Using Active Directory to Manage Application permissions

Question

I am a software developer that is integrating Active Directory into my application. I am using Delphi but I have a question about Active Directory setup.

Currently the software prompts for a username and password on start up. The only roles are admin and user. The admin is an application admin and the windows user may not have any domain/system admin privileges.

I want a Domain Admin to be able to open the application and assign Domain Users to either admin or user. This I have found some code to handle.

My question is how should Active Directory be setup. I did some quick searching and found a lot of information and it is a little overwhelming for this lowly developer.

My guess would be to have a group called CompanyGroup and a sub groups called CompanyAdminGroup and CompanyUserGroup. The reason for the CompanyGroup is that there are folders that both CompanyAdminGroup and CompanyUserGroup need read/write access to. Seems easier to manage that at a CompanyGroup level.

Basically looking for direction on how to properly setup AD for this scenario. I appreciate any and all feedback.

Answer 1

I would suggest creating a security group in Active Directory that matches the groups in the application.

Something along the lines of APPLICATION_USERS or APPLICATION_ADMINISTRATORS.

Make this two a member of the two groups in the application. Assign members to the two Active Directory groups that need each access.