Table of Contents: User Synchronization and Single Sign On

• Basic Knowledge
  • Continue with Microsoft
  • User Synchronisation: AD Attributes 
• Basic Configuration
  • How to Configure SSO
  • How to install the User Sync V2
     
• NTLM
  • Troubleshooting Guide Single-Sign-On with NTLM
     
• SSO with Azure
  • Connecting to Azure AD (Knowledge Center)
  • Connecting DocuWare with an Identity Service - Microsoft Azure Active Directory (Knowledge Center)
• SSO with ADFS
  • Microsoft Active Directory Federation Services - Guide to configure DocuWare and how to create a Application Group in ADFS (Knowledge Center)
• SSO with Okta (7.8)
  • Connect DocuWare with Okta
• SSO with OpenID Connect (7.8)
  • Single Sign-on with OpenID Connect
     

KBA related to

• Common configuration behaviors
  • Too many users were synchronized
• Error message
  • ADSync.log contains this error
    • Password was saved with a different user account
    • Failed to synchronize ldap user... We expect the user to be an existing DocuWare user, but he is either not active or we failed to match him while syncing users by either externalId, externalProvider or name and email
• Specific behavior​​​​
  • Windows Pop Up when attempting a login with Windows NTLM
  • DocuWare User Synchronisation Desktop App - User is not created
• Special Use Cases
  • User Synchronization (V2) - How to synchronize users from an external directory to DocuWare?
     
• Restrictions
  • Licenses
    1. Only members of the predefined role "Organization Administrator" have permission to assign licenses.
    2. This authorization applies to User Synchronization in Administration(V1), DocuWare User Synchronization Desktop App (V2) and manual creation of a user.
    3. The function profile "Manage Users" does not have the authorization to assign licenses.
    4. We, therefore, recommend you run the user synchronization with a corresponding user.
    5. For more information on predefined roles in DocuWare, click here: https://help.docuware.com/#/home/63950/1/1
    6. Licenses are assigned in this order:
       1. Free workflow licenses
       2. Free named license
    7. The assignment sequence cannot be configured
    8. If all licenses are assigned, no further assignment is made
    9. Users can not be excluded from automatic assignment
    10. Deactivated users keep an assigned license
  • A networkid can only be set once when the user is created. After that, the networkid can only be changed by the user. Even if the sAMAccountName has been changed in the Active Directory.
  • AD User Synchronization Version 2 requires that the user performing the synchronization be currently logged into that domain.  Additionally, they need sufficient rights in DocuWare to add/modify/deactivate users.  Synchronizing more than one domain to a single DocuWare organization is supported.  In order for this to occur, a separate instance of the tool needs to be run on each domain to be synchronized. More Infos can be found in the Release Notes of Version 7.0
  • Upgrading from User Sync Version 1 to User Sync Version 2 can be done from DocuWare Version 7.5 (See Release Notes of DocuWare 7.5 for further details): 
    1. We implemented in User Sync V1 a unique identifier for each user in the active directory so that we can uniquely match users and prevent the creation of duplicate users in DocuWare.
    2. This is especially relevant when customers upgrade from User Sync V1 to User Sync V2 which uses the external ID to uniquely identify and match an AD user to a DocuWare user.