Managing User Accounts

Note: Must be set up by All Sites Admin.

If you have Active Directory and have configured Revolution with your Active Directory IP address (done on the Global Settings page, Authentication section), you can use the password associated with the user's Active Directory account instead of creating a separate password for Revolution.

To use Active Directory, create a user account as you would normally, but follow these rules:

• The Full Name should match what's entered in the user's Active Directory account.
• The Username must exactly match the Active Directory username.
• Check Use AD Authentication. The Password field is then hidden.

The AD column on the Users page shows green for user accounts with 'User AD Authentication' checked; otherwise, the column shows gray.

Each user account must be assigned at least one site. The system automatically creates a Default site that you can assign to user accounts if your organization is only using one site.

Tip: You can change the name for the Default site if you wish.

Determine access to notifications, endpoints & contacts, tags, and calendars:

• Single-site organizations – leave Allow Access to All Sites enabled and select Default from the Site drop-down list.
• Multi-site organizations:

  • If you want this user to only have limited access, clear Allow Access to All Sites and select one or more Sites from the drop-down list they will have access to.

    Select multiple Sites to allow Users to perform actions limited to those sites.

  • If you want this user to have access to all sites, leave Allow Access to All Sites enabled, and select a Site from the drop-down list to be the user's default site.

The sites setting is not visible to users on their Profile page but admins can see which sites are assigned to user accounts on the Users page. Users can see which sites notifications and endpoints are assigned to on the Manage Notifications and Status > Endpoints pages.

It is unlikely that you will want to import all Active Directory user accounts into Revolution as user accounts. To filter which users to import:

1. Create one or more organizational units (OU) in Active Directory (AD)
2. Add users or user groups to the OUs
3. Import either each OU or individual group into Revolution, it is not suggested that you import both OUs and groups.

Here are a couple of suggestions on how to filter AD users to import into Revolution.

For single-site organizations, using groups instead of OUs, create a group of users in Active Directory that you want as Revolution users for example, Revolution Users. You will then import this group into Revolution. After the import, adjust individual Revolution user accounts to assign the appropriate user role.

For multi-site organizations, here are a couple of suggestions:

• Create an organization unit for each Revolution site, move AD users into the appropriate OU. In each site OU, create a subset group of users in Active Directory that will be imported as Revolution users. This hierarchy allows you to use the OU to import AD users into Revolution as contact records, specifically importing just the user group into Revolution as user accounts. The Revolution import process allows you to assign the site during import.
  For example, I have Active Directory users at two schools that I need to create Revolution users accounts for. I have two sites defined in Revolution– Scorpion and Good Witch. In Active Directory, I create two OUs – Scorpion and Good Witch. I've moved my AD users into their appropriate OU. Next, in the AD Scorpion OU, I create a Group (Scorpion Users) and assign the users I want to import as Revolution users. Then I do the same for the Good Witch OU.

Now, in Revolution, I import the Scorpion Users AD group to Revolution with the Scorpion site assigned. Then I'll repeat the process to import the Good Witch Users AD group to Revolution with the Good Witch site assigned. When I import my AD users to create contact records, I'll use the Scorpion OU and Good Witch OU instead of the groups.

• Alternately, you could create one AD organization unit and one Group in that OU, import from the one Group into Revolution, and then adjust each Revolution user account to assign the appropriate site and user role.

You can create AD organizational units and groups however you want to import users into Revolution.

These are high-level steps. For specific instructions, refer to your Active Directory documentation.

Create organization units:

1. Create one or more organizational units in Active Directory > End Users. (I'm creating these organizational units – Scorpion and Good Witch.)
2. Move your AD users into the appropriate organizational units.

Choose import method:

If you're importing from a group, all you need to do is enter the AD group name into the Revolution Group Name field. Leave the Container DN field blank.

If you're importing from an organization unit:

1. Right-click on an OU that you just created, click Properties > Attribute Editor > distinguishedName > View.
2. Copy the distinguishedName value.
3. You're going to paste this value in the Container DN field in the Revolution import function (step 5 below).

1. Go to Users Contacts & Sites > Import.
2. Select New > New Active Directory import settings.
3. Enter a Name for the import.
4. Select whether this import is Available in All Sites or is only available to a single Site.
   • Single-site organizations, leave Available in All Sites selected.
   • Multi-site organizations, do one of the following:
     1. If you are an All Sites Admin – To assign these users to a specific site, clear Available in All Sites and select a Site from the drop-down list. Or, you can leave the tag Available to All Sites.
     2. If you're a Site Admin – This tag is automatically assigned to your default site.
5. For Import Type, select User.
6. For Server, enter your Active Directory Hostname or IP Address. If you are using Secure LDAP, you must specify a hostname.

7. Enable Use SSL to import using secure LDAP. When enabled, you must also specify the secure port value (the default port is 636).

8. Enter the Username and Password for an Active Directory user account that has read-only permissions, if possible.

   This is typically a service account that is not assigned to a particular person and does not have admin privileges. Make sure the account has access to the designated container DN (Distinguished Name).

9. Do one of the following:

• Container DN only – Enter the distinguishedName (DN) of the Active Directory OU into the Container DN field and leave the Group Name field blank.

  All AD users in this OU will be imported into Revolution and used to create user accounts.

• Group Name only – Enter the Active Directory Group Name and leave the Container DN field blank.

  Only AD users from this group will be imported into Revolution and used to create user accounts.

• Both Container DN and Group Name – Use this method if your organization has thousands of users.

  Enter information into both Container DN and Group Name to narrow down the users to be imported for user accounts in Revolution.

Note: The Active Directory Group must be in the same hierarchy as the OU.

Important: Leaving both the Container DN and Group Name fields blank results in Revolution importing all AD users and creating Revolution records for them, which could be several thousand for a large company. If you choose to do this, then you should note that you could run into performance issues and possibly crash Revolution.

10. If you are using Revolution outside of the US, enter the appropriate ISO Country Code.
11. (Optional) Enter a Role. Once users are imported into Revolution, you can change the user role for each account as needed. (Since most of my users will be Editors, I'm going to select that role and then adjust the two accounts that I need to assign as Admins.).
12. For Use Active Directory Authentication:
    • Enable this option to define that imported users will use their Active Directory credentials to log in to Revolution.
    • Disable this option to define that a user will receive a One-time password to use on their first login. They will be required to change this password at that time.

13. Select Save.

    After this initial import, Revolution displays a brief note with the status of the refresh. You can also view detailed log information by going to Logging and filtering for ImporterLog or reviewing the importerLog.txt log file.

    All of the Users created from this import will retain the various values and settings you specified, such as their role or any site information.

Note: Phone numbers import in whatever format used in AD. Therefore, you may see numbers listed as 503-555-9876, but manually entered phones might be entered as 5035559876.

If you created more than one organizational unit, repeat the process to import the other units.

You can refresh your Active Directory imports manually or automatically, using any of the following methods:

• Automatic upon start or restart – When you start or restart your Revolution server, the Active Directory imports are refreshed on a two-minute delay
• Automatic on a schedule – Go to Global Settings > Import Contact and Users and enter a time for a daily refresh.
• Manually from the Import Configuration page – Go to Users Contacts & Sites > Import and select Import.
• Manually from the System Status page – Go to System Status > Import Configuration and select Refresh Data.

After completing the refresh, Revolution displays a brief note with the status of the refresh. You can also view detailed log information by going to Logging and filtering for ImporterLog or reviewing the importerLog.txt log file.

Upon a refresh, if an AD record is Disabled, Revolution will:

• For Users, change their role to Inactive.
• For Contacts, change their state to Inactive.

Single-site organizations: Edit user accounts to change user role where needed.

Multi-site organizations: Edit user accounts to:

• assign or change site assignment
• adjust access to notifications, endpoints & contacts, tags, and calendars
• change user role