18 Barracuda SSL VPN Administrator’s Guide
conditions applicable to a Policy apply equally to all Accounts and Groups within that Policy.
Accounts and Groups are referred to collectively as Principals. An Account or Group may be included
in more than one Policy.
Each Policy has been attached to the required Resources, granting Policy members access to them.
The ‘Everyone’ Policy is a built-in, already available Policy which has been created to allow an
efficient way to allocate Resources to all users; in this example, email and intranet access. In addition
to this, all members of the ‘Engineering’ Policy have access to specific Engineering system resources.
In the same way, all members of the ‘Sales & Support’ Policy have access to their own specific system
resources.
Also, the Engineering and Sales Managers are members of the ‘Managers’ Policy and this allows
them to access the planning and personal details information which is restricted to management
personnel. The configuration of Resources and Policies is flexible: it is possible for multiple
Resources to be assigned the same Policy and also for multiple Policies to be assigned to a single
Resource.
By default the ‘Everyone’ Policy gives all users certain administrative controls such as the ability to
change their password; this is achieved through the use of Access Rights. Access Rights are attached
to a Policy and specify administration-type privileges. The ‘Managers’ Policy has Resource Access
Rights attached which would allow managers to perform create, edit and delete actions, for example.
This enables managers to perform administrative tasks by making certain Resources available to their
team. In the example, members of the ‘Sales & Support’ and ‘Engineering’ Policies are able to use
the Resources made available to them but have no administrative control.
Organizational Control
The SSL VPN has three internal preconfigured User Databases of type ‘Built-in’. These are Default,
Super User and Global. The main System Administrator is identified as the ‘Super User’ who would
delegate responsibility by creating administrative Accounts and Groups, with the necessary Access
Rights, typically within the ‘Default’ User Database.
In many cases it is likely that a repository of user information exists already, e.g. Active Directory or
LDAP. Within the SSL VPN it is possible to create a User Database to an existing repository and then
use the Accounts and Groups defined within it when creating and assigning Resources and Policies.
Resources and Policies are only accessible to the Accounts and Groups within the same User
Database.
The Global User Database is the exception to this rule; Policies across all User Databases are visible
to Global and so Resources created in Global can have any Policy assigned. This is an efficient way
to make Resources available to all users where a number of User Databases exist; the diagram below
shows how the ‘Everyone’ Policies from two User Databases (AD and LDAP) are used to achieve
t
h
i
s
:
Summary of Contents for SSL VPN
Page 8: ...viii Barracuda SSL VPN Administrator s Guide...
Page 34: ...34 Barracuda SSL VPN Administrator s Guide...
Page 76: ...76 Barracuda SSL VPN Administrator s Guide...
Page 94: ...94 Barracuda SSL VPN Administrator s Guide...
Page 98: ...98 Barracuda SSL VPN Administrator s Guide...
Page 104: ...104 Barracuda SSL VPN Administrator s Guide...
