Configuring Group End Point Control

To configure the End Point Control profiles used by local groups

1. Navigate to either the Users > Local Users or Users > Local Groups page.
2. Click the Configure icon next to the group to be configured for EPC. The Edit Local Group window is displayed.
3. Click the EPC page. The EPC window is displayed.
4. Configure EPC group settings and add or remove device profiles, Group Configuration for LDAP Authentication Domains.

Lightweight Directory Access Protocol (LDAP) is a standard for querying and updating a directory. Because LDAP supports a multilevel hierarchy (for example, groups or organizational units), the SMA appliance can query this information and provide specific group policies or bookmarks based on LDAP attributes. By configuring LDAP attributes, the SMA appliance administrator can leverage the groups that have already been configured in an LDAP or Active Directory database, rather than needing to manually recreate the same groups in the SMA appliance.

After an LDAP authentication domain is created, a default LDAP group is created with the same name as the LDAP domain name. Although additional groups can be added or deleted from this domain, the default LDAP group cannot be deleted. If the user for which you created LDAP attributes enters the Virtual Office home page, the bookmark you created for the group the user is in displays in the Bookmarks Table.

For an LDAP group, you can define LDAP attributes. For example, you can specify that users in an LDAP group must be members of a certain group or organizational unit defined on the LDAP server. Or you can specify a unique LDAP distinguished name.

To add an LDAP attribute for a group so that a user has a bookmark assigned when entering the Virtual Office environment, complete the following steps

1. Navigate to the Portals > Domains page and click Add Domain to display the Add New Domain window.

2. Select LDAP from the Authentication Type menu. The LDAP domain configuration fields are displayed.

   

3. Enter a descriptive name for the authentication domain in the Domain Name field. This is the domain name users select to log in to the Secure Mobile Access user portal. It can be the same value as the Server address field.
4. Enter the IP address or domain name of the server in the Server address field.
5. Enter the search base for LDAP queries in the LDAP baseDN field. An example of a search base string is CN=Users,DC=yourdomain,DC=com.
6. Enter a Server address that has been delegated control of the container that server is in.
7. Enter the username along with the corresponding password in the Login username and Login password fields.
8. Enter a Backup Server address.
9. Enter the backup username along with the corresponding backup password in the Login username and Login password fields.
10. Select the name of the portal in the Portal name field. Additional layouts can be defined in the Portals > Portals page.
11. Select Allow password changes (if allowed by LDAP server) if you want to be able to change user’s passwords. The admin account must be used when changing user passwords.
12. Optionally select Use SSL/TLS. This option allows for the needed SSL/TLS encryption to be used for Active Directory password exchanges. This check box should be enabled when setting up a domain using Active Directory authentication.

13. Optionally select Enable client certificate enforcement to require the use of client certificates for login. By checking this box, you require the client to present a client certificate for strong mutual authentication. Two additional fields appear:

    • Verify username matches Common Name (CN) of client certificate – Select this check box to require that the user’s account name match their client certificate.
    • Verify partial DN in subject – Use the following variables to configure a partial DN that matches the client certificate:
      • Username: %USERNAME%
      • Domain name: %USERDOMAIN%
      • Active Directory username: %ADUSERNAME%
      • Wildcard: %WILDCARD%
14. Select Delete external user accounts on logout to delete users who are not logged into a domain account after they log out.
15. Select Only allow users listed locally to allow only users with a local record in the Active Directory to login.

16. Select Auto-assign groups at login to assign users to a group when they log in.

    Users logging into Active Directory domains are automatically assigned in real time to Secure Mobile Access groups based on their external AD group memberships. If a user’s external group membership has changed, their Secure Mobile Access group membership automatically changes to match the external group membership.

17. Optionally, select One-time passwords to enable the One Time Password feature. A drop-down menu appears, in which you can select if configured, required for all users, or using domain name. These are defined as:

    • if configured – Only users who have a One Time Password email address configured uses the One Time Password feature.
    • required for all users – All users must use the One Time Password feature. Users who do not have a One Time Password email address configured are not allowed to login.
    • using domain name – Users in the domain uses the One Time Password feature. One Time Password emails for all users in the domain are sent to username@domain.com.

18. If you selected if configured or required for all users in the One-time passwords drop-down menu, the Active Directory AD e-mail attribute drop-down menu appears, in which you can select mail, mobile, pager, userPrincipalName, or custom. These are defined as:

    • mail – If your AD server is configured to store email addresses using the “mail” attribute, select mail.
    • mobile or pager – If your AD server is configured to store mobile or pager numbers using either of these attributes, select mobile or pager, respectively. Raw numbers cannot be used, however, SMS addresses can.
    • userPrincipalName – If your AD server is configured to store email addresses using the “userPrincipalName” attribute, select userPrincipalName.
    • custom – If your AD server is configured to store email addresses using a custom attribute, select custom. If the specified attribute cannot be found for a user, the email address assigned in the individual user policy settings is used. If you select custom, the Custom attribute field appears. Type the custom attribute that your AD server uses to store email addresses. If the specified attribute cannot be found for a user, the email address is taken from their individual policy settings.

    If you select using domain name, an E-mail domain field appears following the drop-down menu. Type in the domain name where one-time password emails are sent (for example, abc.com).

19. Select the type of user from the User Type drop-down menu. All users logging in through this domain are treated as this user type. The choices depend on user types defined already. Some possible choices are:

    • External User – Users logging into this domain are treated as normal users without administrative privileges.

    • External Administrator – Users logging into this domain are treated as administrators, with local Secure Mobile Access admin credentials. These users are presented with the admin login page.

      This option allows the Secure Mobile Access administrator to configure a domain that allows Secure Mobile Access admin privileges to all users logging into that domain.

      SonicWall Inc. recommends adding filters that allow administrative access only to those users who are in the correct group. You can do so by editing the domain on the Users > Local Groups page.

    • Read-only Administrator – Users logging into this domain are treated as read-only administrators and can view all information and settings but cannot apply any changes to the configuration. These users are presented with the admin login page.
20. Click Accept to update the configuration. After the domain has been added, the domain is added to the table on the Portals > Domains page.
21. Navigate to the Users > Local Groups page and click the Configure icon. The Edit Group Settings page is displayed, with fields for LDAP attributes on the General page.

22. On the General page, you can optionally fill out one or multiple LDAP Attribute fields with the appropriate names where name=value is the convention for adding a series of LDAP attributes. To see a full list of LDAP attributes, refer to the SonicWall Inc. LDAP Attribute document.

    As a common example, fill out an attribute field with the memberOf= attribute which can bundle the following common variable types:

    CN= - the common name. DN= - the distinguished name. DC= - the domain component.

    You need to provide quote delimiters around the variables you bundle in the memberOf line. You separate the variables by commas. An example of the syntax using the CN and DC variables would be:

    memberOf="CN=<string>, DC=<string>"

    An example of a line you might enter into the LDAP Attribute field, using the CN and DC variables would be:

    memberOf="CN=Terminal Server Computers,CN=Users,DC=sonicwall,DC=net"

23. Type an inactivity timeout value (in minutes) in the Inactivity Timeout field. Enter 0 (zero) to use the global inactivity timeout setting.

24. Under Single Sign-On Settings, in the Automatically log into bookmarks list, select one of the following:

    • Use global policy – Use the global policy for using SSO to log in to bookmarks.
    • User-controlled (enabled by default for new users) – Enable SSO to log in to bookmarks for new users and allow users to change this setting.
    • User-controlled (disabled by default for new users) – Disable SSO to log in to bookmarks for new users and allow users to change this setting.
    • Enabled – Enable SSO to log in to bookmarks
    • Disabled – Disable SSO to log in to bookmarks
25. Click Accept when done.