The Check Point products have the ability since years to authenticate users using a LDAP server.
In former times this was called SmartDirectory(LDAP), now it is the User Directory Software Blade.
The pricelist states that you have to pay $4000 for it and you may say that this is an awfull lot of money.
But today I’m going to show you the cool things you can do with that blade and how to use this in your enterprise environment your enhanced user experience.
First we should have a look at the Actice Directory structure.
For my lab environment I build the test domain hamburg.local.
The OU (LDAP term for organisational unit) Employees is containing another two OUs which hold the endusers.
We place external users in the OU ext and internal users in the OU int. This is a pure example of how OUs can be used for grouping users into logical units for better administration.
All the users belong to one or more groups. We have built-in groups and custom groups. In my Active Directory I keep the groups created by myself in the OU Groups.
The normal Actice Directory Users and Computers plugin for the management console shows the AD structure in a tree view, but does not reveal the underlying LDAP structure.
Since the Check Point User Directory/SmartDirectory is a LDAP connector, we need to deal with the LDAP structure and attributes.
A good tool for displaying the LDAP structure of an Active Directory is ADSI EDIT, which is part of the support tools in Windows 2003 server and built-in with Windows 2008 server.
When a complete path is needed, this is called DN or distinguished name. The DN for the built-in administrator for example is
cn=administrator,cn=users,dc=hamburg,dc=local.
OK, our Activce Directory is ready, let’s configure the Check Point Security Management.
Now we login to SmartUpdate and add the Software Blade license for User Directory, either eval license or normal license for your environment. Then we enable the blade and the functionality in SmartDashboard.
On your security management object, enable User Directory blade.
In global properties, enable SmartDirectory(LDAP).
We then have to create a user template which contains information about how the user is able to authenticate. Select Check Point Password as authentication scheme.
Now we’re going to create a node object which represents the Active Directory Domain Controller.
Then we create the object for a LDAP account unit.
On the Server tab click Add and select the newly created node object from the drop down menu.
If you’re using unencrypted LDAP, the TCP port is 389 so leave this unchanged.
Under Username you fill in the credentials of a user that is able to do operation within the Active Directory.
Within my simple setup I chose the Administrator account.
Under Login DN you have to specify the full path to the user account within the directory.
The built-in Administrator is
cn=Administrator,cn=users,dc=hamburg,dc=local,
the newly created user John Doe is
cn=John Doe,OU=ext,OU=Employees,dc=hamburg,dc=local.
Fill in a password and submit with OK.
Then change to the tab Objects Management and say Fetch branches.
This is the first test if the security management can communicate with the Active Directory domain controller and if you supplied the right credentials. If so, you will see some branches.
Normaly, these brances are not usefull because you created some of your own. In that case delete the fetched branches and create new ones.
These branches can be seen as container or folders that hold your users and/or groups.
Create all the branches you might need.
In our example we want to check for existing user accounts locted under OU Employees and sub-OUs and for security groups located under OU Groups so we need these branches.
Change to the Authentication tab and enable the checkbox for Use user template. Choose the newly created template from the beginning.
Click OK.
Now you will find an object in the tree which represents the LDAP account unit. When you click on it, the account unit is accessed.
The data that is found in the directory is displayed in a tree view. Note that you see only the branches you configured.
We’re only seconds away from using accounts from the Actice Directory!
Next create a LDAP Group which represent the users as only groups can be used in the rulebase.
I want to give this group VPN access so my group is named ldap-grp_vpn_access.
Then you have to select the account unit that should be queried for the user accounts, so choose the one created before.
At last we need to define the scope of the group. A very simple approach is to use the setting All Account-Unit’ Users. With this, all users found in the Active Directory belong to this group.
But most of the time this is not the right solution as you want to limit the user access to a specific group of individuals.
So you can focus with your group on a special OU which is located in a sub tree. At this point we have the predefined branches again, that we created while adding the account unit object.
The drop down menu has the defined branches ready. Take special notice that you can’t change the branch configuration at the account unit if the branch is in use in a group!
If you configure your group this way, every user that is in or beneath this OU is considered to belong to this group.
In my example setup I want to give selective access to the VPN, so the approach with all users in one OU is not the right one.
I’m going to build a security group in the Active Directory and assign the users as members to this group, which should get access to the VPN.
The group is called VPNUser and I configure the Group in branch option to check for the users here.
Now every user that belong to VPUser can authenticate and access the VPN.
Not only the VPN, actually. This groups can be used anywhere in the rulebase, for example authentication rules etc.
That’s all for now – in a new blog entry I will cover dynamic filters, LDAP templates and so on.
Tobias Lachmann
