Authentication Settings

When selected, authentication information is stored in a cache.

Authentication is then based on this stored information, rather than on information retrieved from an authentication server or the internal user database

Specifies the name of the default Windows domain used for looking up authentication information.

This is one of the domains you have configured on the Appliances tab of the Configuration top-level menu.

When selected, the basic NTLM authentication method is applied to authenticate users.

Information that a user submits for authentication is then sent in plain-text format (less secure) to the Windows domain server.

When selected, the integrated NTLM authentication method is applied to authenticate users.

Information that a user submits for authentication is then encrypted before it is sent to the Windows domain server.

When selected, NTLM authentication information is stored in this cache.

Authentication is then based on this stored information, rather on information retrieved from the Windows domain server.

When selected, the basic NTLM authentication method is applied to authenticate users.

Information that a user submits for authentication is then sent in plain-text format (less secure) to the Windows domain server.

When selected, the integrated NTLM authentication method is applied to authenticate users.

Information that a user submits for authentication is then encrypted before it is sent to the Windows domain server.

When selected, NTLM authentication information is stored in this cache.

Authentication is then based on this stored information, rather on information retrieved from the Windows domain server.

Sets the password for a user name.

The Set button opens a window for configuring a new password.

When selected, version 3 of the LDAP protocol is used.

_{If you want to configure Secure LDAP authentication, also known as LDAPS, it is this LDAP version that you must use.}

This version is by default selected.

When selected, the name of the user who asks for authentication must map to a DN (Distinguished Name).

This name identifies the user in the directory on the LDAP server.

Specifies a filtering term for restricting the lookup of user attributes

To substitute the user name in the filtering term, u% is used as a variable.

Specifies a filtering term for restricting the lookup of group attributes

To substitute the user name in the filtering term, u% is used as a variable.

Lets you select an algorithm to calculate hash values for passwords. When user credentials are submitted from a browser to the proxy on Web Gateway, the password is encrypted using this hash.

You can select one of the following:

• MD5 (default)
• SHA-256

Sets a limit to repeated uses of the nonce (number only once) that is transmitted in the authentication process and required as a parameter for calculating the authentication hash.

The maximum number of times that a nonce can be used by default is 100.

Sets a limit to the time period (in minutes) that a nonce remains valid

The maximum time that a nonce can remain valid by default is 30 minutes.

When selected, a check is performed to ensure that the URL that a client sends as a parameter for calculating the authentication hash is the same as the URL that this client sends in its request for accessing a particular destination in the web.

If this check fails, the request is blocked.

As this check might also fail due to problems with the different formats that the browsers on the clients use for sending URLs, it is optional.

The check is enabled by default.

Sets the code value for the attribute retrieved with the user group information, according to RFC 2865.

For example, 25 is the code for the “class” attribute.

Sets the Vendor ID that is required for retrieving vendor-related data in the search for user group information.

According to RFC 2865, the vendor ID is a part of the vendor attribute, followed by several subattributes. Its code value is 26.

Sets a code value for the type of subattributes included in a vendor attribute. according to RFC 2865.

Since not all vendors adhere to this structure, we recommend specifying 0 as value here. This allows the authentication module to retrieve all available vendor information.

When selected, information to identify the groups that a user is a member of is retrieved from the ticket that is used in the process of authenticating users under the Kerberos authentication method.

When this option is selected, the following option becomes accessible.

When selected, communication with the OTP server is performed using an SSL-secured connection.

When this option is selected, the information in the following four fields is no longer grayed out and the Import button below these fields becomes accessible.

The fields provided detailed information about the certificate that is currently used in SSL-secured communication with the OTP server.

• Subject — Provides general information about the certificate.
  • Common Name (CN) — Specifies the common name of the certificate. By default, this name is localhost.
  • Organization (O) — Specifies the organization of the certificate. By default, the organization is OTP Server
  • Organizational Unit (OU) — Specifies the organizational unit of the certificate. By default, the organizational unit is not set.
• Issuer — Provides information about the issuer of the certificate.
  • Common Name (CN) — Specifies the common name of the issuer. By default, this name is localhost.
  • Organization (O) — Specifies the organization of the issuer. By default, the organization is OTP Server.
  • Organizational Unit (OU) — Specifies the organizational unit of the server certificate. By default, the organizational unit is not set.
• Validity — Limits the time the certificate is valid.
  • Not before — Shows the date and time when the validity of the certificate begins.
  • Not after — Shows the date and time when the validity of the server certificate ends.
• Extensions — Provides additional information about the certificate.
  • Comment — Provides a plain-text comment on the certificate. By default no comment is provided.
• Import — Opens a window for importing a certificate.

Specifies the prefix to messages that are sent from the OTP server to Web Gateway and the delimiters that include a message.

By default a message looks like this:

OTP for SWG: $$$$

When selected, a new evaluation to assign a value to a property is performed each time a rule containing this property is processed.

If a value has been stored for a property in the cache, it is not used.

While using cache values is recommended to improve performance, there can be situations where the new evaluation of a property is required.

In these situations, the same property is used more than once within the authentication rules and with the same settings of the Authentication module. A new evaluation ensures the most current value is assigned to the property each time.