SonicOS 8 Users

Download PDF
Technical Documentation > SonicOS 8 Users > Configuring User Settings > Setting the Single-Sign-On Methods > Configuring SSO > Enforcement

Enforcement

The settings in the Enforcement tab are if you want to either trigger SSO on traffic from a particular zone, or bypass SSO for traffic from non-user devices such as internal proxy web servers or IP phones.

  1. Navigate to the Device > Users > Settings > Authentication page.
  2. Next to Configure SSO, click Configure.

    The SSO Configuration page is displayed.

  3. Under Enforcement tab, select the following:

    1. Under Per-Zone SSO Enforcement, select for any zones on which you want to trigger SSO to identify users when traffic is sent.

      • DMZ

      • LAN

      • MGMT

      • VPN

    2. Click Save.

      These per-zone SSO enforcement settings are useful for identifying and tracking users in event logging and AppFlow Monitor visualizations, even when SSO is not otherwise triggered by content filtering, IPS, or Application Control policies, or by firewall access rules requiring user authentication.

  4. To bypass SSO for traffic from certain services or locations and apply the default content filtering policy to the traffic, select the appropriate service or location from the list in the SSO Bypass table or add a new service or location to the table. The table displays the built-in services that bypass SSO; these services cannot be delete.

    1. Click the Add Bypass button.

      The Add an SSO bypass rule dialog displays.

    2. For Bypass SSO for, select either the Services or Addresses.

    3. Select a service or address from the drop-down menu.

    4. Select the Bypass type:

      • Full bypass (don’t trigger SSO)

      • Trigger SSO but bypass holding packets while waiting for it

    5. Click Save.

  5. Enable SSO bypass user name for logging. This is enabled by default.

    1. To select a SSO bypass user name for logging, select the Log user name <bypass name> for SSO bypasses and specify a name for the SSO bypassed user.

    2. Optionally, select Create a dummy user. If this setting is enabled, on receiving SSO bypass traffic, a dummy user entry is created with the given user name for the originating IP address.

    3. Optionally, specify an inactivity timeout, in minutes, in the Inactivity timeout (mins) field. The default is 15 minutes.

  6. Click Save.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden