> ## Documentation Index > Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt > Use this file to discover all available pages before exploring further. # WebMarshal and NDS > Import users and groups from Novell NDS, server considerations for the NDS connector, and NDS authentication in the browser. WebMarshal can import users and groups for authentication from Novell NDS. ## NDS integration overview The WebMarshal server retrieves NDS user information from a NDS tree. Additional details on how to use this connection can be found in [User management](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#user-management). At the client workstation, the account information can be entered manually at the start of a browsing session. WebMarshal also includes a utility to automate authentication from client workstations. ## Server considerations Before configuring the Novell NDS connector, install the latest version of the Novell NDS client on the WebMarshal server. ### Public access Experience with the version of NDS included with NetWare has shown the following: #### NetWare 5.x By default the \[Public] account can browse all users and groups in the tree (unless the NDS administrator locks down the site). #### NetWare 6 By default the \[Public] account can get a list of user groups but cannot retrieve the members of the list; therefore a user account is required to import users. Furthermore the user group 'description' is only available if the chosen account is an administrator. It is possible to broaden the \[Public] access to a NDS tree by adding permission for the \[Public] account to access the 'Group Membership' property. This is performed from the 'Tree' item in ConsoleOne. ### Logon access If an account logon to the NDS tree is required, remember that the Windows Novell client logs on as a Windows user as well. This user can be either a local account in your NT user database or a NT domain user. Therefore each NDS user actually has a dual identity. Most sites resolve this by creating an NT account and a NDS account with the same name and password. ### NDS limitations The NDS client has a limitation in that it only allows *one* NDS logon per logged on NT user. This means for example that it is not possible to logon to NDS as 'Bob' and then run another application as 'Bill'. By default, the WebMarshal engine service runs under the NT LocalSystem account. Because this is different to the NT account that is used by the interactive user, the engine should have the freedom to log in as any NDS account that it chooses. It is not recommended therefore that you modify the account used by any of the WebMarshal services from the default of LocalSystem. If you did you could create the possibility of a clash between the interactive user and the WebMarshal services. (For example, when the interactive user logged out he might also log out the WebMarshal services from NDS as well). ### NDS name conventions By default NDS uses names as in the following example to refer to user and group objects in the tree: ```text theme={null} CN=Bob.OU=Marketing.O=NewYork ``` WebMarshal also supports abbreviating this format to: ```text theme={null} Bob.Marketing.NewYork ``` To convert from the shortened form back to the full form, WebMarshal uses the following rule: The left-most component (up to the period) is a CN=. The right most component is an O=. Everything in between is OU=. ### Importing NDS groups If you import a user group, WebMarshal will fetch the members of that group. If you import an organizational unit (OU) or context (O) then WebMarshal will perform a directory search of all user accounts located in the tree under that object. ## NDS authentication in the browser Microsoft does not include any native support for transparent NDS authentication. Therefore, some user effort or additional configuration is required to authenticate using NDS. ### Manual authentication By default, NDS users are prompted for a user name and password every time they open their browser (Basic Authentication). The pain of this can be eased in two ways. * User names can be typed in shortened format. See [NDS name conventions](#nds-name-conventions). * Most web browser software provides a way to remember your user name and password so you only have to click **OK**. ### Automatic authentication For Windows users, WebMarshal also includes a small utility called `WMProxyLogon.exe`. If this program is added to the logon script it will run as a system tray icon and periodically inform the proxy server of your NDS logon. While this program is running the user will not be prompted for authentication when beginning to browse. By default the utility uses the current system proxy settings so if proxy settings are not properly configured the logon procedure will not work. To override these settings see *Options* below. #### Usage Typically the `WMProxyLogon.exe` would be included as part of the all user logon script. The program is small enough that it can be run from its location on the WebMarshal server. Double-click the system tray icon to see the current user information and/or exit from the program. #### Options `WMProxyLogon.exe` has the following command line options: * `/?` shows help information * `/Proxy::` overrides the system settings and forces `WMProxyLogon.exe` to communicate with the stated proxy server. Note that the browser must still be configured correctly to use the proxy server. * `/NoIcon` disables display of the system tray icon.