Configuring eDirectory Agent

Administrator Help | TRITON AP-WEB and Web Filter & Security | Version 8.0.x

Related topics:

Identifying on-premises users transparently

Manual authentication

Configuring user identification and authentication

Websense eDirectory Agent gathers user logon session information from Novell eDirectory, which authenticates users logging on to the network. The agent then:

Associates each user with an IP address.

Records user name-to-IP-address pairings to a local user map.

Communicates the map to Filtering Service.

Filtering Service uses the information to apply policies to users, groups, or OUs.


	Note From a Novell client running Windows, multiple users can log on to a single Novell eDirectory server. This associates one IP address with multiple users. In this scenario, eDirectory Agent's user map only retains the user name/IP address pairing for the last user logged on from a given IP address.

One instance of Websense eDirectory Agent can support one Novell eDirectory master, plus any number of Novell eDirectory replicas.

Use the User Identification > eDirectory Agent page to configure a new instance of eDirectory Agent, as well as to configure the global settings that apply to all instances of eDirectory Agent.

For detailed information eDirectory Agent deployment, including configuration options not available via the TRITON Manager, see the Using eDirectory Agent for Transparent User Identification technical paper.

To add a new instance of eDirectory Agent:

Under Basic Agent Configuration, enter the IPv4 address or hostname of the eDirectory Agent machine.


	Note Machine names must start with an alphabetical character (a-z), not a numeric or special character. Machine names containing certain extended ASCII characters may not resolve properly. In non-English environments, enter an IP address instead of a name.

Enter the Port that eDirectory Agent should use to communicate with other Websense components (30700, by default).

To establish an authenticated connection between Filtering Service and eDirectory Agent, select Enable authentication, and then enter a Password for the connection.

Next, customize global eDirectory Agent communication settings:

Under eDirectory Server, specify a Search base (root context) for eDirectory Agent to use as a starting point when searching for user information in the directory.

Provide the administrative user account information that eDirectory Agent should use to communicate with the directory:

Enter the Administrator distinguished name for a Novell eDirectory administrative user account.

Enter the Password used by that account.

Specify a User entry timeout interval to indicate how long entries remain in the agent's user map.

This interval should be approximately 30% longer than a typical user logon session. This helps prevent user entries from being removed from the map before the users are done browsing.

Typically, the default value (24 hours) is recommended.


	Note In some environments, instead of using the User entry timeout interval to determine how frequently eDirectory Agent updates its user map, it may be appropriate to query the eDirectory Server at regular intervals for user logon updates. See the Using eDirectory Agent for Transparent User Identification technical paper for details.

Add the eDirectory Server master, as well as any replicas, to the eDirectory Replicas list. To add an eDirectory Server master or replica to the list, click Add, and the follow the instructions in Adding an eDirectory server replica.

When you are finished making configuration changes, click OK to return to the User Identification page, then click OK again to cache your changes. Changes are not saved until you click Save and Deploy.