occurs once you have enabled Single Sign-on and added the relevant users to the SYSPRO.ERP security group in Microsoft Active Directory (AD).

When an Active Directory user belongs to the SYSPRO.ERP security group, they are assumed to be personnel in the organization who have access to the SYSPRO ERP application and are therefore SYSPRO operators. This is important because Active Directory users on many sites include personnel who use additional applications and don't necessarily require access to SYSPRO.

  1. The SYSPRO 8 Active Directory Sync Service interrogates Microsoft Active Directory (AD) to read all users contained within the SYSPRO.ERP security group, either by direct membership or via a nested group.

    This lets you take advantage of an existing Active Directory security grouping (if it exists) without having to duplicate existing groups.

    The service provides an audit trail of all updates that occur and stores this information in the AdmSsoUserSyncLog table of your system-wide database.

    The service updates the SYSPRO AdmSsoUsers table, which updates the users linked to SYSPRO operators shown in the Active Directory User Management program.

  2. The Active Directory User Management program lets you to assign Active Directory users to existing SYSPRO operator codes, or to create new SYSPRO operator codes to which you want to assign Active Directory users.

  3. The SYSPRO 8 Active Directory Sync Service detects any change against the attributes of operators in the SYSPRO.ERP security group of Microsoft Active Directory (AD) during its next synchronization schedule and updates (the AdmSsoUsers table and the relevant operators' details).

    Operator attributes include:

    • Operator name
    • Operator email address
    • Network user name
    • Operator status (i.e. Active, Disabled or Removed)

  4. You are notified via email (if this is configured) that changes requiring your attention have been made in Microsoft Active Directory (AD).

    For example:

    New users are added to the security group in Microsoft Active Directory (AD) which require SYSPRO operator assignment.

    This prompts you to run the Active Directory User Management program to review the changes and manage accordingly.

The following indicates areas in the product that may be affected by implementing this feature:

Setup Options > System Setup > Login

The form within the Setup Options program includes options that let you enable integration between SYSPRO and Microsoft Active Directory (AD).

Program List > Administration > Security

This is a new program that lets administrators configure and manage the relationship between Microsoft Active Directory (AD) users and SYSPRO operators.

The program accesses the AdmSsoUsers table and allows you to:

  • View all users added to the SYSPRO.ERP security group in Microsoft Active Directory (AD).
  • Assign Active Directory users to existing SYSPRO operator codes.
  • Create a new SYSPRO operator code to assign to an Active Directory user.
  • Force a sync between Microsoft Active Directory (AD) and SYSPRO to update the operator list.
  • Delink a SYSPRO operator from an Active Directory user.
  • Delete a SYSPRO operator that was linked to an Active Directory user.
  • Filter, hide or unhide the operators that you want to view.

If a user is removed from the SYSPRO.ERP security group in Microsoft Active Directory (AD), they are automatically disabled within SYSPRO when the SYSPRO 8 Active Directory Sync Service synchronizes with Microsoft Active Directory (AD).

SYSPRO Ribbon bar > Setup > Operators

New operator fields related to this feature are available from the Operator Details pane.

The operator type AD Managed indicates that the operator is managed by Microsoft Active Directory (AD) (via the SYSPRO 8 Active Directory Sync Service).

The authentication type Windows (W) indicates that Single Sign-on is enabled for the operator and that Windows authentication is used when logging into SYSPRO.

This indicates the current status of the operator (as recorded in the OperatorStatus column of the AdmOperator table:

Active

Indicates that the operator is active in SYSPRO and Microsoft Active Directory (AD) and can log into SYSPRO.

Disabled

Indicates that the operator was disabled from Microsoft Active Directory (AD) and is therefore not able to log into SYSPRO.

Removed

Indicates that the operator was removed via Microsoft Active Directory (AD) and is therefore not able to log into SYSPRO.

This indicates the reason for the operator status not being Active.

This indicates the date when the operator status was last changed.

Program List > Administration > Security

The SYSPRO 8 Active Directory Sync Service is used to integrate Microsoft Active Directory (AD) to read all users contained within the SYSPRO.ERP security group.

The service updates the AdmSsoUsers table, which updates the operators listed in the Active Directory User Management program.

This service is installed using the SYSPRO Installer Application.

The SYSPRO 8 Active Directory Sync Service must be run as a named user that has READ permission to access Microsoft Active Directory (AD).

Program List > Administration > Security

This program includes auditing and logging capabilities for all operators that are linked to and managed by Microsoft Active Directory (AD), providing an audit trail of all updates that occur, including:

  • Operators activated via Microsoft Active Directory (AD)
  • Operators disabled via Microsoft Active Directory (AD)
  • Operators removed via Microsoft Active Directory (AD)
  • Operators details changed via Microsoft Active Directory (AD)