Web: Example for Configuring AD SSO for Internet Access Users (Multiple AD Servers + ADSSO_Setup.exe)

Procedure

1. Choose Network > Interface, set IP addresses for interfaces and assign the interfaces to security zones.

   The following example describes how to configure interface GigabitEthernet 0/0/3. You can configure other interfaces based on the networking diagram.

   Zone	trust
   IP Address	10.3.0.1/24

2. Choose Policy > Security Policy > Security Policy, click Add to configure security policies.
   1. Configure security policies between the Trust (AD server and AD monitor) and Local zone to ensure the communication among the FW and AD server.

      Name	local_policy_ad_01
      Source Zone	local
      Destination Zone	trust
      Destination Address	10.3.0.0/24
      Action	Permit

      Name	local_policy_ad_02
      Source Zone	trust
      Destination Zone	local
      Source Address	10.3.0.0/24
      Action	Permit

   2. Configure a security policy to allow users to access the server cluster.

      Name	policy_sec_03
      Source Zone	trust
      Destination Zone	dmz
      Source Address	10.3.0.0/24
      Action	Permit

3. On a FW, choose Object > Authentication Server > AD, click Add to set the parameters for communication with an AD server.

   

   The parameter settings on the FW must be consistent with those on the AD server.

   

   

   For the V600R007C20 version, whether to enable SSL for AD authentication cannot be configured on the web UI. When you configure the AD server on the web UI, SSL (ldap-over-ssl) is enabled by default. In this mode, LDAP over SSL must also be enabled on the AD server. For details, see the operating system guide of the AD server. To disable SSL (no-ssl), click CLI Console in the lower right corner of the web page. On the CLI configuration page that is displayed, run the ad-server authentication 10.3.0.251 88 no-ssl command in the corresponding AD server template view. The following uses no-ssl as an example.

   Click Detect. In the dialog box that is displayed, click OK and enter the user name and password that are configured on the AD server. Click Start Checking to check the connectivity to the AD server.

   If you are unfamiliar with the AD server and cannot provide the server name or Base DN values, you can use the AD Explorer software downloaded from Internet to connect to the AD server to query the attribute values. The mappings between the server attributes and parameters on the FW are as follows.

   

4. On a FW, choose Object > User > Authentication Domain, click Add to create an authentication domain.

   

5. On a FW, choose Object > User > User Import > Server Import, click Add to configure a policy to import user information from the AD server to the FW.

   

   

   In this example, users and user groups are imported to the FW. The user and user group filtering conditions in this example use the default values (&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer))) and (|(objectclass=organizationalUnit)(ou=*)).

6. Choose Object > User > cce.com, configure AD SSO and click Apply.

   Click Configure on the right of Server Import Policy. A dialog box is displayed. Click Import Immediately corresponding to policy_import. After the import is complete, the user groups and users on the AD server are displayed in User/User Group/Security Group Management List.

   

7. Choose Object > User > Authentication Policy, click Add to create an authentication policy.

   Name	auth_policy_service
   Source Zone	Trust
   Source Address/Region	10.3.0.0/24
   Action	Authentication exemption

   

   If the action of the authentication policy is set to authentication exemption, the FW obtains user information through SSO and permits the traffic when user information fails to be obtained during SSO authentication. If the network has high security requirements, set the action of the authentication policy to portal authentication. Then the FW will implement portal authentication on the users failing the SSO authentication.

   If the packets exchanged between the user and the AD server, between the user and the AD monitor, and between the AD monitor and the AD server pass through the FW, ensure that the authentication policy on the FW does not authenticate these packets and the security policy allows them through. You can choose Object > User > Authentication Policy to check the authentication policy.

8. Choose Object > User > Authentication Option, set the online user timeout duration to 480 minutes.
9. Visit Huawei technical support website , download ADSSO_Setup.exe and copy it to the AD monitor.
10. Enable the AD SSO service on the AD monitor.
    

    When the ADs in a domain establish synchronization relationships, only one SSO service program (ADSSO_Setup.exe) needs to be deployed.

    In this example, ADSSO_Setup.exe is deployed on the AD server with IP address 10.3.0.254.

    You must use an account that belongs to the Administrators group to log in to the AD monitor (AD server with IP address 10.3.0.254 in this example) and perform the following operations:

    1. Double-click ADSSO_Setup.exe. In the dialog box that is displayed, select English as the installation wizard language and click OK. The installation wizard is then displayed in English.
    2. Click Next and specify an installation directory, click Install.
    3. Start the ADSSO Agent program.
    4. Configure AD SSO parameters.
       

       Perform step 2 in the following figure several times to add all AD servers in the domain.

       

       1. Configure the parameters for the AD SSO program to receive messages from PCs and the shared key used by the AD SSO program to communicate with the FW.

          

          In this example, one AD SSO program monitors the login messages of multiple AD servers, and therefore Anti-replay Time needs to be set to 0 to disable the anti-replay function. The anti-replay function detects the different between the time when the AD SSO service program receives a user login message and the time when the user actually logs in to the AD server. If the time difference exceeds the anti-replay time, the user is disabled from going online from the FW. In the scenario with multiple AD servers, users are authenticated by different AD servers. The AD SSO service program obtains the user login time from these AD servers one by one. In this case, the time difference exceeds the Anti-replay Time value. Therefore, the anti-replay function needs to be disabled.

          Make sure that the port (port 12345 in this example) you intend to use is not occupied by other services. Choose Start > Run on the AD domain controller, enter cmd, and run netstat -ano|findstr 12345. If no information is returned, port 12345 is not occupied by other services. Otherwise, the system displays a message indicating the process ID of the service occupying the port. You are advised to release this port or specify another idle port for the AD SSO service.

       2. Add AD servers.

          Click Add several times to add all AD servers in the domain.

          The AD SSO program supports a maximum of 16 AD servers. It can connect to multiple AD servers to query login user information until it queries required information.

       3. Add FWs.

          The SSO program supports a maximum of five FWs and sends user login/logout messages to the FWs.

          

          When the FWs work in hot standby scenarios, you need to set Device Address to the virtual IP address of the VRRP group where the interfaces reside, so that the SSO service can send user login messages to the standby device during an active/standby FW switchover.

       4. Start the SSO service.

          You can right-click the AD SSO icon in the system tray on your desktop to start or stop the AD SSO service. Alternatively, click Show Log on the home page to view program operating logs and SSO service logs.

          You can also set the encoding style of the AD SSO program on the web UI. Ensure that the AD SSO program and the FW have the same encoding style. The default encoding style of the FW is GBK. If you have switched the encoding style to UTF-8, set the encoding style to UTF-8 here. Otherwise, keep the default setting.

11. On the AD domain controller, add script ReportLogin.exe to the logon script (Logon.exe) and logoff script (Logoff.exe) respectively, and set the parameters of the logon and logoff scripts so that the AD SSO service can monitor the logon and logoff operations of domain users. You can obtain script file ReportLogin.exe from the Script folder in the installation directory of the AD SSO on the AD monitor.
    

    When the ADs in a domain establish synchronization relationships, only one set of login/logout scripts needs to be deployed on one AD server. The login/logout scripts will be automatically synchronized to other AD servers.

    You must use an account that belongs to the Administrators group to log in to the AD domain controller. In this example, the Windows Server 2003 and Windows 2008 Server are used as an AD domain controller.

    1. Access the group policy configuration page and find the login/logout script. The procedures for accessing the group policy configuration pages of Windows 2003 Server, Windows 2008 Server, and Windows 2012 Server are different, and the login/logout script paths are different on these configuration pages.

       Windows 2003 Server

       1. Choose Start > All Programs > Administrator Tools > Active Directory Users and Computers. Then run the Active Directory Users and Computers tool.

       2. Right-click the domain (cce.com as an example) that requires SSO and select ProPerties. In the dialog box that is displayed, click the Group Policy tab.

       3. Double-click Default Domain Policy to open the domain policy configuration window.

       4. Choose User Configuration > Windows Settings > Scripts(Logon/Logoff),.

       Windows 2008 Server and Windows 2012 Server

       1. Choose Start > Administrative Tools > Group Policy Management.

       2. Right-click Default Domain Policy under the domain to which SSO authentication is to be applied, and choose Edit.

       3. Choose User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff).

    2. Double-click Logon to access the login script configuration window.
    3. In the login script configuration window, click ShowFiles... and copy ReportLogin.exe to the directory that is displayed. Then close the directory.
    4. In the login script configuration window, click Add, add login script ReportLogin.exe, and set the script parameters, as shown in Table 1. Then click OK.

       When adding the user login script, click Browse and select ReportLogin.exe in the directory displayed in 11.c.

       Table 1 script parameters

       Script Name

       Script Parameters

       ReportLogin.exe

       10.3.0.254 12345 0 3 Admin@123 NOTE: The parameters are separated by spaces. In the example, the IP address of the AD SSO service is the IP address (10.3.0.254) of the AD monitor. The service port must the same as the Port value specified in 12 when you install ADSSO_Setup.exe. The port number in this example is 12345. 0 indicates a login script. To configure a logout script, set this parameter to 1. 3 indicates maximum number of allowed retransmissions. The client shared key must the same as the Client Key value specified in 12 when you install ADSSO_Setup.exe. The Password in this example is Admin@123.

    5. Configure the logout script by referring to steps 11.b and 11.d. The login and logout scripts are both ReportLogin.exe but are saved in different folders.
    6. Choose Start > Run, enter cmd to open the CLI, and run gpupdate to apply the policy.
12. Reference the user groups when configuring a security policy, quota control policy, proxy policy, audit policy, PBR, and traffic policy.