Active Directory

It is important for a government website to protect itself from unauthorized users. The Vision CMS includes a user and permission system with encrypted passwords that ensures only authorized staff can login to the backend. We can also add custom programming to integrate the CMS login with the Active Directory if needed.

The client must provide an internal server to host a web service that can be used for the website to interface with the Active Directory server. SSL is the required protocol for data communication.

Please see here for more information regarding Active Directory Configuration.

Setup Guide - For client

Please use the following document for clients utilizing the vCMS Active Directory Web Service. The following guide gives them some background regarding how the AD connection works with the CMS as well as prompting them to provide the requisite information that allows us to set up the web service.

Review and share this guide for AD Setup with the client.

If the client is using ADFS, use this guide.

Expand/Contract Questions and Answers

When the users enter their credentials, where is the authentication process done?
When the users enter their credentials, Vision CMS will pass the credential information to AD Web Service, then AD web service will pass to AD to get authenticated. Then AD web service will give the authentication result back to vision CMS6, if authenticated successful, then vision CMS6 allows users login, otherwise, will not.
Where is the information that's extracted through the Web Service stored?
Vision will store the fetched information in the Vision CMS database.
What information does the Vision AD Web Service extract from the AD?
This is the data that is communicated on sync:
Active Directory - Step 1A
Active Directory - Step 1B
Active Directory - Step 2
Active Directory - Step 3
Active Directory - Software Requirements
Does visionCMS support other Directory Services aside from Microsoft Active Directory which still have an LDAP implementation such as OpenLDAP, Apache Directory Services, Red Hat Directory Services... etc?
It is a possibility to use these but it will require further testing. Currently we do not have any implementations with different directory services.
Why does our Active Directory integration not use Microsoft's ADFS (Active Directory Federation Services) solution?
There are several reasons why we do not use ADFS for CMS6:
- Our visionCMS has some logins that must work whether Active Directory is used or not, such as the Vision Webmaster account login. ADFS does not have allow this.
- Our visionCMS allows a client to use Active Directory for both visionCMS Users and Members at the same time. ADFS does not allow this.
- Our visionCMS can easily switch back and forth from using Active Directory to not using Active Directory, it would not have been easy to switch it ON and OFF with ADFS.
- If Microsoft updates and makes changes to their ADFS solution it could break our system.
How do we secure the communication between the CMS and the Active Directory servers?
We require and make use of SSL for securely transporting communication packets between the CMS and the Active Directory servers. This is very important if Vision hosts the site or if Client hosts the site in a DMZ. We also have a web service that the CMS would communicate to instead of directly communicating with the Active Directory and in addition to that, this web service only responds to a specific IP range (by default, it contains our co-location and office IP ranges).
When the client adds a user into the appropriate AD group, how long does it take for our system to pick that up? Is there a delay?
There is a window service tasked to do this automatically every 24 hrs. This is usually scheduled during off-peak hours 10PM - 3AM, but this can be manually invoked in the backend if you would like by placing a call to Vision directly for the request. For several technical reasons, Sysadmin access is allowed only the Vision Network Admin team.

Setup Guide - For client

When the users enter their credentials, where is the authentication process done?

Where is the information that's extracted through the Web Service stored?

What information does the Vision AD Web Service extract from the AD?

Active Directory - Step 1A

Active Directory - Step 1B

Active Directory - Step 2

Active Directory - Step 3

Active Directory - Software Requirements

Does visionCMS support other Directory Services aside from Microsoft Active Directory which still have an LDAP implementation such as OpenLDAP, Apache Directory Services, Red Hat Directory Services... etc?

Why does our Active Directory integration not use Microsoft's ADFS (Active Directory Federation Services) solution?

How do we secure the communication between the CMS and the Active Directory servers?

When the client adds a user into the appropriate AD group, how long does it take for our system to pick that up? Is there a delay?