Watchguard Firebox X15, User Manual

Page: 164 / 266

Managing Users and Groups
150 WatchGuard Firebox X Edge
The results of the authentication attempt are shown on the screen.
If the authentication is successful, the User Permissions section
shows the access rights for this user account.
Configuring groups for LDAP authentication
Account privileges for users that authenticate to an LDAP server are
set based on group membership. The group that the user is in sets
all privileges for that user except MUVPN. MUVPN privileges must
be set at the user level.
The name you give to a group on the Firebox X Edge must match
the name of the group assigned to user entries in the LDAP direc-
tory. On the Edge, there is a built-in default group. The settings of
the default group apply to any LDAP user that does not belong to
any group configured on the Edge. You can change the properties
of the default group, but you cannot delete the default group.
If a user belongs to more than one group, the privileges for that user
are set to the least restrictive settings of all groups to which the user
belongs. In WebBlocker, the least restrictive profile is the profile with
the lowest number of blocked categories. For a more general exam-
ple, a group “admins” allows administrative access, but the the
group “powerusers” gives read-only access, and the group “every-
one” gives no administrative access. A user that belongs to all three
groups gets administrative access because it is the least restrictive
setting of the three.
Adding a group
1
To connect to the System Status page, type
https://
in the
browser address bar, and the IP address of the Edge trusted
interface.
The default URL is: https://192.168.111.1.
2
From the navigation bar, select Firebox Users > New Group .