User manual SONICWALL SONICOS ENHANCED 5.6 SINGLE SIGN-ON

[. . . ] Single Sign-On in SonicOS Enhanced 5. 6 Document Scope This document describes how to install and configure the Single Sign-On feature in the SonicOS Enhanced 5. 6 release. This document contains the following sections: · · · · · · · · "Single Sign-On Overview" section on page 1 "Installing the SonicWALL SSO Agent" section on page 11 "Installing the SonicWALL Terminal Services Agent" section on page 16 "Configuring the SonicWALL SSO Agent" section on page 18 "Configuring the SonicWALL Terminal Services Agent" section on page 25 "Using NDConnector with SonicWALL SSO" section on page 27 "Configuring Your SonicWALL Security Appliance" section on page 32 "Glossary" section on page 61 Single Sign-On Overview This section provides an introduction to the SonicWALL Single Sign-On feature. This section contains the following subsections: · · · · · · "What Is Single Sign-On?" section on page 1 "Benefits of SonicWALL SSO" section on page 3 "Platforms and Supported Standards" section on page 3 "How Does Single Sign-On Work?" section on page 5 "How Does SonicWALL SSO Agent Work?" section on page 6 "How Does SonicWALL Terminal Services Agent Work?" section on page 9 What Is Single Sign-On? Single Sign-On (SSO) is a transparent user authentication mechanism that provides privileged access to multiple network resources with a single login to the domain from a workstation or through a Windows Terminal Services or Citrix server. SonicWALL security appliances provide SSO functionality using the SonicWALL Single Sign-On Agent (SSO Agent) and SonicWALL Terminal Services Agent (TSA) to identify Single Sign-On in SonicOS Enhanced 5. 6 1 Single Sign-On Overview user activity. [. . . ] Click the Advanced tab in the lower half of the page. In the Maximum requests to send at a time field, enter the maximum number of requests to send from the appliance to the agent at one time. The agent processes multiple requests concurrently, spawning a separate thread in the agent PC to handle each. Sending too many requests at a time can overload the PC. On the other hand, if the number of requests to be sent from the appliance exceeds the maximum, then some requests will wait on an internal "ring buffer" queue. Too many requests waiting could lead to slow response times in Single Sign On authentication. For more information, see "Tuning Single Sign-On Advanced Settings" on page 52. Step 9 To apply your changes without exiting the configuration window, click Apply. If you are finished with all Authentication Agent configuration, click OK. Step 10 Proceed with configuration on the Users tab. See "Configuring the Users Settings" on page 37. Editing the Settings of Existing Agents You can edit the settngs for configured agents (SSO Agent or TSA) by clicking the Configure icon or by clicking the settings directly in the table row of the Authentication Agents Settings page. Certain settings, such as Shared Key, are not available for direct editing in the table row. Single Sign-On in SonicOS Enhanced 5. 6 35 Configuring Your SonicWALL Security Appliance To edit the settings of previously configured agents: Step 1 For access to all the settings of an existing agent for editing, click the Configure icon of the row. on the right side Step 2 Step 3 The settings are displayed in the lower half of the page. Make the desired changes and then click Apply. To edit a setting directly in the table row, click on the value in the row that you want to change. Step 4 When clicked, the field changes to an editable text box. Make the desired change and then click anywhere else in the window to exit from editing mode. Step 5 To apply your changes without exiting the configuration window, click Apply. If you are finished with all Authentication Agent configuration, click OK. 36 Single Sign-On in SonicOS Enhanced 5. 6 Configuring Your SonicWALL Security Appliance Configuring the Users Settings The Users tab provides a way to configure user authentication settings and the rates for polling user login status and retrying authentication requests. To configure the Users settings, perform the following steps: Step 1 Click the Users tab. The User Settings page displays. Step 2 Step 3 Check the box next to Allow only users listed locally to allow only users listed locally on the appliance to be authenticated. Check the box next to Simple user names in local database to use simple user names. When selected, the domain component of a user name will be ignored. User names returned from the authentication agent typically include a domain component, for example, domain1/user1. If this box is not checked, user names in the local database must match exactly the full names returned from the agent, including the domain component. Check the box next to Allow limited access for non-domain users to allow limited access to users who are logged in to a computer but not into a domain. These users will not be given membership in the Trusted Users user group, even when set locally, and so will not get any access set in policies for Trusted Users. They will be given access through policies that apply to Everyone or to their specific user names. [. . . ] The user will be transparently logged in again, with the changes reflected. Configuring Additional User Settings The Users > Settings page provides the administrator with configuration options for user session settings, global user settings, and acceptable use policy settings, in addition to SSO and other user login settings. The Enable login session limit and corresponding Login session limit (minutes) settings under User Session Settings apply to users logged in using SSO. SSO users will be logged out according to session limit settings, but will be automatically and transparently logged back in when they send further traffic. Note Do not set the login session limit interval too low. This could potentially cause performance problems, especially for deployments with many users. [. . . ]