“Settings/User settings/Authorization Management" should be used to create users and define authorizations and groups. On this page
In the Groups tab you manage Groups and the authorizations that Groups have.
In the Users tab, you define users, send messages and match them with groups.
System administrator: Can create users and groups. Can add and remove users to and from groups. GEODI authorizations are assigned to groups. At a minimum, we recommend creating the following groups.
GEODI Users
GEODI Managers
GEODI System Administrators
The number of group members is specified. A user can be a member of more than one group.
GEODI also has LDAP/Active Directory support.
The machine where GEODI is installed must be in the same domain.
LDAP groups are not supported, authorization groups must be defined in GEODI.
Management for users coming with LDAP takes place on the Active Directory side.
When passwords kept in LDAP change, it also affects GEODI.
When users are deleted from LDAP, they cannot enter GEODI.
You add LDAP users when you map them to Groups. When you type the user name, if there is a user with a similar name in LDAP, it is presented as an option. This makes it easier to manage a network with many LDAP users.
LDAP users appear as domain\username. The management of these users is entirely on the AD side, so no additional option is provided..
GEODI Notification services use the emails of LDAP users defined on the AD side.
Folder and file based authorizations given on the AD side are used by GEODI. GEODI cannot exceed AD side restrictions but can set new restrictions.
SupportLDAPPermissions must be set to true in the project detail settings ContentReadereEnumerators settings to use the folder authorizations given on the AD side.
You specify which authorizations are used for each group.
The authorization categories may vary depending on the installed modules. For example, with the MOBIDI Connector application module, the necessary categories related to MOBIDI Office are also added.
Authorizations are given to groups. The authorizations of users added/removed to groups are automatically updated.
 |
Users can come from the LDAP/AD side or be GEODI users.
The management of LDAP side users is on the AD side. Changes on the AD side (such as e-mail, password) may take 10-30 minutes to be reflected. During this time the old information will be valid.
You can send an invitation email to the newly added user (if user email is defined).
Users who forgot their password can request a new password from the login page.
If your license allows, you can create open GEODI projects with guest user definition. Guest users are a practical solution for informational projects such as the Ankara digital city archive or the Nigerian Ministry of Treasury projects.
You need to activate guest users in Settings. You also need to include them in a group and set the appropriate authorizations for your project. They will appear as "guest" in the user list.
GEODI can integrate with authentication sources such as Google, Facebook. Users can log in to the system with these authentication sources. There are ready definitions for Google, Dropbox, Linkedin, Facebook, Microsoft. You can find the required definition for each of them in GEODI/Settings/LoginProvider directory. To activate them, you need to change the extensions to jSettings.
The resources you activate will appear on the login page. You need to authorize users from these sources separately. You do this by including them in a group.
Select the group you want to authorize. If you type "*" in users and select Google, you will authorize all users coming from the google resource. If you replace "*" with a user's email address, you will only authorize that user.
GEODI infrastructure is also suitable for external user authentication services other than LDAP.
KIt can be integrated with other platforms used by organizations. It is sufficient to provide the services specified in developers.dece.com.tr.
It can also be integrated with the user authentication features of services such as Facebook and Google.
If no selection is made for any group, it is interpreted as no authorization and in this case the authorization button is unlocked.