How to manage group memberships from multiples trusted forest ?

Question

Hello,

I need to grant the right for a user to manage only one group. This group is "Domain local" so it is possible to add members from other trusted forests. The problem is that when the group manager want to add a member from the Web interface he only see users from the domain he belong to. How to tell Adaxes to look for users in all registered domains ?

Thanks.

Answer 1

Hello,

If the group scope and type are correct, you need to make sure that the logged on user can actually see users from other domains. To do so:

• Make sure that the domains you need are registered in Adaxes and operational. All the managed domains are displayed under the Active Directory node in Adaxes Administration console.
• Make sure that the user has the permissions to see the users. For details on delegating the permissions, have a look at the following tutorial: https://www.adaxes.com/tutorials_DelegatingPermissions_HideADObjectsFromUsers.htm.
• Make sure that the Web interface the user logs in to is configured to display the users you need. For details on configuring the corresponding Web interface settings, have a look at the following tutorial: https://www.adaxes.com/tutorials_WebInterfaceCustomization_PreventUsersFromViewingTheADStructure.htm.
• Check whether the operation/action being used does not have any predefined limitations of its own.

Comments

Hello,

• All managed domains are registered and operationals. This how securtity role is created. The trustees's scope is the group on which modification must be done.

• 

• On the web interfacem i cannot select more that one domain to browses.

So how to search users from all domains ?

Thanks.

---

Hello,

Thank you for the provided details. The security role only grants permissions over the specified object, nothing else at all. Please, make sure that there are other roles assigned to the user that grant required permissions. For information on how to view all security roles assigned to a user, see https://www.adaxes.com/help/ViewAssignedSecurityRoles.

If you are using the Add to group Web interface action (e.g. right from the Web interface home page), please, make sure that the action has no object selection limits. The following tutorial should be helpful: https://www.adaxes.com/tutorials_WebInterfaceCustomization_ConfigureActionsPane.htm.

Also, could you, try adding members to the same group using Adaxes Administration console? Are you able to add users from other domains in this case? What about using Active Directory Users and Computers?

---

Hello,

Thank you.

I did not solve the issue.

Also, could you, try adding members to the same group using Adaxes Administration console? Are you able to add users from other domains in this case? What about using Active Directory Users and Computers?

In this his case I do not see users from other managed forest when editing the group.

What about using Active Directory Users and Computers?

In this case I can see users from other forest when editing the group.

---

Hello,

What account did you use to log in to Adaxes service when checking the behaviour in Adaxes Administration console? Did you try the Adaxes service account? If not, please, give it a go.

Did you make sure that all the domains you need are registered in Adaxes and are displayed under the Active Directory node in the Administration console?