Active Directory Configuration / Best Practices

Overview

Report Runner authenticates users via Active Directory and uses their group memberships to control report access. The BASE DN setting tells Report Runner where to starts its search in AD. Pointing it at the domain root returns every group in the entire directory. For large organizations, this can "overwhelm" you with "group" results.

Don't Reuse Existing IT/Network Groups -- Create New "Report Runner" Groups

AD groups created for network and IT access purposes are not usually suitable for controlling report permissions. The group list will be enormous, ownership is unclear, and IT changes can accidentally break report access. We recommend creating dedicated groups for Report Runner instead.

Recommended Structure

Create a parent OU=ReportRunner in your domain. Add business unit OUs inside it. Create AD Security Groups inside each BU OU. Here is a sample structure:

OU=ReportRunner,DC=company,DC=com
    ├─ OU=Accounting
    │      ├─ RR_Accounting_FullAccess
    │      └─ RR_Accounting_ReadOnly
    ├─ OU=Sales
    │      ├─ RR_Sales_Dashboard
    │      └─ RR_Sales_Forecasting
    ├─ OU=Inventory
    │      └─ RR_Inventory_AllReports
    ├─ OU=Management
    │      ├─ RR_Management_Executive
    │      └─ RR_Management_Operations
    ├─ OU=North
    │      └─ RR_North_Regional
    ├─ OU=South
    │      └─ RR_South_Regional
    ├─ OU=East
    │      └─ RR_East_Regional
    └─ OU=West
           └─ RR_West_Regional

Report Runner uses Subtree scope, so one BASE DN at the parent OU returns all groups in all child OUs automatically. As new business units are added, create a new child OU — the BASE DN setting never needs to change.

Note: The RR_ prefix makes it clear these groups belong to Report Runner and should not be repurposed for IT/network access. Users are assigned to groups, not OUs. OUs are containers only.

Where Are The Active Directory Settings Saved In Report Runner? Where Is The Base DN Setting Used?

The short answer is in your JNRRV.INI file for Report Runner Viewer, in your JNRRA.INI file for Report Runner Administrator, and in your web.config file for Report Runner Web Portal. The long answer requires a bit more detail.

We also have "legacy" settings for LDAP and some newer settings for LDAPS. We know this can be a bit confusing, but we work hard to always support older legacy settings while also giving users the ability to utilize newer settings.

JNRRV.INI and JNRRA.INI Settings

These settings are under the [Enterprise Viewer] group in each of these files, and they are set and stored the same in each.

For legacy/basic LDAP, there's really only two settings:

ADPath = AD domain (no prefix or suffix) -- EX: whatever.ldap.knownkeep.net
ADFilter = Base DN -- EX: OU=ReportRunner,DC=company,DC=com

For newer/latest LDAPS, we have the following:

LMODE = LDAPS
LSERVER = (same as ADPath above)
LBASE_DN = (same as ADFilter above)
LPORT = 636 (port 636, by default)
LID = administrator ID (if needed for security/authentication)
LPW = administrator Password (if needed for security/authentication)

You may notice some additional AD-related settings, but they are not necessary for most users. To keep this KB article as brief and as focused as possible, we are going to skip them here.

WEB.CONFIG Settings

The web.config settings for Report Runner Web Portal are slightly different and offer some slightly different features (apps were developed separately on different timelines -- that's why features/settings are not exactly alike).

LDAP / Active Directory Settings (Port 389)

ADDomainPath - set this to your LDAP domain (preface with LDAP just like example) - EX: LDAP://localhost/OU=RR,DC=reportrunnerserver,DC=com

ADUserName - set this to the ADMINISTRATOR ID - EX: administrator
ADPassword - set this to your ADMINISTRATOR Password (automatically encrypted the next time Web Portal is used)
ADGroupFilter - set this to wildcarded value to filter what groups are returned - EX: *reports* or something like rr* or something like businessgroup*

LDAPS / Active Directory Settings:

LDAPS_Server - set this to the domain only (do NOT preface with LDAPS) - EX: whatever.ldap.knownkeep.net
LDAPS_BaseDN - set this to your base/root DN - EX: DC=ldap,DC=knownkeep,DC=net
LDAPS_Port - set this to the LDAPS port - EX: 636
LDAPS_UserName - set this to the ADMINISTRATOR ID - EX: [email protected] (UPN format)
LDAPS_Password - set this to your ADMINISTRATOR Password (automatically encrypted the next time Web Portal is used)
LDAPS_UPN_Domain - set this to your UPN domain (this gets appended to your end user's login ID) - EX: ldap.knownkeep.net

LDAP/LDAPS Testing Utility: 

We have a simple testing utility for testing connections to your LDAP or LDAPS domain. Just download, extract, review the ReadMe file, and edit your settings (in settings.ini). 

https://knownkeep.s3.us-east-1.amazonaws.com/KnownKeepLDAPSTester.zip