Keyfactor Command uses groups to control access to the various Keyfactor Command features. The Keyfactor Command Management Portal supports multiple groups with different levels of access to the portal. During the installation, at least one group or user must be entered to grant full administrative access to the portal. After installation, additional groups can be configured through the Keyfactor Command Management Portal to grant more limited access to the portal. The same group may be used for multiple roles. Existing groups may be used.
Important: The built-in Active Directory groups Domain Admins and Enterprise Admins cannot be used directly to grant access to the Management Portal due to how these groups function within Windows. You can create a custom Active Directory group, reference that group in the Management Portal, and add the built-in Domain Admins or Enterprise Admins group to that custom group, if desired.
Tip: If you’re using Active Directory as an identity provider and wish to grant access in the Management Portal to users from trusted Active Directory forests, create a domain local group in the Active Directory domain in which Keyfactor Command is installed, put the cross-forest
An Active Directory forest (AD forest) is the top most logical container in an Active Directory configuration that contains domains, and objects such as users and computers. users and groups in this local group and grant access in Keyfactor Command to this domain local group.
An Active Directory forest (AD forest) is the top most logical container in an Active Directory configuration that contains domains, and objects such as users and computers. users and groups in this local group and grant access in Keyfactor Command to this domain local group.