Restricted Web Interface by OU

Question

We want to allow certain users within certain OU's to manage user accounts and the exchange mailboxes of only users within their respected OU. They shouldn't be allowed to see anything else other than what is within their OU. Is there a way to setup one web interface with the same actions but limit the scope based on the OU the logged in user resides in?

Answer 1

Update 2018

Starting with Adaxes 2018.1 you can limit access to AD structure in the Web interface by specifying a top level node. For details, have a look at the following tutorial: https://www.adaxes.com/tutorials_WebInterfaceCustomization_PreventUsersFromViewingTheADStructure.htm.

Original

Hello,

Yes, you can set up a Web Interface site, in which the scope of the actions depends on who is logged on to the Web Interface. For each action, you can specify a target container where it will be possible to select the objects on which to execute the action. Instead of providing a specific container, you can use a value reference. When the action is executed, the value reference will be replaced with a property value of the user logged on to the Web Interface. In your case, you can use the %adm-PrentDN% value reference. It will be replaced with the Distinguished Name (DN) of the container where the logged in user is located.

To configure an existing Home Page Action:

1. Launch the Web interface Customization tool.
2. In the Interface type drop-down list, select the Web Interface you want to configure.
3. On the General tab, click Configure Home Page Actions.
   
4. Select the action you want to configure, for example, Create User, and click Edit.
   
5. Activate the Target Container tab.
6. Enable the Select specific AD container or OU by default option.
7. Click the Insert a reference to a property value button near the Container DN field.
   
8. Click Show all properties and select adm-ParentDN. Click OK.
9. Select Always use this OU/Container.
   
10. Click OK twice.

You can use the same approach to any other actions you need.

You can also configure the Web Interface Active Directory Pane to display only the OU a user can have access to. To learn how to do this, refer to the following tutorial: http://www.adaxes.com/tutorials_WebInte ... ryPane.htm.

On the Step 5 of this tutorial, you need to specify %adm-ParentDN% in the Object DN field.