---
alias: operation-guide-multipledomains
description: "Configure Multiple Active Directory Domains for seamless integration within the system."
---

# Multiple Active Directory Domains Configuration

Critical Manufacturing MES supports multiple Active Directory domains. Enabling them involves two components:

* The MES Host, which looks up users and synchronizes roles from Active Directory.
* The Security Portal, which signs users in.

The installation configures the first domain from the [[installation-guide-installation#security|Active Directory settings]] entered in DevOps Center: the MES Host domain, the LDAP configuration entries of the domain, and the Security Portal strategy. The following sections describe how to add the other domains.

## MES Host

DevOps Center accepts a single Active Directory domain, so add the other domains after the installation, through configuration entries. Don't change the MES Host configuration manually.

To add a domain:

1. Create the following configuration entries, where `[FQDN]` is the fully qualified domain name of the domain. The installation already created them for the first domain.

    | **Configuration Entry** | **Value Type** | **Description** |
    | ------------------- | ---------- | ----------- |
    | `/Cmf/System/Configuration/LDAP/Credentials/[FQDN]/UserName/` | `System.String` | User with permission to search the domain. |
    | `/Cmf/System/Configuration/LDAP/Credentials/[FQDN]/UserPassword/` | `System.Security.SecureString` | Password of the user. |
    | `/Cmf/System/Configuration/LDAP/Credentials/[FQDN]/Port/` | `System.Int32` | LDAP port of the domain controller, for example `389`, or `636` for LDAPS. |
    | `/Cmf/System/Configuration/LDAP/Credentials/[FQDN]/UseSSL/` | `System.Boolean` | Connects over LDAPS. |
    | `/Cmf/System/Configuration/LDAP/Credentials/[FQDN]/DisableCertificateValidation/` | `System.Boolean` | Skips the validation of the domain controller certificate. |
    | `/Cmf/System/Configuration/LDAP/Credentials/[FQDN]/Domain/` | `System.String` | Optional. NetBIOS name of the domain. When set, the MES Host reads the domain from the configuration, without LDAP queries to discover it. |

    Table: LDAP configuration entries for each domain

2. Set `/Cmf/System/Configuration/LDAP/EnableMultipleDomain/` (`System.Boolean`) to `true`. With this entry enabled, the MES Host uses the domain of each user, follows LDAP referrals with the credentials configured for each domain, and searches for roles across all configured domains.
3. Restart the MES Host. The MES Host reads these configuration entries at startup.

!!! warning "Use the Correct Value Type"
    Create each configuration entry with the value type shown in the table. If an entry has a different value type, for example `Port` created as `System.String`, the MES Host fails to start after the restart, and the entry has to be corrected directly in the database.

For more information, see [[system-configuration-entries]].

## Security Portal

The Security Portal needs one [Windows Active Directory](security-portal/security-portal-strategies/security_portal_strategy_activedirectory.md) strategy (`local-ActiveDirectory`) per domain. Each strategy connects to its domain independently.

The installation creates the strategy for the first domain, and the DevOps Center installation doesn't support more than one. Multiple domains are not available out of the box: add the strategies for the other domains in a customization package, through a CmfEntrypoint configuration transform. The transform is applied to `config.json` every time the Security Portal container starts. Manual changes to `config.json` inside the container are lost when it restarts.

The following transform adds a strategy for a second domain to the `MES` tenant:

```json
{
  "@jdt.merge": [
    {
      "@jdt.path": "$.tenants[0].config.MES.strategies",
      "@jdt.value": [
        {
          "id": "ExampleSecondDomain",
          "displayName": "Example Second Domain",
          "type": "local-ActiveDirectory",
          "config": {
            "defaultDomain": "exampleseconddomain",
            "ldap": {
              "url": "ldap://exampleseconddomain.company.com",
              "base": "DC=exampleseconddomain,DC=company,DC=com",
              "user": "EXAMPLESECONDDOMAIN\\mesadmin",
              "password": "<Password>"
            }
          }
        }
      ]
    }
  ]
}
```

For how to package and deploy a configuration transform, see [Deployment via CmfEntrypoint](https://developer.criticalmanufacturing.com/explore/guides/customizations/securityportal/configuration/#deployment-via-cmfentrypoint) in the Developer Portal.

## Users and Roles

After configuring a domain, create its users and roles in MES as for the first domain. See [[user-guide-security-users]] and [[user-guide-security-roles]].