Has anyone successfully passed off user/group management via directory services (specifically?AD) to HR?
For instance, right now when a freelancer comes in HR creates a ticket that goes to IT that has employee name, position, and group permissions, and we add the user in AD manually.
We use a very simple grouping setup, of staff (local admin, global read), freelance (access only to assigned project folders) accounting, and engineering.?
The question is, why am I managing this? Why can't this be done via an HR web interface, that allows them limited access for creating new users and assigning them a group??Obviously?access would have to be limited so they can't go around creating domain admins everywhere, but it doesn't seem like this is a weird request, after all they handle hiring, payroll and accounting issues, is user security really more important than the company finances?
I've googled for "active directory web interface" but frankly they all look sketchy or like they were developed in the 90s and never touched again. Obviously I'd prefer something open source, and packaged so I don't have to develop it myself.
Any suggestions, or glaring problems with this theory are welcome?
