Help center support eXpress

We've collected answers to popular questions to make eXpress easy and convenient to use. Didn't find the answer to your question? Contact our support team.

Registration Settings
Updated 20 Oct 2026

Registration Settings

CTS
eCTS

Click Save to apply changes.

CTS-Only Registration

Parameter Description
Allow registration without phone number Global server parameter. Determines whether a user can log in without a phone number: via corporate email or corporate server address.
Display warning on impending ban on registration without number If enabled, client app users will receive a notification that registration without a phone number will soon be unavailable: Add a phone number. The administrator has prohibited login without a telephone number. Add a telephone number to continue using the app.
⚠️ If you plan to prohibit logging in without a phone number, enable the warning: this way users will have time to add phone numbers and avoid login errors. If you don't plan to, clear this checkbox.
In builds of the branded ETS app, some login method buttons may be disabled.
Allow skipping two-factor authentication within the contour If enabled, users with a phone number can skip SMS code verification when connecting from within the Corporate Data Transfer Network (CDTN) contour. This applies to those who previously logged in without a phone number, but whose phone number was detected.
Display warning asking to add number to log in from beyond loop If the option is enabled, users of client applications will receive a notification that sign-in to the app from outside the secure corporate network without a phone number will soon become unavailable.

User Contact Management

For information on how a user can manage the phone number linked to their account, see this article.
Parameter Description
Allow to add phone number Server users can link a mobile phone number to their account to authenticate with it and to be found by phone number in contacts.
Allow to edit phone number Server users can modify their linked phone number.
Allow to delete phone number Server users can remove their linked phone number.

Corporate Data Visibility in Unauthorized Zone

Parameter Description
Show the corporate server address on the login screen When the check box is selected, the user sees the corporate server address on the sign-in screens. When cleared, the address is hidden on the sign-in screens via OpenID, by email, and by AD credentials. Instead of the address, the app shows the name from the server properties on
RTS
/
ETS
, or “Corporate server” if there is no name. By default, the check box is selected. Works starting with server version 3.47 and app versions Android 3.49, iOS 3.48, web and desktop 3.57.
Prefill the credentials found by email Populate the login and domain fields if a match was found via simplified authentication mapping.

Registration Methods

Select the registration and authentication method for the corporate server: E-mail, NTLM (Active Directory), or OpenID. Only one method can be selected.

Method Description Availability
E-mail

Authentication is performed using a code sent to the linked email.

If not all users have accounts in LDAP, enable E-mail authentication. This allows some corporate accounts to be created on the server via LDAP synchronization, while others are added manually in the admin panel. All users will authenticate using the email code.

 Authentication via email code is available for accounts added from AD as well as those created manually in the admin panel.
NTLM

Authentication is performed using AD login and password. User data is synchronized with AD. Synchronization runs on long and short cycles.

Full synchronization runs every 3 hours and on the schedule specified in the Full synchronization schedule (cron format) field. It adds new users, updates the address book based on changes in AD, and disables users excluded from the synchronization filter.

Short synchronization runs every 10 minutes. It checks the status of the AD account: disabled account, lockout, expired password and expired account, password change.

To start synchronization manually, click Sync.

 Authentication via AD login and password is only available for accounts added from AD if NTLM is selected.
OpenID OpenID authentication. For example, users without an AD account or corporate email can log in using a special token. Authentication via OpenID is only available for accounts added from OpenID if OpenID is selected.

How to Check the Current Authentication Method?

The current corporate server authentication method can be checked in the admin panel or by following the link in a browser: https://the_server_FQDN/api/v2/ad_integration/register_methods. The response will indicate: "register_methods":["current_authentication_type"]}.

Can Users Be Synced from AD and Authenticated via OpenID?

Yes, but this requires system modifications and consultations with architects in the deployment project.

How Do I Connect Multiple Active Directory Domains?

CTS
ETS
eCTS

The connection method depends on how the directory is structured in your organization.

How the domains are structured How to connect
Root domain with subdomains Configure corporate server synchronization with the root domain directory — subdomains will be included in the selection along with it. Authentication type — NTLM.
Several separate domains, even connected by trust relationships Through an intermediate directory. The organization deploys an AD LDS collector domain. It collects users of connected domains into a single database, and synchronization is performed from it. Authentication type — Email. The collector only collects user information and does not manage them, so sign-in with domain credentials is unavailable.

Via Keycloak. The organization connects its domains to Keycloak in a federation. Authentication type — OpenID. The login scenario is configured on the Keycloak side and can be of any complexity. The app displays the forms of this scenario.
The connection scheme is chosen during the implementation phase together with an eXpress specialist: it affects both the user sign-in method and how terminated employees are deactivated.

Synchronization Settings

Parameter Description
Synchronization sources Corporate system from which user accounts are synchronized: NTLM (Active Directory) or OpenID. The None option disables synchronization.
Full synchronization schedule Configure the synchronization time in Cron format.
The minimum interval is 1 hour (0 * * * *). This schedule supplements the standard one, according to which synchronization occurs every 3 hours.
Sync This button forces synchronization of users with the connected corporate system.
⚠️ Synchronization with OpenID does not create user accounts. The account appears when the user authenticates on
CTS
/
eCTS
.

Related questions