LDAP Authorization
76
Firebox SSL VPN Gateway
Group memberships from group objects working evaluations
LDAP servers that evaluate group memberships from group objects indirectly work with Firebox SSL
VPN Gateway authorization.
Some LDAP servers enable user objects to contain information about groups to which they belong, such
as Active Directory or eDirectory. A user’s group membership can be computable attributes from the
user object, such as IBM Directory Server or Sun ONE directory server. In some LDAP servers, this
attribute can be used to include a user’s dynamic group membership, nesting group membership, and
static group membership to locate all group memberships from a single attribute.
For example, in IBM Directory Server, all group memberships, including the static, dynamic, and nested
groups, can be returned using the ibm-allGroups attribute. In Sun ONE, all roles, including managed, fil-
tered, and nested, are calculated using the nsRole attribute.
Group memberships from group objects non-working evaluations
LDAP servers that evaluate group memberships from group objects indirectly will not work with Firebox
SSL VPN Gateway authorization.
Some LDAP servers enable only group objects such as the Lotus Domino LDAP server to contain infor-
mation about users. The LDAP server does not enable the user object to contain information about
groups. For this type of LDAP server, group membership searches are performed by locating the user on
the member list of groups.
LDAP authorization group attribute fields
The following table contains examples of LDAP group attribute fields.
To configure LDAP authentication
1
Click the
Authentication
tab.
2
In
Realm Name
, type a name for the authentication realm that you will create, select
One Source
,
and then click
Add
.
If your site has multiple authentication realms, you might use a name that identifies the LDAP realm for which you
will specify settings. Realm names are case-sensitive and can contain spaces.
Note
If you want the Default realm to use LDAP authentication, remove the Default realm as described in
“Changing the Authentication Type of the Default Realm” on page 65
.
3
In
Select Authentication Type
, choose
LDAP Authentication
and click
OK
.
The Realm dialog box opens.
4
Click the
Authentication
tab.
5
In
Server IP Address
, type the IP address of the LDAP server.
6
In
Server Port
, type the port number.
Microsoft Active Directory Server
memberOf
Novell eDirectory
groupMembership
IBM Directory Server
ibm-allGroups
Sun ONE directory (formerly iPlanet)*
nsRole
Summary of Contents for SSL 1000
Page 1: ...WatchGuard Firebox SSL VPN Gateway Administration Guide Firebox SSL VPN Gateway...
Page 40: ...Using the Firebox SSL VPN Gateway 30 Firebox SSL VPN Gateway...
Page 118: ...Setting the Priority of Groups 108 Firebox SSL VPN Gateway...
Page 146: ...Managing Client Connections 136 Firebox SSL VPN Gateway...
Page 168: ...Generating Trusted Certificates for Multiple Levels 158 Firebox SSL VPN Gateway...
Page 190: ...180 Firebox SSL VPN Gateway...
Page 198: ...188 Firebox SSL VPN Gateway...
