Dell SonicWALL Secure Mobile Access 8.5
Administration Guide
409
http://technet.microsoft.com/en-us/library/cc755809(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/cc731033(v=ws.10).aspx
Group Configuration for Active Directory and
RADIUS Domains
For authentication to RADIUS or Active Directory servers (using Kerberos), you can individually define AAA users
and groups. This is not required, but it enables you to create separate policies or bookmarks for individual AAA
users.
When a user logs in, the SMA/SRA appliance validates with the appropriate Active Directory or RADIUS server
that the user is authorized to login. If the user is authorized, the SMA/SRA appliance checks to see if a user
exists in the SMA/SRA appliance database for users and groups. If the user is defined, then the policies and
bookmarks defined for the user applies.
For example, if you create a RADIUS domain in the SMA/SRA appliance called “Miami RADIUS server,” you can
add users to groups that are members of the “Miami RADIUS server” domain. These user names must match the
names configured in the RADIUS server. Then, when users log in to the portal, policies, bookmarks and other
user settings applies to the users. If the AAA user does not exist in the SMA/SRA appliance, then only the global
settings, policies and bookmarks applies to the user.
This section contains the following subsections:
•
Bookmark Support for External (Non-Local) Users
•
•
Adding an Active Directory Group
Bookmark Support for External (Non-Local) Users
The Virtual Office bookmark system allows bookmarks to be created at both the group and user levels. The
administrator can create both group and user bookmarks which are propagated to applicable users, while
individual users can create only personal bookmarks.
Because bookmarks are stored within the SMA/SRA appliance’s local configuration files, it is necessary for group
and user bookmarks to be correlated to defined group and user entities. When working with local (LocalDomain)
groups and users, this is automated since the administrator must manually define the groups and users on the
appliance. Similarly, when working with external (non-LocalDomain, for example, RADIUS or LDAP) groups, the
correlation is automated since creating an external domain creates a corresponding local group.
However, when working with external (non-LocalDomain) users, a local user entity must exist so that any user-
created (personal) bookmarks can be stored within the Secure Mobile Access configuration files. The need to
store bookmarks on the SMA/SRA appliance itself is because LDAP and RADIUS external domains do not provide a
direct facility to store such information as bookmarks.
Rather than requiring administrators to manually create local users for external domain users to use personal
bookmarks, the SMA/SRA appliance automatically creates a corresponding local user entity upon user login.
Bookmarks can be added to the locally-created user.
For example, if a RADIUS domain called myRADIUS is created, and RADIUS user jdoe logs on to the SMA/SRA
appliance, the moment jdoe adds a personal bookmark, a local user called jdoe is created on the SMA/SRA
appliance as type External, and can then be managed like any other local user by the administrator. The
external local user remains until deleted by the administrator.
