Configuration
csharp
// Enable AD authentication
@Security.AuthenticationMode = "WindowsAD";
@Security.ADDomain = "company.local";

// Map AD groups to permissions
@Security.ADGroupMapping["Domain Users"] = "Operator";
@Security.ADGroupMapping["Domain Admins"] = "Administrator";
Runtime Behavior
User Validation Order
Check SecurityUsers (internal)
Query RuntimeUsers database
Validate against AD/LDAP
Apply Guest if no match
Session Management
csharp
// Get all active users
var users = @Security.GetActiveUsers();

// Check if RuntimeUser
bool isRuntimeUser = @Security.IsRuntimeUser(username);

// Get user source
string source = @Security.GetUserSource(username); 
// Returns: "Internal", "Database", "AD"
Best Practices
Use appropriate source - AD for enterprise, DB for standalone
Set permissions carefully - RuntimeUsers can't be admins
Implement audit trail - Track user creation/modification
Regular cleanup - Remove inactive RuntimeUsers
Secure database - Protect RuntimeUsers table
Document user sources - Clear origin tracking
Test authentication - Verify all paths work
Troubleshooting
User not found:
Check database connection
Verify table exists
Review AD connectivity
Confirm username format
Cannot create user:
Verify CreateUsers permission
Check database write access
Review policy restrictions
Confirm unique username
AD users not working:
Test domain connectivity
Verify group mappings
Check authentication mode
Review domain credentials
Database errors:
Verify connection string
Check table schema
Review permissions
Test database access
CONSOLIDATE:
Windows AD / LDAP Server (Reference)
Windows AD / LDAP Integration
Windows AD Authentication
Automatic Availability 
Windows AD support is automatically enabled  when:
Solution runs on Windows
Domain connectivity exists
Port 3102 (default) accessible
Configuration:
Navigate to Runtime → Startup
Enable Use WA checkbox
Set PortWA: 3102 (or custom)
Configure redundancy ports if needed
Connection Methods:
Rich Client:
Server: ServerName
Port: 3102 (AD port)
Windows Authentication: Enabled
Web Client URL:
http://server/fs-2024/TSmartClient.application?port1=3102&wa=true
LDAP Server Configuration
Setup:
Navigate to Runtime → Startup
Enable Use WA checkbox
Set PortWA: 3102 (or custom)
Configure redundancy ports if needed
 Security → RuntimeUsers
Enter LDAP server in AD/LDAP Server field:
ldap://company.local:389
ldaps://secure.company.local:636
Connection String Examples:
Standard LDAP:
ldap://dc1.company.local:389
Secure LDAP:
ldaps://dc1.company.local:636
With Base DN:
ldap://dc1.company.local:389/DC=company,DC=local
Permission Mapping
User Resolution Order:
Check for exact username match in Security → Users
Map Windows groups to permission groups
Apply Guest permissions if no match
Group Mapping Example:
Windows Group: Domain\Engineers
Permission Group: Engineering
Result: User gets Engineering permissions
Configuration Steps
Create permission group matching AD group name
Set desired permissions for group
AD users automatically inherit permissions
LDAP Server Integration
Configuration
Navigate to Security → RuntimeUsers
Enter LDAP server in AD/LDAP Server field:
   ldap://company.local:389
   ldaps://secure.company.local:636
Authentication Flow
LDAP Attributes Mapping:
LDAP Attribute
Solution Property
sAMAccountName
UserName
memberOf
Permissions (via groups)
displayName
Display name
mail
ContactInfo
department
UserGroup
Runtime Behavior
User Validation Order
Check SecurityUsers (internal)
Query RuntimeUsers database
Validate against AD/LDAP
Apply Guest if no match
Authentication Flow
csharp
Client.LogOn(username, password)
    ↓
1. Check Engineering Users (SecurityUsers)
2. Check Runtime Users (Database)
3. Check LDAP Server (if configured)
4. First valid match logs in
User Identification
Domain Requirements
Client user must exist on server domain
Same domain group membership required
Server validates client credentials
Domain trust relationships honored
Username Formats
DOMAIN\username     // NetBIOS format
username@domain.com // UPN format
username           // Local/simple format
Session Management
csharp
// Get all active users
var users = @Security.GetActiveUsers();

// Check if RuntimeUser
bool isRuntimeUser = @Security.IsRuntimeUser(username);

// Get user source
string source = @Security.GetUserSource(username); 
// Returns: "Internal", "Database", "AD"
Security Configuration
Forcing AD-Only Access
Configuration
Disable solution users, accept only AD:
Enable Use WA in Runtime → Startup
Disable standard authentication port
Configure AD-only port
Implementation
csharp
// Check if using Windows Authentication
if (@Client.IsWindowsAuthenticated)
{
    string domain = @Client.WindowsDomain;
    string user = @Client.WindowsUserName;
    @Info.Trace($"AD User: {domain}\\{user}");
}
LDAP Configuration Details
Connection String Examples
Standard LDAP:
ldap://dc1.company.local:389
Secure LDAP:
ldaps://dc1.company.local:636
With Base DN:
ldap://dc1.company.local:389/DC=company,DC=local
LDAP Attributes Mapping
LDAP Attribute
Solution Property
sAMAccountName
UserName
memberOf
Permissions (via groups)
displayName
Display name
mail
ContactInfo
department
UserGroup
Redundancy Configuration
Primary/Backup Servers
Primary AD Port: 3102
Backup AD Port: 3103
Command Line:
TServer.exe /port1:3102 /wa:true
TServer.exe /port1:3103 /wa:true /backup
Security Considerations
Best Practices
Use secure LDAP - LDAPS on port 636
Limit service account - Minimal permissions
Configure firewalls - Restrict AD ports
Regular group audits - Review mappings
Test failover - Verify redundancy
Document mappings - Clear group relations
Monitor authentication - Track failures
Service Account
Service Account Configuration
csharp
// Configure service account for LDAP queries
@Security.LDAPServiceAccount = "svc_scada";
@Security.LDAPServicePassword = GetSecurePassword();
@Security.LDAPSearchBase = "OU=Users,DC=company,DC=local";
Troubleshooting
Cannot authenticate:
Verify domain connectivity
Check port accessibility
Confirm user exists in AD
Review group memberships
Wrong permissions:
Check group name spelling
Verify exact match required
Review permission mapping
Test with known group
LDAP connection failed:
Test LDAP server access
Verify credentials
Check SSL certificates
Review firewall rules
Slow authentication:
Best Practices Checklist
 Use appropriate source - AD for enterprise, DB for standalone
 Set permissions carefully - RuntimeUsers can't be admins
 Use secure LDAP - LDAPS on port 636 when possible
 Implement audit trail - Track user creation/modification
 Regular cleanup - Remove inactive RuntimeUsers
 Secure database - Protect RuntimeUsers table
 Document user sources - Clear origin tracking
 Test authentication paths - Verify all methods work
Check domain controller load
Review network latency
Optimize LDAP queries
Consider caching
Common Configurations
Manufacturing Domain
AD Server: mfg.company.local
Port: 3102
Groups:
  - MFG\Operators → Operator
  - MFG\Engineers → Engineering
  - MFG\Managers → Supervisor
Enterprise LDAP
LDAP: ldaps://enterprise.local:636
Base DN: DC=enterprise,DC=local
Groups:
  - CN=SCADA_Users → User
  - CN=SCADA_Admin → Administrator
Troubleshooting
User not found:
Check database connection
Verify table exists
Review AD connectivity
Confirm username format
Cannot create user:
Verify CreateUsers permission
Check database write access
Review policy restrictions
Confirm unique username
AD/LDAP users not working:
Test domain connectivity
Verify group mappings
Check authentication mode
Review domain credentials
Wrong permissions:
Check group name spelling (exact match required)
Review permission mapping
Test with known group
Slow authentication:
Check domain controller load
Review network latency
Optimize LDAP queries
Consider caching
See Also
Security Module (Reference) - Complete security documentation
Security & Compliance (Tutorial) - Setup guide
Standards Compliance (How-to Guide) - Regulatory requirements

In this section...