Domain Authentication Behavior
The default installation of LSA contains entries in a properties file for administrators and authenticated users. The properties file contains two access groups for LSA.
- full_access_groups – Administrators and non-administrators
- readonly_access_groups – Authenticated users
LSA supports multiple comma (,) separated group names for both administrators and authenticated users. Users that are part of both groups are assigned administrative access to LSA. Server administrators can edit entries or add multiple groups to the individual entries.
Users who are part of the full_access_groups will have full access to LSA even if they are not an administrator. If the administrator group value is removed from the full_access_groups, an error message will display Invalid Credentials, and you will not be able to access LSA.
Users who are part of the readonly_access_groups will be given read-only access by default. If the authenticated users group value is removed from the readonly_access_groups, an error message will display Invalid Credentials, and you will not be able to access LSA even in read-only mode.
LSA will prompt users to provide the domain name, user name, and password of the server they are trying to access. Once the credentials are verified, users will given access based on their assigned access level.