How to Enable Windows Lightweight Directory Access Protocol (LDAP) in Active Directory With InsightCM

Issue Details

This article explains how to enable Windows Lightweight Directory Access Protocol (LDAP) authentication in Active Directory for InsightCM. With LDAP set up, administrators manage InsightCM user accounts and permissions in one place, Active Directory, which keeps access secure and simple to maintain. After setup, users sign in to InsightCM with their Active Directory credentials and get the permissions assigned to their Active Directory group.

Important

Configuration can vary depending on your organization's IT policies and security restrictions, such as group naming conventions, organizational unit structure, service account requirements, or access to the domain controller. Before you begin, review this process with your IT department and confirm any details that need clarification.

Prerequisites

• InsightCM installed and configured.
• Administrative access to Active Directory.
• An InsightCM account with administrator permissions.
• Windows administrator rights on the InsightCM server.
• An InsightCM server joined to the domain, with network access to the domain controller.

Table of Contents

• Part A: Configure Active Directory (Steps 1–6)
• Part B: Configure InsightCM Roles (Steps 7–10)
• Part C: Update the Login Settings and Restart (Steps 11–12)
• Outcome

Instructions

Part A: Configure Active Directory

1. Open Active Directory Users and Computers: Click Start, type Active Directory, and select Active Directory Users and Computers.

2. Create the InsightCM Security Groups: Create three security groups, one for each InsightCM access level: Administrators, Technicians, and View Only. For example: site1_icm_administrators, site1_icm_technicians, and site1_icm_viewonly.

3. Add Users to Each Group: Make sure each user belongs to the correct group. To check, right-click the user, select Properties, and open the Member Of tab.

4. Enable Advanced Features: Go to View > Advanced Features. This turns on the Attribute Editor tab you need in Step 6.

5. Open the Group Properties: Right-click the security group and select Properties.

6. Copy the Distinguished Name: Open the Attribute Editor tab, scroll down to distinguishedName, and copy its value. Repeat Steps 5–6 for each security group, and keep the values. You'll need them in Step 10.

Example:

CN=site1_icm_administrators,OU=InsightCM,OU=Groups,OU=Site1,OU=PGD,DC=yourdomain,DC=loc

Part B: Configure InsightCM Roles

7. Open Roles and Permissions in InsightCM: On the InsightCM server, open InsightCM in your browser, click the menu arrow in the top-right corner, and select Options. Then go to Security > Roles and Permissions.

8. Delete the Existing Roles: Select each existing role (for example, Technician) from the Role drop-down and click the Delete (trash) icon.

9. Create the New Roles: Click the + icon next to Role, enter a role name (for example, AdminICM), and click OK. Then, under Permissions, click Add and select the permissions for that role. Repeat this step for each role: Administrators, Technicians, and View Only.

10. Link Each Role to Its Active Directory Group: With the role selected, under Active Directory Roles, click Add. Paste the distinguishedName of the matching security group from Step 6 and click OK. Repeat for each role, then click OK to save and close the Options window.

Part C: Update the Login Settings and Restart

11. Modify the LoginAuth.json File: On the InsightCM server, go to C:\ProgramData\Cutsforth\InsightCM\Auth and open LoginAuth.json in a text editor with administrator rights. Update the values as shown below and save the file.

{
  "DisableBuiltinAccounts": true,
  "LdapConnectionString": "LDAP://<YourDomainName>",
  "LdapDomainName": "<YourDomainName>",
  "LdapUsernameFilterToken": "name",
  "SessionTimeoutMinutes": 7200,
  "LdapServiceAccountUserName": "",
  "LdapServiceAccountPassword": ""
}

• DisableBuiltinAccounts: Set to true to turn off the built-in InsightCM accounts, so users can only sign in with Active Directory.
• LdapConnectionString: Your domain, with the LDAP:// prefix in uppercase (for example, LDAP://yourdomain.loc).
• LdapDomainName: Your domain name (for example, yourdomain.loc).
• LdapServiceAccountUserName / LdapServiceAccountPassword: Optional. Leave them blank unless your environment requires a service account.

Caution: Once DisableBuiltinAccounts is set to true, the built-in InsightCM accounts can no longer sign in. Before you restart, confirm the Active Directory groups and InsightCM roles are set up correctly.

12. Restart the Server: Restart the InsightCM server to apply the changes.

Outcome

Users sign in to InsightCM with their Active Directory username (without the domain prefix) and password. Each user gets the permissions of the InsightCM role linked to their Active Directory group.

Do you need more help?

Submit your questions or requests using the Support Ticket Submission form.