Support

Go to the table of contents Go to the previous page Go to the next page Go to the index View or print as PDF
Security > Proxy user authentication > Multiple realm authentication
Multiple realm authentication
Help | Content Gateway | Version 7.7.3
 
Related topics:
*
Transparent proxy authentication settings
*
Global authentication options
*
Multiple realm authentication: Domains
*
Creating an Integrated Windows Authentication realm rule
*
Creating an LDAP authentication realm rule
*
Working with authentication realm rules
*
Multiple Realm Authentication use cases
*
Troubleshooting Multiple Realm Authentication
Multiple realm authentication is designed for environments that have multiple domains that are essentially isolated for the purposes of user authentication by a lack of mutual inbound and outbound trust relationships. Therefore, users in these domains must be authenticated by a domain controller within their domain. With respect to this feature, these isolated domains are called realms.
 
* 
Note 
If all the users in your network can be authenticated by domain controllers that share trust relationships, you probably don't need rules for multiple authentication realms.
However, the option is well suited to single domain environments that benefit from multiple authentication rules based on IP addresses, inbound proxy port (explicit proxy), and/or User-Agent values.
Multiple realm authentication allows distinct authentication rules to be written for each domain, thereby supporting the use of multiple authentication methods at the same time (IWA, legacy NTLM, LDAP). For example, RealmA might be an Active Directory domain for which you want to authenticate users with Integrated Windows Authentication. RealmB might be an LDAP domain for which you must authenticate users with LDAP. This is easy to accomplish with multiple realm authentication. For several hypothetical scenarios, see Multiple Realm Authentication use cases.
In explicit proxy environments, authentication rules can be written for traffic inbound on specific ports. This allows for authentication rules that specify the proxy port, source IP addresses, User-Agent, authentication method, and realm.
 
* 
Important 
In a multiple realm environment, Content Gateway may authenticate users that Web Security does not know about (are outside User Services primary domain). In these cases, Content Gateway can be configured to send an "alias" user name that Web Security knows about. Or, to apply the Default policy, send no name. This selection is made in the Advanced Options of each rule you define.
For a more detailed description, see Unknown users and the 'alias' option, below.
How does support for multiple realm authentication work?
In networks with multiple realms (or a single realm), rules are defined to direct sets of IP addresses, traffic on specific ports, or specified User-Agent values to distinct domain controllers. These rules are defined on the Configure > Security > Access Control > Authentication Realms tab. Rules are stored in the auth.config file.
*
Multiple realm authentication rules can be defined for IWA, Legacy NTLM, and LDAP sources.
*
One or more authentication rules can be defined for each realm.
*
The specifiers used in each realm rule type (IWA, legacy NTLM, LDAP) vary.
*
Rules are applied from the list top down; the first match applies. If no rule matches, no authentication is attempted.
*
Transactions are logged with the name used by Filtering Service.
*
Proxy authentication statistics are collected and reported discreetly for each authentication method. See Security (in the Statistics section).
 
* 
Important 
Content Gateway must be configured with a DNS server that can resolve the fully qualified domain name (FQDN) of Content Gateway for every realm used by Integrated Windows Authentication. If this isn't done, IWA rules fail to work. How to configure the DNS server is up to the network administrator. One option is to configure a DNS transfer zone (Sub Zone) between the primary DNS server of Content Gateway and the DNS server of each authentication realm.
Unknown users and the 'alias' option
In multiple realm environments, it's possible for Content Gateway to authenticate a user who, when passed to Web Security, is not recognized because the name is not in the User Services directory. When an authenticated user name is not matched, the Default policy is applied. There are several ways to address this:
*
Change the Web Security User Services configuration to see and add the names to its directory.
*
Add the unrecognized names to Web Security's primary domain. The names must match exactly. Define policies for the new names.
*
For users who match a particular realm rule, pass an alias name and add the alias name to Web Security's primary domain. The names must match exactly. Define a policy for the alias name.
*
If the existing Web Security default policy is sufficient, do nothing, or for every user who matches a particular realm rule, in the realm rule select to use a blank (empty) alias.
For some illustrative use cases, see Multiple Realm Authentication use cases.
Multiple realm authentication configuration summary
*
Join all of the Windows domains to be used with Integrated Windows Authentication rules (domains can be added or removed later, but rules cannot be created for a domain that is not joined). See Multiple realm authentication: Domains.
*
If Content Gateway is an explicit proxy and you want to bring in traffic on multiple ports, specify the ports on the Configure > Protocol > HTTP tab.
 
* 
Important 
*
You must also configure your clients to use the correct port.
*
If Content Gateway is a transparent proxy, make Transparent proxy authentication settings
*
Configure the Global authentication options
*
Create authentication rules
*
Creating an Integrated Windows Authentication realm rule
*
Creating a legacy NTLM authentication realm rule
*
Creating an LDAP authentication realm rule
Print print article Email email article Font Size: A A

Search

Article Rating:

Do you have any additional feedback?    Email: close

Related Articles

Quick Links

Service Requests

How are we doing?

Provide us feedback on your experience with the Service Request portal.

provide feedback >

Go to the table of contents Go to the previous page Go to the next page Go to the index View or print as PDF
Security > Proxy user authentication > Multiple realm authentication