Help center support eXpress

We've collected answers to popular questions to make eXpress easy and convenient to use. Didn't find the answer to your question? Contact our support team.

Registration Settings
Updated 2 Nov 2026

Registration Settings

CTS
eCTS

Click Save to apply changes.

CTS-Only Registration

Parameter Description
Allow registration without phone number Global server parameter. Determines whether a user can log in without a phone number: via corporate email or corporate server address.

Allows signing in via corporate email, corporate server address, and “Single sign-on” (Kerberos).
Display warning on impending ban on registration without number If enabled, client app users will receive a notification that registration without a phone number will soon be unavailable: Add a phone number. The administrator has prohibited login without a telephone number. Add a telephone number to continue using the app.
⚠️ If you plan to prohibit logging in without a phone number, enable the warning: this way users will have time to add phone numbers and avoid login errors. If you don't plan to, clear this checkbox.
In builds of the branded ETS app, some login method buttons may be disabled.
Allow skipping two-factor authentication within the contour If enabled, users with a phone number can skip SMS code verification when connecting from within the Corporate Data Transfer Network (CDTN) contour. This applies to those who previously logged in without a phone number, but whose phone number was detected.

Applies only inside the network. Outside the network an SMS is always required; if the checkbox is off, an SMS is required inside the network as well.
Display warning asking to add number to log in from beyond loop If the option is enabled, users of client applications will receive a notification that sign-in to the app from outside the secure corporate network without a phone number will soon become unavailable.

User Contact Management

For information on how a user can manage the phone number linked to their account, see this article.
Parameter Description
Allow to add phone number Server users can link a mobile phone number to their account to authenticate with it and to be found by phone number in contacts.
Allow to edit phone number Server users can modify their linked phone number.
Allow to delete phone number Server users can remove their linked phone number.

Corporate Data Visibility in Unauthorized Zone

Parameter Description
Show the corporate server address on the login screen When the check box is selected, the user sees the corporate server address on the sign-in screens. When cleared, the address is hidden on the sign-in screens via OpenID, by email, and by AD credentials. Instead of the address, the app shows the name from the server properties on
RTS
/
ETS
, or “Corporate server” if there is no name. By default, the check box is selected. Works starting with server version 3.47 and app versions Android 3.49, iOS 3.48, web and desktop 3.57.
Prefill the credentials found by email Populate the login and domain fields if a match was found via simplified authentication mapping.

Registration Methods

Select the registration and authentication method for the corporate server: E-mail, NTLM (Active Directory), or OpenID. Only one method can be selected.

Method Description Availability
E-mail

Authentication is performed using a code sent to the linked email.

If not all users have accounts in LDAP, enable E-mail authentication. This allows some corporate accounts to be created on the server via LDAP synchronization, while others are added manually in the admin panel. All users will authenticate using the email code.

 Authentication via email code is available for accounts added from AD as well as those created manually in the admin panel.
NTLM

Authentication is performed using AD login and password. User data is synchronized with AD. Synchronization runs on long and short cycles.

Full synchronization runs every 3 hours and on the schedule specified in the Full synchronization schedule (cron format) field. It adds new users, updates the address book based on changes in AD, and disables users excluded from the synchronization filter.

Short synchronization runs every 10 minutes. It checks the status of the AD account: disabled account, lockout, expired password and expired account, password change.

To start synchronization manually, click Sync.

 Authentication via AD login and password is only available for accounts added from AD if NTLM is selected.
OpenID OpenID authentication. For example, users without an AD account or corporate email can log in using a special token.

Accounts added from OpenID can log in via OpenID, as well as accounts added from AD if the username and domain from OpenID match the account's AD login and domain.

After logging in via OpenID, the account source changes to OpenID.

How to Check the Current Authentication Method?

The current corporate server authentication method can be checked in the admin panel or by following the link in a browser: https://the_server_FQDN/api/v2/ad_integration/register_methods. The response will indicate: "register_methods":["current_authentication_type"]}.

Can Users Be Synced from AD and Authenticated via OpenID?

Yes. Select the OpenID registration method and AD as the sync source. Synchronization with AD creates and updates accounts, and users log in via OpenID.

Requirements:

  • The OpenID provider passes a username equal to the AD login, and the domain. If the domain is not passed, login of an account added from AD fails, and a new user who logs in gets a second account on the server.
  • On login, the profile is filled with data from OpenID. Attributes missing in OpenID are restored from AD at the next synchronization.

Agree on this setup for the production environment with the architects in the deployment project.

How to Switch from AD to OpenID Without Losing Messages?

The server finds an existing account by login and domain. If the username and domain from OpenID match the AD login and domain, the user logs in to the same account: the HUID and messages are kept, and the source changes to OpenID. Otherwise, the server creates a new empty account.

To switch without losses:

  • Check the mapping: the username in OpenID equals the AD login, and the domain is passed.
  • Switch the registration method and log in with one test user. The HUID in the user's profile in the admin panel must stay the same.
  • Turn off automatic logout confirmation for the time of the switch. Reject the logout requests that appear. An account without a phone number loses its messages after a confirmed logout.

How Do I Connect Multiple Active Directory Domains?

CTS
ETS
eCTS

The connection method depends on how the directory is structured in your organization.

How the domains are structured How to connect
Root domain with subdomains Configure corporate server synchronization with the root domain directory — subdomains will be included in the selection along with it. Authentication type — NTLM.
Several separate domains, even connected by trust relationships Through an intermediate directory. The organization deploys an AD LDS collector domain. It collects users of connected domains into a single database, and synchronization is performed from it. Authentication type — Email. The collector only collects user information and does not manage them, so sign-in with domain credentials is unavailable.

Via Keycloak. The organization connects its domains to Keycloak in a federation. Authentication type — OpenID. The login scenario is configured on the Keycloak side and can be of any complexity. The app displays the forms of this scenario.
The connection scheme is chosen during the implementation phase together with an eXpress specialist: it affects both the user sign-in method and how terminated employees are deactivated.

Synchronization Settings

Parameter Description
Synchronization sources Corporate system from which user accounts are synchronized: NTLM (Active Directory) or OpenID. The None option disables synchronization.
Full synchronization schedule Configure the synchronization time in Cron format.
The minimum interval is 1 hour (0 * * * *). This schedule supplements the standard one, according to which synchronization occurs every 3 hours.
Sync This button forces synchronization of users with the connected corporate system.
⚠️ Synchronization with OpenID does not create user accounts. The account appears when the user authenticates on
CTS
/
eCTS
.

Related questions