LDAP User Authentication and Site Selection

Transcription

1 Active Directory/LDAP integration with SubDomains June 20, 2006 In This Document: Overview Overview page 1 Sample Domain Structure page 2 Special Considerations page 3 Configuring MS Active Directory page 4 This document covers the integration of sub-domains with Microsoft Active Directory and LDAP. Copyright 2005 Check Point Software Technologies, Ltd. All rights reserved 1

2 Sample Domain Structure Sample Domain Structure Figure 1 illustrates the Domain structure for two LDAP Account Units and a single User group that includes users from both Account Units. Figure 1 Sample Domain structure From SmartDashboard, users in both groups can be viewed, but authentication fails for users in the subdomain GROUP.ABC.LOCAL until a Global Group is created in GROUP.ABC.LOCAL. The subdomain requires special configuration steps to allow proper LDAP authentication for all users from both Account Units. Briefly, all relevant users should be added to a group called abc_remote_access_users and proper rule added to rulebase in security policy. Active Directory/LDAP integration with SubDomains. Last Update June 20,

3 Special Considerations When configuring MS Active Directory with subdomains: Special Considerations Each AD subdomain must be defined as a Global Catalog. Active Directory has a global catalog which contains a partial replica of all objects in the directory. The attributes in the global catalog are those most frequently used in search operations, user's first and last names, login names, etc. It allows users to find objects without knowing the domain by searching the entire forest. Global catalog allows searches on the entire forest as well as the schema and configuration containers. It contains a small subset of properties on each object. To search a global catalog, a domain controllerthat contains a global catalog must be available. Global catalogs are read-only. Groups in main domain must be defined as a Universal group. A Universal group can contain Accounts from any domain in the same forest, global groups from any domain in same forest, or other Universal groups from any domain in same forest. Microsoft's Certificate Server must be installed on all domains. This is required for SSL communication between the Active Directory Server and the Check Point SmartCenter Server/ Management Server. SSL communication must be enabled between FireWall-1 and Active Directory. Each domain must be defined a separate account unit. An External Group for the main domain's universal group must be defined on each subdomain's account unit actually on each users contained domain's account unit. A user-authentication rule must be duplicated for each external group definition (for each users contained in a subdomain). Active Directory/LDAP integration with SubDomains. Last Update June 20,

4 To configure MS Active Directory with subdomains: 1. Define each AD subdomain as a Global Catalog: Configuring MS Active Directory a. Select Start > Programs > Administrative Tools > Active Directory Sites and Services. Active Directory/LDAP integration with SubDomains. Last Update June 20,

5 b. Open Properties window for NTDS Settings and enable the Global Catalog option. c. Click OK. 2. Define main domain groups as a Universal Group: Active Directory/LDAP integration with SubDomains. Last Update June 20,

6 a. Select New > Group. b. In Group properties Group Scope section, enable radio button for Universal. Active Directory/LDAP integration with SubDomains. Last Update June 20,

7 c. Click OK. 3. Install Microsoft's Certificate Server on all domains: a. Select Start > Settings > Control Panel > Add/Remove Components > Add/Remove Windows Components. b. Select Certificate Services option and click Next. Active Directory/LDAP integration with SubDomains. Last Update June 20,

8 c. Select Enterprise Root CA for main domain and Subordinate CA for subdomains. d. Fill in the CA Identifying Information fields. Note - This is the information that will be part of your certificate. Active Directory/LDAP integration with SubDomains. Last Update June 20,

9 e. Take the Data Storage Location defaults. Certificate Server is now installed (no reboot necessary). Active Directory/LDAP integration with SubDomains. Last Update June 20,

10 4. For the main domain and subdomains, enable SSL communication between FireWall-1 and Active Directory: a. Select Start > Programs > Administrative Tools > Domain Security Policy. b. Browse to Security Settings > Public Key Policies > Automatic Certificate Request Settings. Right click and select New Automatic Certificate Request. Active Directory/LDAP integration with SubDomains. Last Update June 20,

11 c. Select Domain Controller from window, and select your CA. Configuring MS Active Directory 5. Define Account Units: Each domain must be defined a separate account unit. For example: a separate account unit for Europe.GCN.LOCAL is Europe_AU. 6. Define External group: External group for main domain's universal group must be defined on each subdomain's account unit (actually on each users contained domain's account unit): a. As an account unit, choose the subdomain account unit name (for example: Europe_AU) b. As a subtree (branch), choose a location of the universal group on the main domain (for example: CN=GROUPS, DC=GCN, DC=LOCAL) c. Select the Only group in branch option with the universal group's CN. Active Directory/LDAP integration with SubDomains. Last Update June 20,

12 7. Duplicate user authentication rules Configuring MS Active Directory In the the FireWall-1 Rulebase, duplicate a user-authentication rule for each external group definition (for each user contained in a subdomain). For example: On the Europe_AU account unit, the Europe_GR external group was defined. On the Ro_Europe_AU account, the Ro_Europe_GR external group (both them on the basis of main domain's universal group) was defined. Now define the same user-authentication rule for Europe_GR and Ro_Europe_GR. Active Directory/LDAP integration with SubDomains. Last Update June 20,