Active Directories And Ldap Configurations - NETGEAR UTM5 Reference Manual

ProSecure Unified Threat Management (UTM) Appliance

Active Directories and LDAP Configurations

Note: For an overview of the authentication options that the UTM supports,
see Authentication Process and Options
The UTM supports security policies that are based on an Active Directory with single sign-on
(SSO) through the use of the DC agent (see
configuration options.
Note: This manual assumes that you already have some knowledge of
Active Directories and LDAP servers.
How an Active Directory Works
Understanding how a typical Active Directory (AD) works might be of help when you are
specifying the settings for the LDAP and Active Directory domains on the UTM.
The following applies to a typical AD:
• Organizational unit (OU), common name (CN), and domain controller (DC) can all be
used to build a search base in the AD. The following applies to the OU and CN
containers:
- An AD administrator can create an OU but cannot create a CN that was built in the AD
server.
- An AD administrator can apply a global policy object (GPO) to an OU but not to a CN.
• An OU is created in the root node (for example, dc=companyname, dc=com) of the
hierarchy. In a company AD, an OU often represents a regional office or department.
• A group is created under cn=users.
• A user is created under each OU so that the user can logically show in a tree of the AD
server.
• A relationship between a group and users is built using their attributes (by default:
member and memberOf). These show in a lookup result.
The following is an example of how to set the search base:
If a company AD server has cn=users and ou=companyname defined and both are
specified under dc=companyname,dc=com, the search base needs to be set as
dc=companyname,dc=com in order for the UTM to search both users and groups.
If the size limit is exceeded so that dc=companyname,dc=com misses some entries during
the lookup process, a user can still be correctly authenticated. However, to prevent the size
limit from being exceeded, an AD administrator needs to set a larger value in the LDAP
server configuration so that the entire list of users and groups is returned in the lookup result.
Managing Users, Authentication, and VPN Certificates
on page 356.
DC Agent on page 387) and additional LDAP
362