This background task will connect to and synchronize user information from LDAP into CentricMinds (based on a defined position within LDAP or a desired search criteria). The sync adds, modifies and/or deletes user accounts within CentricMinds as needed.
When an individual user attempts to authenticate with CentricMinds, that authentication can be performed against an LDAP data source. After successful authentication, a synchronization of that user's information is performed.
During a synchronization of a user's information into CentricMinds, the following is supported:
This has made it possible for organizations to use an LDAP data source as a 'source of truth' for user information and provide access to CentricMinds content in a structured and automated way. It has also made it possible to support user personalization and automated subscription and/or notifications, by matching content-based metadata against synchronized user metadata.
CentricMinds provides a flexible authentication model which includes support for the following approaches:
CentricMinds provides support for Single Sign-On (SSO). SSO is an approach to access control of multiple, related, but independent software systems. With this approach a user logs in once and gains access to all systems without being prompted to log in again at each of them. CentricMinds supports the following:
Connect with your AD environment, extend user profiles with our tools and provide a seamless login with SSO.
Access to Intranet software like CentricMinds is typically driven by security repositories, with Active Directory being the most common.
Uniquely CentricMinds provides its own security management environment which can be either integrated with Active Directory, or operate as a standalone environment where the creation and authentication of users is managed within CentricMinds.
CentricMinds supports a Users, Groups and Roles security model. Users are also viewed as resources within CentricMinds and as such can be readily shared and used in the same manner as content. This provides unique and powerful ways of displaying content associated with staff within the Intranet. Users are classified based on their function, namely:
CentricMinds provides two key points of integration with an LDAP compliant data source (e.g. Microsoft Active Directory):
A background tasks that connects to and synchronizes a user’s information from LDAP into CentricMinds.
When an individual user attempts to authenticate to CentricMinds, that authentication can be performed against LDAP.
CentricMinds provides a flexible authentication model, which includes support for the following approaches:
CentricMinds provides ‘out of the box’ support for the internal storage of user accounts and their associated authentication. User information is stored within the CentricMinds database.
CentricMinds provides ‘out of the box’ support for authentication with a LDAP compliant data source (e.g. Microsoft Active Directory). The data source will remain the ‘source of truth’ and all authentication attempts via the CMS will include communication and verification with the data source. Information (included security group and role associations) is synchronized and used by the CMS.
A combination of Traditional and LDAP Authentication; which first tests against an LDAP compliant data source (e.g. Microsoft Active Directory) followed by an authentication attempt against the CMS (in the event that the LDAP authentication fails). This provides the ability to support internal authentication of staff, but also supports authentication of external users (who do not have an LDAP account) as needed. This brings greater flexibility in supporting user authentication across varying target audiences.
CentricMinds also provides the ability to perform authentication against external systems (via HTTPS requests) or external databases (via direct data querying).
CentricMinds provides support for Single sign-on (SSO). SSO is an approach to access control of multiple, related, but independent software systems. With this approach a user logs in once and gains access to all systems without being prompted to log in again at each of them.
The CMS supports a basic approach to SSO using the browser’s ability (via NTLMv1 or NTHMLv2) to retrieve the username of the user currently logged into Windows (i.e. within a domain). When the site is accessed, the user will be silently logged into the CMS via their windows user account.
The CMS supports an advanced approach to SSO (which will work with all browsers) and makes use of Microsoft Active Directory Federation Services (ADFS). When the Intranet is accessed, a secure ADFS token is checked for authentication information; if one exists, the user will be silently logged into the CMS, if one does not exist, the user will be directed to login via ADFS and then passed back accordingly.