Group Memberships From Group Objects Working Evaluations; Group Memberships From Group Objects Non-Working Evaluations; Ldap Authorization Group Attribute Fields; To Configure Ldap Authentication - Watchguard SSL 1000 User Manual

LDAP Authorization

Group memberships from group objects working evaluations

LDAP servers that evaluate group memberships from group objects indirectly work with Firebox SSL
VPN Gateway authorization.
Some LDAP servers enable user objects to contain information about groups to which they belong, such
as Active Directory or eDirectory. A user's group membership can be computable attributes from the
user object, such as IBM Directory Server or Sun ONE directory server. In some LDAP servers, this
attribute can be used to include a user's dynamic group membership, nesting group membership, and
static group membership to locate all group memberships from a single attribute.
For example, in IBM Directory Server, all group memberships, including the static, dynamic, and nested
groups, can be returned using the ibm-allGroups attribute. In Sun ONE, all roles, including managed, fil-
tered, and nested, are calculated using the nsRole attribute.

Group memberships from group objects non-working evaluations

LDAP servers that evaluate group memberships from group objects indirectly will not work with Firebox
SSL VPN Gateway authorization.
Some LDAP servers enable only group objects such as the Lotus Domino LDAP server to contain infor-
mation about users. The LDAP server does not enable the user object to contain information about
groups. For this type of LDAP server, group membership searches are performed by locating the user on
the member list of groups.

LDAP authorization group attribute fields

The following table contains examples of LDAP group attribute fields.
Microsoft Active Directory Server
Novell eDirectory
IBM Directory Server
Sun ONE directory (formerly iPlanet)*

To configure LDAP authentication

1 Click the Authentication tab.
2 In Realm Name, type a name for the authentication realm that you will create, select One Source,
and then click Add.
If your site has multiple authentication realms, you might use a name that identifies the LDAP realm for which you
will specify settings. Realm names are case-sensitive and can contain spaces.
If you want the Default realm to use LDAP authentication, remove the Default realm as described in
"Changing the Authentication Type of the Default Realm" on page 65.
3 In Select Authentication Type, choose LDAP Authentication and click OK.
The Realm dialog box opens.
4 Click the Authentication tab.
5 In Server IP Address, type the IP address of the LDAP server.
6 In Server Port, type the port number.
76
memberOf
groupMembership
ibm-allGroups
nsRole
Note
Firebox SSL VPN Gateway