Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual, Page: 262 / 861

261 Limiting user access
Authenticating with an external authentication server
Prerequisites
None.
To configure an authentication scheme
1
In the SGMI, in the left pane, under Assets, click Authentication Servers .
2 In the right pane, on the Schemes tab, click New .
3 In the Scheme Properties dialog box, in the Scheme name text box, type a unique name for your
new scheme.
4 To make this authentication scheme the default, check Set as default .
5 To have the security gateway check the authentication cache before prompting a user for his
credentials, check
Reuse HTTP passwords .
6 In the list of authentication server records, in the Authentication column, check the box next to
authentication server type you want to add.
7
Optionally, on the Description tab, type a more detailed description than you typed in the Caption
text box.
8 Click OK .
9 Optionally, do one of the following:
■
To save your configuration now, and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
10 After creating the authentication scheme, you can use it in the following ways:
■
Use it in a rule, to configure authentication.
■
Use it to establish authentication for secure desktop mail access.
■
Use it as the authentication scheme when configuring OOBA authentication.
Related information
For further information related to this topic, see the following:
■
“Scheme Properties—General tab” on page 693
■
“Scheme Properties—Description tab” on page 693
■
“Adding an authentication scheme to a rule” on page 261
■
“Advanced mail actions” on page 446
■
“Configuring the OOBA service” on page 265
Adding an authentication scheme to a rule
When the security gateway considers a rule for a connection attempt, it evaluates each of the
authentication servers defined in order of their assignment in the authentication scheme configured
for that rule. For instance, if a rule specifies a scheme called All_Methods that contains RSA SecurID,
LDAP, and active directory authentication methods defined in that order, the security gateway
attempts to authenticate the connection by first using RSA SecurID, then LDAP, and then finally trying
active directory.
If the authentication scheme has a single authentication server and the user fails the authentication
phase, the connection is dropped. If there is more than one server and the user fails any of the
authentication phases, the connection is dropped. The security gateway only establishes a connection
after all of an authentication scheme’s authentication servers have been satisfied.