• SonicOS 8
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• About User Management
  • Using Local Users and Groups for Authentication
    • About User Databases
    • About User Groups
  • Using RADIUS for Authentication
  • Using LDAP/Active Directory/eDirectory Authentication
    • LDAP Terms
    • LDAP Directory Services Supported in SonicOS
    • Integrating LDAP into the SonicOS Network Security Appliance
      • Preparing Your LDAP Server for Integration
      • Configuring the CA on the Active Directory Server
      • Exporting the CA Certificate from the Active Directory Server
      • Importing the CA Certificate into SonicOS
  • Using RADIUS
  • Using TACACS+
  • Using Single Sign-On
    • What is Single Sign-On?
    • Benefits of SonicWall SSO
    • Platforms and Supported Standards
    • How Does Single Sign-On Work?
      • SonicWall SSO Authentication Using the SSO Agent
      • SonicWall SSO Authentication Using the Terminal Services Agent
      • SonicWall SSO Authentication Using Browser NTLM Authentication
    • How Does SSO Agent Work?
      • Logging
    • How Does Terminal Services Agent Work?
      • Multiple TSA Support
      • Encryption of TSA Messages and Use of Session IDs
      • Connections to Local Subnets
      • Non-Domain User Traffic from the Terminal Server
    • How Does Browser NTLM Authentication Work?
      • NTLM Authentication of Domain Users
      • NTLM Authentication of Non-Domain Users
      • Credentials for NTLM Authentication in the Browser
    • How Does RADIUS Accounting for Single-Sign-On Work?
      • RADIUS Accounting Messages
      • SonicWall Compatibility with Third-Party Network Appliances
      • Proxy Forwarding
      • Non-Domain Users
      • IPv6 Considerations
      • RADIUS Accounting Server Port
    • Installing the Single Sign-On Agent and/or Terminal Services Agent
      • Installing the SonicWall SSO Agent
      • Installing the SonicWall Terminal Services Agent
        • Accessing the SonicWall Terminal Services Agent
        • Creating a SonicWall TSA Troubleshooting Report
    • Single Sign-On Advanced Features
      • Viewing SSO Mouseover Statistics
      • Using the Single Sign-On Statistics in the TSR
      • Examining the Agent
      • Remedies
    • Configuring Access Rules
      • Automatically Generated Rules for SonicWall SSO
      • Accommodating Mac and Linux Users
        • Using SSO on Mac and Linux With Samba
        • Using SSO on Mac and Linux Without Samba
      • Allowing ICMP Pings from a Terminal Server
    • Managing SonicOS with HTTP Login from a Terminal Server
    • Viewing and Managing SSO User Sessions
      • Logging Out SSO Users
      • Configuring Additional SSO User Settings
      • Viewing SSO and LDAP Messages with Packet Monitor
      • Capturing SSO Messages
      • Capturing LDAP Over TLS Messages
    • Multiple Administrator Support
      • Preempting Administrators
      • Logging in with Administrator Rights
        • Disabling the User Login Status Popup
      • Configuring Multiple Administrator Support
        • Configuring Additional Administrator User Profiles
        • Configuring Administrators Locally when Using LDAP or RADIUS
        • Verifying Multiple Administrators Support Configuration
        • Viewing Multiple Administrator Related Log Messages
• Configuring Users Status
  • Displaying Unauthenticated Users
  • Displaying the User Count
  • Refreshing the Users List
  • Logging Out Users
    • Logging Out a Single User
    • Logging Out Multiple Users
• Configuring User Settings
  • User Login Settings
    • Setting the Authentication Method for Login
    • Configuring RADIUS Authentication
      • Configuring RADIUS Settings
      • Configuring RADIUS Users Settings
      • Testing RADIUS Settings
    • Configuring LDAP
      • Configuring LDAP Setting
      • Configuring Referrals
      • LDAP User Settings
      • Enabling LDAP Relay
      • Testing LDAP Settings
    • Configuring TACACS+
      • Configuring TACAS+ Settings
      • Configuring TACACS+ User Settings
      • Testing TACACS+ Settings
    • Requiring User Names be Treated as Case-Sensitive
    • Preventing Users From Logging in from More than One Location
    • Forcing Users to Log In Immediately After Changing Their Passwords
    • Displaying User Login Information Since the Last Login
  • Setting the Single-Sign-On Methods
    • Configuring SSO
      • SSO Agents
      • Users
      • Enforcement
      • Terminal Services
      • NTLM
      • RADIUS Accounting
      • 3rd Party API
      • Capture Client
      • Test
  • One-Time Password Settings
  • Configuring the User Web Login Settings
    • Setting the Timeout for the Authentication Page
    • Setting How the Browser is Redirected
    • Managing Redirections to the Login Page
    • Redirecting Unauthenticated Users
    • Authenticating user's multiple IP addresses
  • Adding URLs to Authentication Bypass
  • User Session Settings
    • User Session Settings for SSO-Authenticated Users
    • User Session Settings for Web Login
  • Accounting
    • Configuring RADIUS Accounting
      • Sending RADIUS Accounting Information to Servers
      • Configuring User Accounting
      • Testing RADIUS Accounting
      • Editing RADIUS Servers
      • Deleting RADIUS Servers
    • Configuring TACACS+ Accounting
      • Configuring User Accounting
      • Testing TACACS Accounting
      • Editing TACACS Servers
      • Deleting TACACS Servers
  • [[[Missing Linked File System.LinkedTitle]]]
    • • Post-Login Acceptable Use Policy Example Template
      • Post-Login Acceptable Use Policy Preview Message
• Configuring Local Users and Groups
  • About Authentication and Passwords
    • Using Two-Factor Authentication
    • Enforcing First Login Password Change
  • Configuring Local Users
    • Quota Control for all Users
    • Viewing Local Users
    • Adding Local Users
      • Configuring Local Users Settings
      • Configuring Local Users Groups
      • Configuring Local Users VPN Access
      • Configuring Local Users User Quota
    • Editing Local Users
  • Configuring Local Groups
    • Adding Local Groups
      • Configuring Local Groups Settings
      • Configuring Local Group Settings Members
      • Configuring Local Group Settings VPN Access
      • Configuring Local Group Settings Administration
    • Editing Local Groups
  • Settings
• Configuring Guest Services
  • Adding Guest Profiles
  • Editing Guest Profiles
  • Deleting Guest Profiles
• Configuring Guest Accounts
  • Adding Guest Accounts
  • Editing Guest Accounts
  • Deleting Guest Accounts
    • Deleting a Guest Account
    • Deleting Multiple Guest Accounts
    • Deleting All Guest Accounts
• Managing Guest Status
  • Logging Out Guests
  • Logging Out All Guests
• SonicWall Support
  • About This Document

SonicWall SSO Authentication Using the Terminal Services Agent

For users logged in from a Terminal Services or Citrix server, the TSA takes the place of the SSO Agent in the authentication process. The process is different in several ways:

• The TSA runs on the same server that the user is logged into, and includes the user name and domain along with the server IP address in the initial notification to the firewall.
• Users are identified by a user number as well as the IP address (for non-Terminal Services users, there is only one user at any IP address and so no user number is used). A non-zero user number is displayed in the SonicOS Management Interface using the format x.x.x.x user n, where x.x.x.x is the server IP address and n is the user number.
• The TSA sends a close notification to SonicOS when the user logs out, so no polling occurs.

After a user has been identified, the Security Appliance queries LDAP or a local database (based on administrator configuration) to find user group memberships, match the memberships against policy, and grant or restrict access to the user accordingly. Upon successful completion of the login sequence, the saved packets are sent on. If packets are received from the same source address before the sequence is completed, only the most recent packet is saved.

User names are returned from the authorization agent running the SSO Agent in the format <domain>/<user-name>. For locally configured user groups, the user name can be configured to be:

• The full name returned from the authorization agent running the SSO Agent (configuring the names in the firewall local user database to match).
• A simple user name with the domain component stripped off (default).

For the LDAP protocol, the <domain>/<user-name> format is converted to an LDAP distinguished name by creating an LDAP search for an object of class domain with a dc (domain component) attribute that matches the domain name. If one is found, then its distinguished name is used as the directory sub-tree to search for the user’s object. For example, if the user name is returned as SV/bob, then a search for an object with objectClass=domain and dc=SV is performed. If that returns an object with distinguished name dc=sv,dc=us,dc=SonicWall,dc=com, then a search under that directory sub-tree is created for (in the Active Directory case) an object with objectClass=user and sAMAccountName=bob. If no domain object is found, then the search for the user object is made from the top of the directory tree.

When a domain object has been found, the information is saved to avoid searching for the same object. If an attempt to locate a user in a saved domain fails, the saved domain information is deleted and another search for the domain object is made.

User logout is handled slightly differently by SonicWall SSO using the SSO Agent as compared to SSO with TSA. The network security appliance polls the authorization agent running the SSO Agent at a configurable rate to determine when a user has logged out. Upon user logout, the authentication agent running the SSO Agent sends a User Logged Out response to the firewall, confirming that the user has been logged out and terminating the SSO session. Rather than being polled by the network security appliance, the TSA itself monitors the Terminal Services/Citrix server for logout events and notifies the network security appliance as they occur, terminating the SSO session. For both agents, configurable inactivity timers can be set, and for the SSO Agent the user name request polling rate can be configured (set a short poll time for quick detection of logouts, or a longer polling time for less overhead on the system).