Stormshield SN series - Page 58

Allow web enrolment
for users
A user account has to be created in order for this option to be functional.
If this option is selected, any user who attempts to connect and who does not exist in
the user database will be able to request the creation of his account by filling in a web
form. The administrator will then be able to confirm or deny his request.
Allow web enrolment
for users and create
their certificates
If this option is selected, users will not only be able to request the creation of their
accounts if they do not exist in the user database, but they will also be able to
request the creation of a certificate.
Notification of a new enrolment
This option allows new enrolled users to be informed of the creation of their accounts in the user
database.
Do not send any e-mail By default, the drop-down list will show that no e-mails will be sent to the
administrator to inform him of enrolment requests.
You can also define a group of users to whom enrolment requests will be sent in the
menu Notifications\E-mail alerts\ Recipients tab.
Once this group has been created, it will automatically be included in the drop-down
list and will be able to receive requests if you select it.
User
Prohibit simultaneous
authentication of a
user on multiple hosts
This option makes it possible to prevent a user from authenticating on several
computers at the same time.
By enabling this option, his multiple requests will automatically be denied.
Expiry of the HTTP cookie
Managing cookies for user authentication on the firewalls allows securing authentication by
preventing replay attacks for example, given that the connection cookie is necessary in order to
be considered authenticated.
Cookies are indispensable for allowing several users to authenticate from the same IP address.
These IP addresses have to be entered in the list of Multi-user objects (Authentication policy
tab).
NOTE
This option affects all methods except the SSO agent, which does not support multi-user
authentication.
The web browser negotiates cookies, therefore if authentication is carried out with Internet
Explorer, it will not be effective with Firefox or other web browsers.
At the end of the
authentication period
The HTTP cookie expires by default At the end of the authentication period, meaning
that it is negotiated only once throughout the whole duration of the authentication.
When a session is shut
down
The cookie will be negotiated every time a request is sent to your web browser.
Do not use (not
recommended)
It is possible to function without using the HTTP cookie, but this option is not
recommended as it compromises the security of the authentication.
Conditions of use for internet access
Enable the display of
the conditions of use
for internet access
Through this option, Conditions of use for internet access, also known as a Disclaimer,
can be shown to the user. The user must indicate his agreement to the terms by
selecting the relevant checkbox before being able to authenticate.
These conditions can be customized in the “Captive portal” tab.
NOTE
Page 58/448 sns-en-user_configuration_manual-v3 - Copyright © Stormshield 2016
SNS - USER CONFIGURATION MANUAL V.3
AUTHENTICATION