User's Manual

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
5-2 Managing Users, Groups, and Authentication
v1.0, September 2009
• Authenticated users. User who have a computer behind the STM, who log in to the STM
with a user name and password, and who are assigned an access policies that normally differs
from the STM’s default e-mail and Web access policies. Different users or user groups can
have different access policies, so there can be multiple access policies on the STM.
In addition to being authenticated as individual users, users can be authenticated on the STM
according to group membership or IP address:
– Group membership. A group is defined in the STM’s local database, an LDAP database,
or a RADIUS database. If you use a RADIUS database for authentication, a group can also
be defined in a VLAN.
– IP address. A group is defined by its IP address and subnet.
The login window that is presented to this type of users is the User Portal Login screen (see
Figure 5-7 on page 5-10), which requires three items: a user name, a password, and a domain
selection. The domain determines the authentication method that must be used—LDAP,
Active Directory, RADIUS, or the STM’s local database.
Configuring Groups
The use of groups simplifies the application of exception policies that allow different sets of users
to have different Internet access restrictions. Rather than applying the same exception to each user,
it is easier to apply a single exception to the entire group. For information about exception policies,
see “Setting Web Access Exception Rules” on page 4-48.
You can define groups either by name or by IP address and subnet:
• Groups defined by name. These are local groups on the STM to which you can add users
from the STM’s local user database. Local groups are automatically assigned to the STM’s
prosecuredomain default domain.
• Groups defined by IP address and subnet. These are groups that can be on your local
network or on a remote device.
Note: For detailed information about authentication, see “Configuring
Authentication” on page 5-9.
Note: For information about groups that are defined by VLANs, see “Creating and
Deleting VLANs for Use with RADIUS Domains” on page 5-23.