This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Filtering Profiles - AD groups not picked up

I'm running an Astaro 120 with Full Guard on 8.201.

All of the Workstations have the Astaro Authentication Agent installed.

I created 4 Groups and setup the Back-end Active Directory and limited it to each matching group in AD.

Under Web Filtering Profiles I setup my Actions and Filters.  In the Filters I added the Groups to each filter.

Then under Proxy Profile I Added the Network and the Filters.  Selected Transparent and Agent Authentication.

When testing a user the Astaro sees the groups they belong too.  However the Web Log shows that it isn't matching the Users to the correct filter and fails them over to the Default Fail-over Filter action.

If I manually add the users or create static groups it works fine.  It just doesn't work with the Back-end Active Directory.

Any ideas????

This thread was automatically locked due to age.

Parents

0 BAlfson over 14 years ago

You are confusing two different authentication methods.  AAA and AD-SSO are unrelated.

To use the AD-authenticated backend groups, you must have the Profile in AD-SSO mode, and the users' browsers must be configured to use the Astaro Proxy on port 8080 (easily done with a GPO).

The AAA actually captures the IP of the user and identifies the user to the Astaro.  You then can use the "name (User Network)" objects in packet filter rules and, for example, in "Network groups" for HTTP/S Proxy Profiles.
Correction: In Using AAA to Allow a Single User to Download .exe Files, I correct my post about how to use AAA with Profiles.  The username or user group must be used in the Filter Assignment, and 'Allowed networks' in the profile cannot use "(User Network)" objects.  This appears to me to conflict implicitly with the documentation and explicitly with the announcement of the Agent.

Cheers - Bob
PS Try: HTTP/S Proxy Access with AD-SSO (Caution, the section "Configure User Authentication" should be eliminated as it has no effect on AD-SSO and can cause problems in larger organizations)

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 14 years ago

You are confusing two different authentication methods.  AAA and AD-SSO are unrelated.

To use the AD-authenticated backend groups, you must have the Profile in AD-SSO mode, and the users' browsers must be configured to use the Astaro Proxy on port 8080 (easily done with a GPO).

The AAA actually captures the IP of the user and identifies the user to the Astaro.  You then can use the "name (User Network)" objects in packet filter rules and, for example, in "Network groups" for HTTP/S Proxy Profiles.
Correction: In Using AAA to Allow a Single User to Download .exe Files, I correct my post about how to use AAA with Profiles.  The username or user group must be used in the Filter Assignment, and 'Allowed networks' in the profile cannot use "(User Network)" objects.  This appears to me to conflict implicitly with the documentation and explicitly with the announcement of the Agent.

Cheers - Bob
PS Try: HTTP/S Proxy Access with AD-SSO (Caution, the section "Configure User Authentication" should be eliminated as it has no effect on AD-SSO and can cause problems in larger organizations)

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data