SpendMap User Guide (v15)

Field

Description

Distinguished name

•This is the Active Directory (LDAP) host or hosts to connect to when authenticating users. This can be one or more host names (e.g. server1) or IP addresses (e.g. 192.168.1.1). Separate each with a space.

•Each host name can optionally include a port number that is separated from the host name by a colon (e.g. server1:12345). If the port is not included, the default port 389 is used (636 when using SSL).

•TIP: If you are using the Mobile Web App and specifying multiple hosts, specify the host of the Mobile Web App server as the first host in the list.

•IMPORTANT: If Active Directory support is ever disabled (by deleting the contents of this field), for security reasons the Windows User ID field in the [NAME/ADDRESS] Folder of the User Master File will be deleted and all system user passwords will be set to the user ID itself. Each user will then be forced to select a new password upon their next login.

Name is fully qualified?

•When connected to the server, an A-Record only DNS lookup is performed on the supplied host string. Check this box when passing a fully-qualified DNS host name as opposed to a domain name for the host name setting above. Using this option can reduce the authentication time by avoiding a query to the remote DNS server for SRV record lookups.

Domain name

•If you have multiple domains in your organization AND you have specified multiple host names, above, from more than one domain, you must enter the domain for each host name used. For clarity, if you only have one domain in your organization OR if all hosts indicated above are within the same domain, you do NOT need to enter a domain here.

•You can specify a domain name (recommended), a UPN, a Windows NT style username or other name that the directory server will accept as an identifier of the Active Directory services on the host server (above).

Connection Time-out (seconds) – Main System Interface

•The number of seconds that the Desktop Application and Web App will attempt to authenticate the user against the Active Directory server. If authentication is not completed and the time-out is reached, the authentication process is canceled and the user is notified that a time-out has occurred.

Connection Time-out (seconds) – Mobile Web App

•Similar to the previous setting, this is the number of seconds that the Mobile Web App will attempt to authenticate the user against the Active Directory server. Keep the Mobile Web App time-out as low as possible as excessive delays during authentication will impede Mobile Web App performance.

Security Option

•Select one of the following security options:

•Generic Security Services (default option):  This option does not provide authentication, but instead chooses the most appropriate authentication method from a list of available services and passes all authentication data to that service. (Requires Windows 2000 or above)

•Digital signing:  Enables Kerberos signing (cannot be used with SSL) 

•Encryption: Enables Kerberos encryption (cannot be used with SSL)

•SSL (Secure Socket Layer):  Enables use of an SSL connection.

•NOTE: At the time of writing, Active Directory access is only used for user authentication; no other data is read from the Active Directory database. In addition, SpendMap uses the "safe bind method" during authentication that does not send plain text passwords across the network. Therefore, in most cases, the first option (Generic Security Services) should offer sufficient security.

Button

Description

[OK]

•Save changes and exit.

[CANCEL]

•Exit without saving changes.

[ADDITIONAL SECURITY SETTINGS]

•Go to Security Settings utility to see related settings.