This option to display the Conditions of use for internet access does not apply to the transparent
SSO agent authentication method, as it does not require the activation of the authentication
portal.
Display frequency of
the Conditions (except
Guest method)
This display frequency will be the one configured for all methods expect Guest method
(see the Available methods tab).
Transparent or explicit HTTP proxy and multi-user objects
Multi-user objects
The list of networks of options allows several authentications from the same IP address (see the
option Multi-user objects). This allows, for example, accessing applications and data from a
remote computer (TSE server) applying filtering by user. This Multi-user application only applies
to HTTP and HTTPS traffic.
Below is a brief description of the mechanisms that allow multi-user authentication. The various
modes are covered in the following chapters.
Cookie mode
Multi-user objects have been made possible thanks to the Cookiemode; in which authentication
information is saved in a cookie by the browser during the first connection to each new queried
website. This information is forwarded in requests that follow to be intercepted by the firewall,
which will then be able to apply its policy.
Authentication offered by the browser (HTTP code 407)
The Proxy-Authorization - HTTP code 407 method can be used only for explicit proxies. The HTTP
protocol provides a field dedicated to authentication. The browser will prompt the user to
authenticate via a message window and the connection information will be relayed to the firewall
via the HTTP header. The security policy can then be applied.
The "Proxy-Authorization" (HTTP 407) authentication method via the browser does not allow the
SSL (certificates) and SPNEGO methods as they do not involve the authentication portal, even
though it needs to be enabled.
NOTE
If an object is added to or deleted from the list of Multi-user objects, ensure that no
authentication process relating to this object has been saved. Using Stormshield Network
Realtime Monitor, check the use of this object in the User module and delete the
authentication of any authenticated users by right-clicking on them – action "Delete user
from ASQ".
Transparent proxy (implicit)
The transparent or implicit proxy allows filtering user requests without any configuration on the
client workstation (no proxy declaration in the browser). As such, the firewall’s proxy will intercept
and filter all requests in order to allow or deny access to a website, for example.
This mode is recommended as it meets all requirements: authentication of the user according
to the selected method, SSL filtering (blocking of websites in HTTPS, for example), etc. The use of
this mode provides the benefits of all the features but nonetheless cannot use the transparent
authentication SSO agent method.
Page 59/448 sns-en-user_configuration_manual-v3 - Copyright © Stormshield 2016
SNS - USER CONFIGURATION MANUAL V.3
AUTHENTICATION
To Next Page
