Watchguard Firebox X20E, User Manual

Page: 176 / 310

Using LDAP/Active Directory Authentication
164 Firebox X Edge e-Series
directory.
The
Group Attribute Name is the name of the group membership attribute of user entries in the
LDAP directory.
11
Click Submit .
Using the LDAP authentication test feature
After the Firebox X Edge e-Series is configured to use LDAP authentication, you can use the LDAP
authentication test feature to make sure the Edge can connect to the LDAP server. You can use the test
for a specified user account to make sure that the Edge can successfully send and receive authentica-
tion requests for that user.
To use the test feature, click LDAP Authentication Test and type the name and password of an LDAP
user account. The user name must be typed in the domain\user name format, such as mycom-
pany\admin.
The results of the authentication attempt are shown on the screen. If the authentication is successful,
the User Permissions section shows the access rights for this user account.
Configuring groups for LDAP authentication
Account privileges for users that authenticate to an LDAP server are set based on group membership.
The group that the user is in sets all privileges for that user except MUVPN. MUVPN privileges must be
set at the user level.
The name you give to a group on the Firebox X Edge must match the name of the group assigned to
user entries in the LDAP directory. On the Edge, there is a built-in default group. The settings of the
default group apply to any LDAP user that does not belong to any group configured on the Edge. You
can change the properties of the default group, but you cannot delete the default group.
If a user belongs to more than one group, the privileges for that user are set to the least restrictive set-
tings of all groups to which the user belongs. In WebBlocker, the least restrictive profile is the profile
with the lowest number of blocked categories. For a more general example, a group “admins” allows
administrative access, but the group “powerusers” gives read-only access, and the group “everyone”
gives no administrative access. A user that belongs to all three groups gets administrative access
because it is the least restrictive setting of the three.
Adding a group
1
To connect to the System Status page, type https:// in the browser address bar, and the IP
address of the Firebox X Edge trusted interface.
The default URL is: https://192.168.111.1
2
From the navigation bar, select Firebox Users > New Group .
The Firebox Users New Group page appears.