D-Link NetDefend DFL-210 User Manual page 324

8.2.4. External LDAP Servers
Bind Request Authentication
LDAP server authentication is automatically configured to work using LDAP Bind Request
Authentication. This means that authentication succeeds if successful connection is made to the
LDAP server. Individual clients are not distinguished from one another.
LDAP server referrals should not occur with bind request authentication but if they do, the server
sending the referral will be regarded as not having responded.
LDAP Server Responses
When an LDAP server is queried by NetDefendOS with a user authentication request, the following
are the possible outcomes:
i. The server replies with a positive response and the user is authenticated.
Clients using PPP with CHAP, MS-CHAPv1 or MS-CHAPv2 is a special case and
authentication is actually done by NetDefendOS, as discussed later.
ii. The server replies with a negative response and the user is not authenticated.
iii. The server does not respond within the Timeout period specified for the server. If only one
server is specified then authentication will be considered to have failed. If there are alternate
servers defined for the user authentication rule then these are queried next.
Usernames may need the Domain
With certain LDAP servers, the domain name may need to be combined with the username when the
user is prompted for a username/password combination.
If the domain is mydomain.com then the username for myuser might need to be specified as
myuser@mydomain.com. With some LDAP servers this might be myuser@domain
mydomain.com\myuser or even mydomain\myuser. The format depends entirely on the LDAP
server and what it expects.
Real-time Monitoring Statistics
The following statistics are available for real-time monitoring of LDAP server access for user
authentication:
• Number of authentications per second.
• Total number of authentication requests.
• Total number of successful authentication requests.
• Total number of failed authentication requests.
• Total number of invalid usernames.
• Total number of invalid password.
LDAP Authentication CLI Commands
The CLI objects that correspond to LDAP servers used for authentication are called LDAPDatabase
objects (LDAP servers used for certificate lookup are known as LDAPServer objects in the CLI).
324
Chapter 8. User Authentication