ExtraHop 8.8 ExtraHop Trace Admin UI Guide
31
Sessions
The ExtraHop system provides controls to view and delete user connections to the web interface. The
Sessions list is sorted by expiration date, which corresponds to the date the sessions were established. If a
session expires or is deleted, the user must log in again to access the web interface.
Remote Authentication
The ExtraHop system supports remote authentication for user access. Remote authentication enables
organizations that have authentication systems such as LDAP (OpenLDAP or Active Directory, for example)
to enable all or a subset of their users to log in to the system with their existing credentials.
Centralized authentication provides the following benefits:
•
User password synchronization.
•
Automatic creation of ExtraHop accounts for users without administrator intervention.
•
Management of ExtraHop privileges based on user groups.
•
Administrators can grant access to all known users or restrict access by applying LDAP filters.
Next steps
•
Configure remote authentication through LDAP
•
Configure remote authentication through SAML
•
Configure remote authentication through
•
Configure remote authentication through RADIUS
Configure remote authentication through LDAP
The ExtraHop system supports the Lightweight Directory Access Protocol (LDAP) for authentication
and authorization. Instead of storing user credentials locally, you can configure your ExtraHop system to
authenticate users remotely with an existing LDAP server. Note that ExtraHop LDAP authentication only
queries for user accounts; it does not query for any other entities that might be in the LDAP directory.
Before you begin
•
This procedure requires familiarity with configuring LDAP.
•
Ensure that each user is in a permission-specific group on the LDAP server before beginning this
procedure.
•
If you want to configure nested LDAP groups, you must modify the Running Configuration file. Contact
When a user attempts to log onto an ExtraHop system, the ExtraHop system tries to authenticate the user
in the following ways:
•
Attempts to authenticate the user locally.
•
Attempts to authenticate the user through the LDAP server if the user does not exist locally and if the
ExtraHop system is configured for remote authentication with LDAP.
•
Logs the user onto the ExtraHop system if the user exists and the password is validated either locally
or through LDAP. The LDAP password is not stored locally on the ExtraHop system. Note that you
must enter the username and password in the format that your LDAP server is configured for. The
ExtraHop system only forwards the information to the LDAP server.
•
If the user does not exist or an incorrect password is entered, an error message appears on the login
page.
Important:
If you change LDAP authentication at a later time to a different remote authentication
method, the users, user groups, and associated customizations that were created
through remote authentication are removed. Local users are unaffected.
Содержание Trace Admin UI
Страница 1: ...ExtraHop 8 8 ExtraHop Trace Admin UI Guide...
