Add new user from a Local type user directory

To add a new user from a Local type user directory click the ADD NEW USER button and select a Local type user directory in the USER DIRECTORY drop down list.

The field ASSIGN TO ROLES lists all the roles that are assigned to this user. See section Assign roles to a user, LDAP group or Active Directory group for details about role assignment.

Add new users from an LDAP type or Active Directory type user directory

To add a new user from an LDAP type or Active Directory type user directory click the ADD NEW USER button and select an LDAP type or Active Directory type user directory in the USER DIRECTORY drop down list. Select USER as the ACCOUNT TYPE.

Provide the name of the account in the ACCOUNT NAME field and click the FIND ACCOUNT button to look up the account in the LDAP or Active Directory. If the lookup succeeds then the ACCOUNT DISPLAY NAME and the DISTINGUISHED NAME fields are filled automatically.

The field ASSIGN TO ROLES lists all the roles that are assigned to this user. See section Assign roles to a user, LDAP group or Active Directory group for details about role assignment.

Add new group from an LDAP type or Active Directory type user directory

To add a new group from an LDAP type or Active Directory type user directory click the ADD NEW USER button and select an LDAP type or Active Directory type user directory in the USER DIRECTORY drop down list.

Provide the name of the group in the ACCOUNT NAME field and click the FIND ACCOUNT button to look up the group in the LDAP or Active Directory. If the lookup succeeds then the ACCOUNT DISPLAY NAME and the DISTINGUISHED NAME fields are filled automatically.

The field ASSIGN TO ROLES lists all the roles that are assigned to all users of the selected group. See section Assign roles to a user, LDAP group or Active Directory group for details about role assignment.

Assign roles to a user, LDAP group or Active Directory group

Role(s) must be assigned to users, LDAP groups and Active Directory groups in order they can use the Web Management Console. The roles assigned to a certain user determine what pages that user can access in the Web Management Console and wheter she can only read, or modify as well values on a page.

The field ASSIGN TO ROLES in the Add/assign new user(s) and Modify user dialogs lists all the roles that are assigned to the user.

The following is the role assignment policy:

1. At least one role must be assigned to a user, LDAP group or Active Directory group

2. Optionally multiple different roles can be assigned

   1. In this case the most permissive available right applies to each function.

      For details about the permissiveness of roles see the Roles tab section.

      Example:

      Roles assigned	Effective permissions
      	Read only permission	No permission
      security_auditor	Config history, Global settings
      help_desk	Global settings	Config history
      security_admin AND security_auditor	Config history, Global settings

Delete user

Effective right

A single user may have multiple roles assigned to it. There may be cases, when one of the assigned roles of the user would prohibit, while the other assigned role of the user would permit a certain function. In this case the more permissive right will be effective.

See section Assign roles to a user, LDAP group or Active Directory group for details about assigning multiple roles to a single user.

Modify role

Delete role

Add new Local type user directory

Click the ADD NEW USER DIRECTORY button and select Local in the USERDIRECTORY TYPE drop down list.

For explanation of the NUMBER OF FAILED LOGINS BEFORE LOCKOUT and LOCKOUT TIME [MINUTES] fields read the Local type user directories section.

Add new LDAP type or Active Directory type user directory

1. Click the ADD NEW USER DIRECTORY button and select LDAP or Active Directory in the USERDIRECTORY TYPE drop down list respectively. Learn more about the differences between LDAP and Active Directory type user directories.

2. Multiple LDAP or Active Directory servers can be configured to provide high availability of the directory services.

   1. Server preference:

      1. The configured servers are taken for a connection attempt in a top-bottom fashion.

         

   2. Failover conditions

      1. If the connection to a certain LDAP or AD server fails (for a reason other then authentication error) then

      2. The next server in the preference order is attempted.

         

   3. Server properties
      The following properties must be specified for each LDAP or AD server:

      1. SERVER HOST: IP address or FQDN of the server

      2. SERVER PORT: The TCP port on which the directory service is listening

      3. ENCRYPTION: What kind of encryption to use when establishing the connection

         1. None: No encryption, communication on a clear-text channel

            As long as ENCRYPTION field is set to None there is no encryption used between the MetaDefender product and the LDAP or Active Directory server. All passwords and other information are sent clear-text over the network.

            Use StartTLS or SSL as ENCRYPTION whenever possible.

         2. StartTLS: The connection is established on a clear-text channel, then upgraded to TLS (TLS over LDAP)

         3. SSL: The connection is established on a TLS encrypted channel (LDAP over TLS)

            For StartTLS and SSL type encrypted connections the LDAP or Active Directory server must authenticate itself with a certificate that's validity can be verified by the MetaDefender product. This can happen in basically two ways:

            1. Trusted certificate: the certificate's root certificate is issued by a trusted certificate authority (e.g. Comodo, Symantec, GoDaddy, GlobalSign, IdenTrust, DigiCert, StartCom, Entrust, Trustwave, Verizon, etc.) These root certificates are usually pre-installed in modern operating systems and as a result can be verified by the MetaDefender product.

            2. Self-signed certificate: the certificate (or it's root certificate) is added to the system as a trusted root certificate. For details about adding a certificate as a trusted root certificate, see the manuals of the operating system of your MetaDefender product. For your convenience here are the necessary commands for Windows and some Linux distributions (the path to the self signed certificate file is C:\Path\To\certificate.crt or /path/to/certificate.crt on Windows or Linux respectively):

               Windows

               > certutil -addstore -f "ROOT" C:\Path\To\certificate.crt

3. Select whether to authenticate or not at the time of the bind request. Authentication at the time of the bind request is an additional security control for directory services like host based authentication at SSH. It may or may not be required by the server.

   1. Selecting the ANONYMOUS BIND option will try to attempt to bind to the directory service with no username and password.

      If the ANONYMOUS BIND option is selected, then the values specified for BIND USERNAME and BIND PASSWORD are ignored, their text fields are disabled.

      Some LDAP and Active Directory servers may be configured to not permit anonymous bind requests .

   2. Specify the BIND USERNAME and BIND PASSWORD values. These values must be the name as DN (distinguished name) and password of a user who has permissions to do searches in the directory.

      As long as TLS is not configured for the Web Management Console, passwords are sent clear-text over the network. For details see Transport Layer Security.

4. The USER BASE DN and the GROUP BASE DN values should provide the entries in the LDAP or Active Directory tree where user and group entity lookups should be started.

   For further LDAP specific property details see LDAP attributes.

   For further Active Directory specific property details see Active Directory attributes.

5. Click the TEST button to test the LDAP or Active Directory settings. If the test succeeds then the user directory can be added to the list with the ADD button.

Delete user directory

Enable or disable user directory

To disable a user directory hover over the user directory's entry in the list and click the Disable user directory icon.

When disabling a user directory, all users that are assigned to it will be blocked from logging in.

When a user directory is disabled then the user directory's entry in the list displays the x mark. To enable the user directory click the Enable user directory icon.

Unlock locked accounts

All the locked user accounts that belong to a Local type user directory, can be released clicking the RELEASE LOCKOUT button.