Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 442 / 1016

Configuring Authentication for User Types
In the Identity tab, configure the user types that the authentication server supports:
•
Admin Users
•
Firewall Auth Users
• XAuth Users
• 802.1X Users
•
L2TP Users
For RADIUS servers, you can also configure the optional domain name checking and
domain name stripping settings, as detailed in the following sections.
Domain Name Checking
Use domain name checking to authenticate users from a specific domain. This setting
is optional and is not required to configure a RADIUS authentication server.
To configure, for Domain to Check In Username, enter the domain name (up to 45
characters). For each user authenticating to the server, the server compares the domain
name in the username to specified domain (the domain is read as a string from right to
left to the first @ character).
To authenticate usernames from all domains, leave this option unconfigured (blank).
Domain Name Stripping
Use domain name stripping to remove the domain name from usernames before sending
to the authentication server. This setting is optional and is not required to configure a
RADIUS authentication server. However, you might need to configure this setting when
implementing a new RADIUS server with an existing network and established usernames.
To configure:
• For Separator Character, enter the separator character used in the usernames.
•
For Separator Character Occurrence, enter the number of times (0 to 10) the separator
character occurs in the username.
When a user attempts to authenticate, the device examines the username from right to
left, then strips domain name information for the specified number of separator characters
before sending the username onto the authentication server.
For example, when the Separator Character is @ and the Separator Character Occurrence
is 2, the device handles the username user1@mygrp.abc@myco.com by stripping the
characters @mygrp.abc@myco.com and sending only the characters user1 to the
authentication server.
If the device does not locate the separator character in the username, it does not strip
the domain name from the username (usernames are passed to the authentication server
as-is). Conversely, if the number of specified separator characters exceeds the number
Copyright © 2010, Juniper Networks, Inc. 392
Network and Security Manager Administration Guide