WatchGuard Technologies SSL VPN manual LDAP authorization group attribute fields

LDAP Authorization

Group memberships from group objects working evaluations

LDAP servers that evaluate group memberships from group objects indirectly work with Firebox SSL VPN Gateway authorization.

Some LDAP servers enable user objects to contain information about groups to which they belong, such as Active Directory or eDirectory. A user’s group membership can be computable attributes from the user object, such as IBM Directory Server or Sun ONE directory server. In some LDAP servers, this attribute can be used to include a user’s dynamic group membership, nesting group membership, and static group membership to locate all group memberships from a single attribute.

For example, in IBM Directory Server, all group memberships, including the static, dynamic, and nested groups, can be returned using the ibm-allGroups attribute. In Sun ONE, all roles, including managed, fil- tered, and nested, are calculated using the nsRole attribute.

Group memberships from group objects non-working evaluations

LDAP servers that evaluate group memberships from group objects indirectly will not work with Firebox SSL VPN Gateway authorization.

Some LDAP servers enable only group objects such as the Lotus Domino LDAP server to contain infor- mation about users. The LDAP server does not enable the user object to contain information about groups. For this type of LDAP server, group membership searches are performed by locating the user on the member list of groups.

LDAP authorization group attribute fields

The following table contains examples of LDAP group attribute fields.

Microsoft Active Directory Server	memberOf
Novell eDirectory	groupMembership
IBM Directory Server	ibm-allGroups
Sun ONE directory (formerly iPlanet)*	nsRole

To configure LDAP authentication

1Click the Authentication tab.

2In Realm Name, type a name for the authentication realm that you will create, select One Source,

and then click Add.

If your site has multiple authentication realms, you might use a name that identifies the LDAP realm for which you will specify settings. Realm names are case-sensitive and can contain spaces.

Note

If you want the Default realm to use LDAP authentication, remove the Default realm as described in “Changing the Authentication Type of the Default Realm” on page 65.

3In Select Authentication Type, choose LDAP Authentication and click OK.

The Realm dialog box opens.

4Click the Authentication tab.

5In Server IP Address, type the IP address of the LDAP server.

6 In Server Port, type the port number.

76 Firebox SSL VPN Gateway