User's Manual

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
5-12 Managing Users, Groups, and Authentication
v1.0, September 2009
RADIUS support two types of protocols:
– PAP. Password Authentication Protocol (PAP) is a simple protocol in which the client
sends a password in clear text.
– CHAP. Challenge Handshake Authentication Protocol (CHAP) executes a three-way
handshake in which the client and server trade challenge messages, each responding
with a hash of the other’s challenge message that is calculated using a shared secret
value.
When logging in through the User Portal Login screen, users must provide their name and
password, and select the domain that corresponds to the authentication method that has been
assigned to them.
Understanding Active Directories and LDAP Configurations
This manual assumes that you already have a knowledge of Active Directories and LDAP servers.
The following sections are meant to provide some additional information before you go to
“Creating and Deleting LDAP and Active Directory Domains” on page 5-16.
How an Active Directory Works
Understanding how a typical Active Directory (AD) works might be of help when specifying the
settings for the LDAP and Active Directory domains on the STM.
The following applies to a typical AD:
• Organizational unit (ou), common name (cn), and domain controller (dc) can all be used to
build a search base in the AD. The following applies to the ‘ou’ and ‘cn’ containers:
– An AD administrator can create an ou but cannot create a cn that was built in the AD
server.
– An AD administrator can apply a global policy objects (gpo) to an ou, but not to a cn.
• An ou is created in the root node (for example, dc=companyname, dc=com) of the hierarchy.
In a company AD, an ou often represents a regional office or department.
• A groups is created under cn=users.
• A users is created under each ou so that the user can logically show in a tree of the AD server.
• A relationship between a group and users is built using their attributes (by default: member
and memberOf). These show in a lookup result.
The following is an example of how to set the search base:
If in a company AD server “cn=users” and “ou=companyname” and both are specified under
“dc=companyname,dc=com”, the search base must be set as “dc=companyname,dc=com” in order
to search both users and groups.