F5 FirePass, Administrator'S Manual

Page: 52 / 182

Chapter 3
3 - 6
8. To test which FirePass server group a user would be mapped to,
enter a user login name for the Windows domain, and then click the
Test Mapping button.
Note
If necessary, you can delete a mapping by selecting it and then clicking the
Delete link.
Using LDAP-based group mapping
LDAP-based group mapping automatically keeps the groups on the FirePass
server synchronized with the groups on an LDAP server. That is, if a user is
moved to a different group on the LDAP server, FirePass server
automatically moves the user to the new group in its internal database the
next time the user logs into FirePass server. If the user is moved to an LDAP
group that does not exist on the FirePass server, the user remains in the same
FirePass server group.
If you use a signup template for new FirePass server users, group mapping
can also have FirePass server query a LDAP or Windows Domain server for
each user’s group membership, and automatically add the new user to the
mapped group in FirePass server’s internal database. (For more information
on LDAP configuration, see Setting up LDAP server authentication, on page
3-27.)
There are two methods you can use to map LDAP groups:
• Based on LDAP user object information such as DN or any attribute.
(See Mapping based on LDAP user object information, following.)
• Based on a LDAP group object information. (See Using Windows
domain-based group mapping, on page 3-4.)
Note
See your LDAP administrator for more specific information about your
site’s LDAP configuration.
Mapping based on LDAP user object information
To map based on LDAP user object information
1. In the LDAP and Windows Domain Based Grouping section of the
Group Management panel, select the Use LDAP User Object to
Map Group option.
A new set of options appears.
2. In the LDAP Server box, enter the name of an LDAP server.
3. In the LDAP Port box, enter an LDAP port, such as 389.