Novell eDirectory Agent | 8e6 Technologies R3000 specification

CHAPTER 1: INTRODUCTION AUTHENTICATION OPERATIONS

Novell eDirectory Agent

Novell eDirectory Agent provides Single Sign-On (SSO) authentication for an R3000 set up in a Novell eDirectory environment. Using Novell eDirectory Agent, the R3000 is notified by the eDirectory server when an end user logs on or off the network, and adds/removes his/her network IP address, thus setting the end user’s filtering profile accord- ingly.

Environment requirements

Novell eDirectory servers

The following eDirectory versions 8.7 or higher with Master,

Read/Write, Read replicas have been tested:

•eDirectory 8.7 in RedHat Linux 9.0

•eDirectory 8.7 in NetWare 6.5 SP5

NOTE: See 8e6 Authenticator: Environment requirements for Minimum and Recommended system requirements. These requirements also apply to eDirectory 8.7 in RedHat Linux 9.0.

50	8E6 TECHNOLOGIES, R3000 ENTERPRISE FILTER AUTHENTICATION USER GUIDE

Image 62

8e6 Technologies R3000 manual Novell eDirectory Agent, Novell eDirectory servers

Contents

Guide Page R3000 Enterprise Filter Authentication User Guide IiiPage Contents Tier 2 Time-based, Web Authentication Set up the Network for Authentication Environment Requirements 103 Set up NT Domain Groups, Members 109Join the NT Domain 101 Create and Maintain NT Profiles 118 155 Test Authentication Settings 162146 208 174Hours 206 Contact Information 209 Ports for Authentication System Access 218Disable SMB Signing Requirements 220 Ldap Server Customizations 219 Ndex Glossary 247 Introduction About this User Guide How to Use this User Guide Conventions Terminology Introduction HOW to USE this User Guide Introduction HOW to USE this User Guide Introduction HOW to USE this User Guide Introduction HOW to USE this User Guide Global Group Filtering ElementsGroup Types Global Group IP groups NT domain groups Ldap domain groups IP diagram with a sample master IP group and its members IP Groups NT domain diagram, with sample groups and members NT Domain Groups Ldap domain diagram, with sample groups and members Ldap Domain Groups Global Group Authentication filtering profilesFiltering Profile Types IP group Master Group IP Sub-Group Filtering Profile Static Filtering ProfilesMaster IP Group Filtering Profile Individual IP Member Filtering Profile NT/LDAP Group Filtering Profile Active Filtering ProfilesGlobal Filtering Profile NT/LDAP Member Filtering Profile Lock Profile Override Account ProfileTime Profile Filtering Profile Components Custom Categories Library Categories8e6 Supplied Categories Minimum Filtering Level Service PortsRules Filter Settings Filtering Rules Filtering Levels Applied Introduction Filtering Elements Sample filtering hierarchy diagram R3000 Authentication Tiers Authentication OperationsR3000 Authentication Protocols Introduction Authentication Operations Tier 1 Single Sign-On Authentication Net use based authentication process Re-authentication process Authentication methods SMB protocol Ldap protocol Name resolution methods Authentication setup procedures Server setup types Configuring the authentication server Login scripts Enter net use syntax in the login script View login script on the server console Windows 2000 or Windows 2003 Server Block page authentication login scripts \\SERVERNAME\netlogon \\IPaddress\netlogon Ldap server setup rules Tier 2 Time-based, Web Authentication Web-based authentication module diagram Tier 2 implementation in an environment Tier 2 Script Tier 1 and Tier 2 Script Introduction Authentication Operations Tier 3 Session-based, Web Authentication Minimum system requirements 8e6 AuthenticatorEnvironment requirements Workstation requirements Recommended system requirements Work flow in a Windows environment 8e6 Authenticator configuration priority WDDEwCw 8e6 Authenticator configuration syntaxWAABwCw Param Parameter Values Dbg Release Meaning Default Table of parameters Introduction Authentication Operations RV102.108.1.0-102.108.1.2551.1.1.12.2.2.2,102.108.2.0 Novell eDirectory Agent Novell eDirectory servers Novell clients Novell eDirectory setupClient workstations R3000 setup and event logs Authentication Solution Compatibility KEY System section Configuring the R3000 for AuthenticationConfiguration procedures Introduction Authentication Operations If using the router or firewall mode Enter eth0 Ethernet Group section Create unique filtering profiles for individual users Workstation Requirements AdministratorEnvironment Requirements End User Network Requirements Set up the Network for Authentication Specify the operation mode Network Setup SET UP the Network for Authentication LAN Settings window Specify the subnet mask, IP addresses Invisible mode Router or firewall mode Enable authentication, specify criteria Enable/Disable Authentication window Network Setup SET UP the Network for Authentication Net use based authentication Web-based authentication Java applet Tier 3 dialog box Enter network settings for authentication Authentication Settings window NIC Device to Use for Authentication field Authentication SSL Certificate window Create an SSL certificate Create, Download a Self-Signed Certificate Download/View/Delete Certificate tab Create, Upload a Third Party Certificate Create a Third Party Certificate Enter your Email Address 10 Create CSR pop-up window Upload a Third Party Certificate 11 Upload Signed SSL Certificate box Download a Third Party Certificate 12 Download CSR pop-up window View log results 13 View Log File window Network Setup SET UP the Network for Authentication Click View to display results in the Result pop-up window Specify block page settings 15 Block Page Authentication window Block Page Authentication Click Apply to apply your settings Block 16 Block User/Machine frame Optional Links Options Back and Help links Option 19 Re-authentication option Option Common Customization 20 Common Customization window Enable, Disable Features TIP Click Restore Default to revert to the default settings Authentication Form Customization 21 Authentication Form Customization window Network Setup SET UP the Network for Authentication Preview Sample Authentication Request Form 22 Sample Customized Authentication Request Form Network Setup SET UP the Network for Authentication Block Page Customization 23 Block Page Customization window Network Setup SET UP the Network for Authentication Preview Sample Block 24 Sample Customized Block 100 Authentication Settings window Join the NT Domain 102 Create an NT Domain Add an NT domain Refresh the NT branch 104 Domain Settings View or modify NT domain details 106 Default Rule NT Domain Details window, Default Rule tab Delete an NT domain 108 Set up NT Domain Groups, Members Add NT groups, members to the tree 110 Specify a group’s filtering profile priority Set Group Priority window 112 Manually add a user’s name to the tree Manually Add Member box Manually add a group’s name to the tree 114 Upload a file of filtering profiles to the tree Upload User/Group Profile window 10 Upload Member Profile File window 116 117 118 Create and Maintain NT ProfilesAdd an NT group, member to the tree list Click Add Add or maintain an entity’s profile 120 Category Profile Redirect URL 122 Filter Options 14 Group Profile window, Filter Options tab Remove an entity’s profile from the tree 124 Create an Ldap Domain Add the Ldap domain 126 Refresh the Ldap branchView, modify, enter Ldap domain details Ldap Server Type Group Objects 128 Click Next to go to the User tab User Objects 130 Address Info Ldap domain address information populates the Address tab 132 Click Next to go to the Account tab Account Info 134 SSL Settings Domain Details window, SSL tab Upload SSL Certificate for Ldaps 136 Alias List Domain Details window, Alias List tab 138 11 Domain Details window, Default Rule tab 140 Default Rule for Novell eDirectory Configure a backup server 13 Backup Server Configuration, Address Info 142 TIP The entry in this field is case sensitive 15 Backup Server Configuration, SSL Settings 144 Modify a backup server’s configuration Delete a domain 146 Set up Ldap Domain Groups, MembersAdd Ldap groups, users to the tree Perform a basic search Options for search results 148 Apply a filtering rule to a profileUnmark All Delete a rule 17 Set Group Priority window 18 Manually Add Member box 150 19 Manually Add Group box 20 Upload User/Group Profile window 152 21 Upload Member Profile File window 154 Create, Maintain Ldap Profiles Add an Ldap group, member to the tree 156 23 Group Profile window, Category tab 158 24 Group Profile window, Redirect URL tab 25 Group Profile window, Filter Options tab 160 161 Test Authentication Settings 162 163 164 Test Web-based authentication settingsCreate an IP Group, test Create a Sub-Group, workstation Create Sub Group box Set up test with a 32-bit net mask 166 Give workstation a 32-bit net mask Sub Group Members window Block everything for the Sub-Group 168 Use Authentication Request Page for redirect URL Select Authentication Request Form Click Apply Disable filter options 170 Attempt to access Web content Internet Explorer browser Username Password 172 Test net use based authentication settings Activate Authentication on the Network 174 Activate Web-based authentication for an IP Group Create a new IP Group, webauth Set webauth to cover users in range 176 Create an IP Sub-Group 13 Create Sub Group box 14 Sub Group Members window 178 15 Sub Group Profile window, Category tab 16 Sub Group Profile window, Redirect URL tab 180 17 Sub Group Profile window, Filter Options tab Set Global Group to filter unknown traffic 182 19 Global Group Profile window, Port tab Select Default Block Page. b. Click Apply 184 Select filter options to be enabled. b. Click Apply 22 Default Block 186 Activate Web-based authentication for the Global Group Exclude filtering critical equipment 188 Block Web access, logging via Range to DetectRange to Detect Settings 24 Range to Detect Settings window, main window Range to Detect Setup Wizard 190 26 Range to Detect Setup Wizard, Step 27 Range to Detect Setup Wizard, Step 192 28 Range to Detect Setup Wizard, Step 29 Range to Detect Setup Wizard, Step 194 Bypass B and go on to to complete this process Block Web access via IP Sub-Group profile 196 Select Default Block Page, and then click Apply 33 Sub Group Profile window, Filter Options tab 198 Modify the Global Group Profile 34 Global Group Profile window, Category tab 35 Global Group Profile window, Port tab 200 36 Global Group Profile window, Redirect URL tab 37 Global Group Profile window, Filter Options tab 202 Activate NT authentication Modify the 3-try login script 204 205 Domestic United States HoursContact Information International 8e6 Taiwan Office Locations and Phone Numbers8e6 Corporate Headquarters USA 8e6 China Support Procedures 208 User/Group File Format and Rules Username Formats Category command codes Port command codesFilter Mode Values Rule Criteria Category Codes Filter Option codes File Format Rules and Examples 212 NT User List Format and Rules NT Group List Format and Rules 214 When translated, these strings of code mean Ldap User List Format and Rules 216 Ldap Group List Format and Rules CN=Sales, CN=Users, DC=qc, DC=local Rule1 218 Ports for Authentication System AccessType Function Not all users returned in User/Group Browser Ldap Server CustomizationsOpenLDAP Server Scenario SMB Signing Compatibility Disable SMB Signing RequirementsServer Signing Mode Not Defined Enabled Disabled R3000 Auth Disable SMB Signing Requirements in Windows Fig. D-1 Go to Active Directory Users and Computers Fig. D-3 Domain Controllers Properties 222 Fig. D-4 Group Policy Object Editor window Fig. D-7 Group Policy Object Editor window, Local Policies 224 Fig. D-9 Define this policy setting Export an Active Directory SSL Certificate Verify certificate authority has been installedObtain or Export an SSL Certificate 226 Locate Certificates folder Click OK to open the Console window Fig. E-4 Add/Remove Snap-in 228 Fig. E-6 Certificates snap-in dialog box Export the master certificate for the domain 230 This action launches the Certificate Export Wizard Fig. E-12 Export File Format 232 Fig. E-14 Settings Export a Novell SSL Certficate 234 Obtain a Sun ONE SSL Certificate Fig. E-17 Export a Certificate pop-up window Override Pop-up Blockers 236 Add override account to the white list If pop-up blocking is enabledYahoo! Toolbar Pop-up Blocker Fig. F-3 Allow pop-ups from source 238 Fig. F-4 # blocked icon enabled Google Toolbar Pop-up Blocker 240 Temporarily disable pop-up blockingAdwareSafe Pop-up Blocker Mozilla Firefox Pop-up Blocker Fig. F-6 Mozilla Firefox Popup Windows Preferences Use the Internet Options dialog box Set up pop-up blockingWindows XP SP2 Pop-up Blocker 242 Fig. F-8 Toolbar setup Use the IE toolbar Fig. F-9 Pop-up Blocker Settings 244 Set up the Information Bar Use the Information Bar Fig. F-11 Information Bar menu options 246 Glossary 248 249 250 251 252 253 254 Index Numerics 256 257 Https Iana 258 Ldap NAT 260 261 262 SMB/NT 264 265