Configure user authentication

This topic describes how to configure ASMS user authentication, including single sign-on, authentication servers, and LDAP forests.

In this topic:

Single Sign On (SSO) and ASMS

ASMS supports a SAML 2.0-based Single Sign On (SSO) solution, enabling you to integrate user logins with your SSO Provider.

SSO solutions have the following elements:

A service provider (SP)	In our case, AlgoSec is a service provider that provides ASMS.
An identity provider (IdP)	In our case, your SSO Provider provides user identity verification as the identity provider.

When SSO is enabled:

• ASMS directs users to authenticate against your SSO Provider as the IdP, and then redirects the user back to ASMS.
• Users already logged in to the SSO Provider are directed directly to ASMS.
• The Logout button no longer appears in ASMS. Log out by logging out of your SSO Provider only.

For more details, see:

• SSO Provider requirements
• Configure Single Sign On

SSO Provider requirements

As your IdP, your SSO Provider must be aware of the following ASMS services:

Assertion Consumer Service, or the Single Sign On URL	Informs the IdP where ASMS redirects the user for Single Sign On (login) requests. Configured as: https://<ASMS URL>/simplesaml/module.php/saml/sp/saml2-acs.php/<SP Identifier>
Single Logout Service	May not be required in all situations. Informs the IdP where ASMS redirects the user for Single Sign Out (logout) requests. Configured as: https://<ASMS URL>/simplesaml/module.php/saml/sp/saml2-logout.php/<SP Identifier>

The SSO Provider must inform ASMS about the user performing the authentication. The following data is passed with the returned attributes, post-authentication:

Attribute	Content	Example
UID	Username	laura
email	Email address	[email protected]
displayName	Name displayed in the user interface	Laura Sanchez

Configure Single Sign On

To configure Single Sign on in ASMS, do the following:

1. In the AFA Administration area, browse to the OPTIONS > Authentication tab.

2. Under User Authentication, select Single Sign On, and complete the following fields as needed:

   Service Provider identifier	The identifier of the AlgoSec SP. This identifier must be unique, and it must be added to the list of known SPs in your identity provider's configuration.
   Identity Provider identifier	The identifier of your installed IdP.
   IdP's Single Sign On service URL	The URL of the IdP's Login page.
   IdP's Single Sign Out service URL	The URL of the IdP's Logout page.

3. Optional: To fetch user data, select the Fetch User Data checkbox and do one of the following:

   Fetch user data from an LDAP server

   Do the following:

   1. Select LDAP, and complete the fields as needed:

      • LDAP Server Credentials fields
      • Attribute Mapping fields
      • Fields Mapping fields
      • FireFlow specific fields
   2. Click Test connectivity for the specific server to test connectivity. A message informs you whether AFA connected to the server successfully.

   3. To configure one or more secondary LDAP servers, select Use Secondary Servers, and complete the additional fields as needed. For details, see LDAP Server Credentials fields.

   4. Continue with step 4.

   LDAP Server Credentials fields

   Server	Type the IP address of the LDAP server's host computer.
   LDAP Version	Select the version of LDAP used on the LDAP server.
   Port	Type the port number on the LDAP server's host computer.
   Timeout	Use the arrow buttons to select the maximum amount of time in seconds to wait for the LDAP server's reply.
   Secure Connection	Select this option to secure connections with the LDAP server, then choose the method to use for securing the connection: LDAPS or StartTLS. The default method is LDAPS. The value of the Port field changes according to the method selected.
   Verify Server Certificate	Select this option to specify that AFA should check the LDAP server's certificate against a locally stored certificate. AFA will only connect to the LDAP server if the certificates are identical. The CA Certificate field appears.
   CA Certificate	Select the locally stored certificate against which AFA should compare the LDAP server's certificate. The certificate must be stored under /home/afa/.fa/ca_certs in order to appear in the drop-down list.
   Bind Type	Select the bind type to use: Simple. AFA sends the entered username and password to the LDAP server. If the entered username exists in the LDAP server, and the password matches the username, then the user is logged in. Regular. AFA logs in to the LDAP server using a user DN and password, and then checks the entered username and password against the LDAP server. If the entered username exists in the LDAP server, the password matches the username, and any additional criteria are met, then the user is logged in. Anonymous. AFA accesses the LDAP server anonymously, and then checks the entered username and password against the LDAP server. If the entered username exists in the LDAP server, the password matches the username, and any additional criteria are met, then the user is logged in. If you chose Regular or Anonymous, additional fields appear. The default value is Regular.
   User DN	Type the user DN that AFA should use to log in to the LDAP server. This field appears only for Regular bind type.
   Password	Type the password that AFA should use to log in to the LDAP server. This field appears only for Regular bind type.

   Attribute Mapping fields

   Name	Type the attribute that contains a user's name, in user objects in the database. The default value is sAMAccountName.
   Group Membership	Type the attribute that contains a user's groups, in user objects in the database. The default value is member.

   Fields Mapping fields

   Associated Roles	Select this option to import user group information from the LDAP server. Selecting this option enables assigning user roles via a specified correspondence between LDAP groups and AFA, FireFlow, or AppViz roles. To manage roles from within the AlgoSec Suite (not the LDAP), do not select this option.
   Full Name	Type the name of the LDAP server user field from which you want to import data to the AlgoSec Firewall Analyzer and FireFlow Full Name field.
   Email	Type the name of the LDAP server user field from which you want to import data to the AlgoSec Firewall Analyzer and FireFlow Email field.
   Notes	Type the name of the LDAP server user field from which you want to import data to the AlgoSec Firewall Analyzer and FireFlow Notes field.

   FireFlow specific fields

   Organization	Type the name of the LDAP server user field from which you want to import data to the FireFlow Organization field.
   Address	Type the name of the LDAP server user field from which you want to import data to the FireFlow Address field.
   City	Type the name of the LDAP server user field from which you want to import data to the FireFlow City field.
   State	Type the name of the LDAP server user field from which you want to import data to the FireFlow State field.
   Zip Code	Type the name of the LDAP server user field from which you want to import data to the FireFlow Zip Code field.
   Country	Type the name of the LDAP server user field from which you want to import data to the FireFlow Country field.
   Home Phone	Type the name of the LDAP server user field from which you want to import data to the FireFlow Home Phone field.
   Work Phone	Type the name of the LDAP server user field from which you want to import data to the FireFlow Work Phone field.
   Mobile Phone	Type the name of the LDAP server user field from which you want to import data to the FireFlow Mobile Phone field.
   Pager	Type the name of the LDAP server user field from which you want to import data to the FireFlow Pager field.

   Fetch user data from the SSO Provider (the IdP)

   Select IDP and complete the fields as needed. For details, see:

   • Fields Mapping fields
   • FireFlow specific fields

   When complete, continue with step 4.

   Fields Mapping fields

   Full Name	Type the name of the LDAP server user field from which you want to import data to the AlgoSec Firewall Analyzer and FireFlow Full Name field.
   Email	Type the name of the LDAP server user field from which you want to import data to the AlgoSec Firewall Analyzer and FireFlow Email field.
   Notes	Type the name of the LDAP server user field from which you want to import data to the AlgoSec Firewall Analyzer and FireFlow Notes field.

   FireFlow specific fields

   Organization	Type the name of the LDAP server user field from which you want to import data to the FireFlow Organization field.
   Address	Type the name of the LDAP server user field from which you want to import data to the FireFlow Address field.
   City	Type the name of the LDAP server user field from which you want to import data to the FireFlow City field.
   State	Type the name of the LDAP server user field from which you want to import data to the FireFlow State field.
   Zip Code	Type the name of the LDAP server user field from which you want to import data to the FireFlow Zip Code field.
   Country	Type the name of the LDAP server user field from which you want to import data to the FireFlow Country field.
   Home Phone	Type the name of the LDAP server user field from which you want to import data to the FireFlow Home Phone field.
   Work Phone	Type the name of the LDAP server user field from which you want to import data to the FireFlow Work Phone field.
   Mobile Phone	Type the name of the LDAP server user field from which you want to import data to the FireFlow Mobile Phone field.
   Pager	Type the name of the LDAP server user field from which you want to import data to the FireFlow Pager field.

4. To set a default mail domain, select Default Mail Domain, and enter the URL.

   When this option is configured, AFA automatically generates an email address for users by attaching the specified email suffix to its username (when an email address is not provided).

5. At the bottom of the page, click OK. Changes to user authentication settings immediately take effect.

Optionally, do any of the following:

Back to top

User authentication via authentication servers

The AlgoSec Security Management Suite (ASMS) supports authenticating users via an authentication server in the following ways:

Local user database	The AlgoSec Security Management Suite maintains a local user database that is composed of the usernames and passwords of users you have added. When a user attempts to log in, the AlgoSec Suite compares the entered username and password to the local user database. If the entered username exists in the database, and the password matches the username, then the user is logged in.
LDAP server	If your company uses an LDAP (Lightweight Directory Access Protocol) server for authenticating network users (for example, Microsoft Active Directory), you can configure the AlgoSec Suite to authenticate users against the LDAP server. When a user attempts to log in (using the login credentials defined for them on the LDAP server), the AlgoSec Suite sends the entered username and password to the LDAP server. If the entered username exists in the LDAP server, and the password matches the username, then the user is logged in. The user will automatically be added to ASMS, allowing you to manage the user in the ASMS web interface. If desired, you can configure additional criteria for authentication. For example, you can specify that the LDAP server should only search certain parts of its database for the entered username and password, or that users must belong to a certain LDAP user group. The AlgoSec Suite additionally supports importing user data, such as permissions and roles, from an LDAP Server. When this is configured, each user is automatically assigned roles based on their LDAP groups. Note: It is possible to use multiple LDAP servers to authenticate users. For more details, see Import user data from an LDAP server.
RADIUS server	Some companies use a RADIUS (Remote Authentication Dial In User Service) server for authenticating network users. The AlgoSec Security Suite can be configured to use the corporate RADIUS server to authenticate users. When a user attempts to log in (using the login credentials defined on the RADIUS server), ASMS sends the entered username and password to the RADIUS server. If the entered username exists in the RADIUS database, and the password matches the username, then the user is logged in. The user will automatically be added to ASMS, allowing you to manage the user in the ASMS web interface. The AlgoSec Suite additionally supports importing data from an LDAP server for RADIUS authenticated users. See Import user data from an LDAP server. Note: Microsoft Active Directory can be configured as a RADIUS server. For information on configuring Active Directory, refer to Microsoft documentation.

By default, the AlgoSec Security Suite uses the local user database to authenticate users. If you want to use a RADIUS server and/or an LDAP server in addition to local authentication, you must configure the desired user authentication method using the following procedure.

Configure user authentication via an authentication server

Do the following:

1. In the toolbar, click your username.

   A drop-down menu appears.

2. Select Administration.

   The Administration page appears, displaying the Options tab.

3. In the Options tab, click the Authentication sub-tab.

   The Authentication page appears.

   

4. Choose Authentication Server.

   Note: The Local check box is selected by default and cannot be cleared.

5. To enable user authentication using a corporate RADIUS server:

   1. Select the RADIUS check box.

      Radius Authentication fields appear.

      

   2. Complete the fields as needed. If you selected the Use Secondary Servers check box, additional fields appear.

      For details, see RADIUS authentication fields.

6. To enable user authentication against an LDAP server:

   1. Select the LDAP check box.

      New fields appear.

      

   2. Complete the fields using the information in LDAP Authentication Fields (see LDAP authentication fields).

      If you selected the Use Secondary Servers or Fetch user data from LDAP check boxes, additional fields appear.

      Continue completing the fields using the information in LDAP Authentication Fields (see LDAP authentication fields).

7. To test connectivity for a defined RADIUS or LDAP server, click Test connectivity for the specific server.

   A message informs you whether AFA connected to the server successfully.

8. In the Default for new users area, choose the default authentication method for new users.

   Note: You can override the default authentication method to use on a per-user basis.

9. To set a default mail domain, select Default Mail Domain, and  type the URL.

   When this option is configured, AFA automatically generates an email address for users by attaching the specified email suffix to its username (when an email address is not provided).

10. Click OK.

Changes to user authentication settings immediately take effect.

Back to top

Import user data from an LDAP server

Whether you are authenticating users with an LDAP or RADIUS authentication server, you can configure ASMS to import user data from an LDAP server. Upon each login, ASMS will fetch the user's full name and email address, as well as roles and inherited permissions. All of this information will be updated for the users on the AlgoSec server.

Do the following:

1. Configure LDAP or RADIUS user authentication. For details, see User authentication via authentication servers.

   • When authenticating with an LDAP server, select the Fetch user data from LDAP check box and complete the fields in the Fields Mapping area.

   • When authenticating with a RADIUS server, do the following:

     1. Select the Fetch user data from LDAP check box in the RADIUS Authentication fields area.

     2. Additionally define the LDAP, select the Fetch user data from LDAP check box and complete the fields in the Fields Mapping area.

   Note: Many fields in FireFlow appear as options for mapping data. To import an LDAP field that doesn't exist by default, see Manage authentication servers and SSO.

2. Click OK.

3. If you selected the Associated Roles option, indicate a correspondence between LDAP groups and AlgoSec Suite roles doing the following:

4. Add/Edit the user role you want to link with an LDAP group. For details, see Manage users and roles in AFA.

5. Type the LDAP group name that you want to link with the role in the Role LDAP DN field.

When users log in that are members of this LDAP group, they will automatically be granted the role.

Back to top

Configure an LDAP forest

If you have multiple LDAP servers with different users defined on each one, you can configure an LDAP forest consisting of these servers. AFA and FireFlow will authenticate LDAP users against the correct LDAP server.

Complete this procedure for each LDAP server you want to include in the forest.

Do the following:

1. Choose a number to represent the LDAP server.

   Number 1 represents the primary LDAP server, and numbers 2 and 3 represent possible backup servers. If you do not want those servers to be included in the forest, choose a number higher than 3.

2. In the toolbar, click your username.

   A drop-down menu appears.

3. Select Administration.

   The Administration page appears, displaying the Options tab.

4. In the Options tab, click the Advanced Configuration sub-tab.

   The Advanced Configuration page appears.

   

5. Add the parameters specified in LDAP Parameters (see LDAP parameters), one at a time, by doing the following:

   1. Click Add.

      The Add New Configuration Parameter dialog box appears.

      

   2. In the Name field, type ParamNumber

      Where:

      • Param is the parameter name.

      • Number is the server number selected in the previous step.

      For example, to specify the port number of LDAP server number 4, type LDAP_Port4.

   3. In the Value field, type the parameters value.

   4. Click OK.

   5. Repeat the above steps for each parameter.

   6. Click OK.

LDAP forest example

In the following example, LDAP server 4 is added to the forest:

Back to top

Log in when an LDAP forest is configured

Do the following:

1. In the AFA or FireFlow Login page, type the following in the Username field:

   LdapDomain\userName

   Where:

   • LdapDomain is the domain name of the LDAP server on which they are defined.

   • userName is the user's LDAP username.

   For example, if Bob is defined on an LDAP server whose domain name is Ldomain4, then he must type "Ldomain4\Bob" in the Username field.

2. In the Password field, type your LDAP password.

3. Click Login.

Back to top