Access Control Authentication Space Wizard

Ops Center Protector User Guide
Version
7.7.x
Audience
anonymous
Part Number
MK-99PRT002-08
ft:lastEdition
2023-10-26

This wizard is launched when a new Authentication Space is added to the Authentication Spaces Inventory.

Figure. Authentication Space Wizard - Specify name and description
Control Description
Name Enter a name for the Authentication Space.
Description Optional. Enter a short description of the Authentication Space.
Cancel Discards all changes and reverts to the previous page.
Previous Takes the user to the previous screen in the wizard.
Save Commits the new settings. Pages currently open in other tabs and windows will need to be reloaded before the changes are seen by the user.
Figure. Authentication Space Wizard - Active Directory
Control Description
Proxy Type or select a Protector node that has a connection to the required Active Directory Service.
Note: The AD Proxy must be a Windows node.
Tip: To avoid the proxy becoming a single point of failure for authentication, select a clustered node where possible.
Active Directory Domain Name Enter the AD domain name, e.g. Contoso.com
Cancel Discards all changes and reverts to the previous page.
Previous Takes the user to the previous screen in the wizard.
Save Commits the new settings. Pages currently open in other tabs and windows will need to be reloaded before the changes are seen by the user.
Figure. Authentication Space Wizard - OS Accounts
Control Description
Authentication Node Type or select a Protector node that will provide local authentication using the OS's authentication service.
Cancel Discards all changes and reverts to the previous page.
Previous Takes the user to the previous screen in the wizard.
Save Commits the new settings. Pages currently open in other tabs and windows will need to be reloaded before the changes are seen by the user.
Figure. Authentication Space Wizard - RADIUS
Control Description
Proxy Type or select a Protector node that has a connection to the required RADIUS server.
Host Name / IP Address Specify the IP address or DNS resolvable name of the required RADIUS server.
Port Specify the IP port number or use the default port number (1812).
Secret Key Specify the Secret Key for the RADIUS server.
Timeout Specify the timeout period in seconds.
Retry Count Specify the number of times a retry should be performed.
Cancel Discards all changes and reverts to the previous page.
Previous Takes the user to the previous screen in the wizard.
Save Commits the new settings. Pages currently open in other tabs and windows will need to be reloaded before the changes are seen by the user.
Figure. Authentication Space Wizard - LDAP
Control Description
Proxy Type or select a Protector node that has a connection to the required LDAP server.
Note:
  • The LDAP Proxy must be a Linux node.
  • An LDAP Authentication Space cannot be used to authenticate via Microsoft Active Directory, despite similarities between the two technologies.
Server URI Enter the URI of the required LDAP server in the format ldap://domain or ldaps://domain
Server Port Enter the LDAP server port number if different from the default value. The default is 636 when connecting over SSL, otherwise it is 389.
Base DN Enter the base Distinguished Name from which searches are performed.

The default account distinguished name (DN) with which to perform initial searches. This is in LDAP DN format (e.g. cn=Admin, ou=Users, dc=mydomain, dc=com)

The default account is needed to perform a lookup of a user's DN from their UID. Users log into Protector with a UID (e.g. bmortimer@mydomain.com) but the user's DN is needed for the LDAP bind and it is found using this account.

If this value is not supplied the LDAP server must support anonymous bind.
Bind Using Select how to bind to the server:
  • Use anonymous bind
  • Bind using specified account - enter the credentials below
Bind Account DN Enabled only if Bind using specified account is selected. Enter the default account with which to perform searches.
Bind Account Password Enabled only if Bind using specified account is selected. The default account password.

This will be stored in an encrypted form within Protector until needed.

If not set the server must support anonymous bind.
TLS Configuration Click to specify TLS configuration options. See below.
Advanced Configuration Click to specify advanced configuration options. See below.
Cancel Discards all changes and reverts to the previous page.
Previous Takes the user to the previous screen in the wizard.
Save Commits the new settings. Pages currently open in other tabs and windows will need to be reloaded before the changes are seen by the user.
Figure. TLS Configuration
Control Description
TLS Request Certificate Check The TLS configuration in LDAP validates the way the Protector client treats the server certificate:
  • Never - Least Secure. No certificate is requested. The Protector client will allow the use of self-signed certificates from the server.
  • Allow - A certificate is requested. The TLS session completes normally even if a bad certificate or no certificate is provided.
  • Try - A certificate is requested. The TLS session completes normally even if no certificate is provided. However if a bad certificate is provided, TLS session terminates.
  • Demand - Hard Secure. This is the default setting. A certificate is requested. The TLS session terminates if a bad certificate or no certificate is provided. The LDAP server's certificate must be valid and signed by a trusted CA.
TLS CA Certificate Directory Specifies path to the directory containing CA certificate files for the server.
TLS CA Certificate File Specifies the CA certificate file for the server.
Cancel Cancels all changes and reverts to the previous page.
Discard Discards all changes and reverts to the Access Control Authentication Space Wizard
Previous Takes the user to the previous screen in the wizard.
Save Commits the new settings. Pages currently open in other tabs and windows will need to be reloaded before the changes are seen by the user.
Figure. Advanced Configuration
Control Description
Person Filter Enter a search filter in RFC 2254 format to look up users.
Group Filter Enter a search filter in RFC 2254 format to look up groups.
Group Strategy Specifies the group look up strategy of the LDAP server:
  • Groups know users - Each group knows its members, which are found using member attributes.
  • Users know groups - Each user knows its groups.
Group Member attribute Used to look for a group’s users or a user’s groups.
Group Member Type Specifies value type stored in Group Member attribute:
  • Member value contains a DN
  • Member value contains a UID
CN Attribute Name of the attribute holding Common Name (CN).
DN Attribute Name of the attribute holding Distinguished Name (DN).
UID attribute The number of the attribute holding the user ID with the default UID.
Cancel Cancels all changes and reverts to the main page.
Discard Discards all changes and reverts to the Figure 2 page.
Previous Takes the user to the previous screen in the wizard.
Save Commits the new settings. Pages currently open in other tabs and windows will need to be reloaded before the changes are seen by the user.