SSO Transparent Authentication "How To"

Here is the entire Configuration in a nut shell. Please undo everything you did with SSO client. One of the best things i Like about the XG firewall SSO is it never uses/exchanges users "Password" with the AD in the whole Client less SSO process

1. You need to Integrate the Active Directory with the XG firewall and make sure the integration is successful.
community.sophos.com/.../123155 (Using SSL for integration is an optional config, I recommend use the normal config and if this document works try implementing the SSL)

2. How do you test if the integration is successful? just login to http://firewallip:8090 and authenticate with a user and verify if its successful and if the user is falling in the correct group in the XG firewall. you can check this under System --> Authentication --> Users

3. Follow this document from there on
community.sophos.com/.../123156

The only place where you might the problem is when you start the STAS service you might see a logon failure you need have to go to services and open the properties of the STAS and under logon (Re enter the password)

Make sure the WMI polling is working from the Active Directory, you can check it from the advanced tab on the STAS suite or from the windows machine itself

Start --> Run --> wbemtest.exe ==> \\ipofworkstation\root\cimv2 --> Query --> select username from win32_computersystem --> Click on Win32 computersystem = Nokey and properties you should see the username.

Note: WMI should be successful for the STAS to work smoothly because the STAS uses WMI as a log off mechanism to verify the users

Please let me know if you have an issue even after I can give you further instructions.

Thanks,
Kranthi

Here is the entire Configuration in a nut shell. Please undo everything you did with SSO client. One of the best things i Like about the XG firewall SSO is it never uses/exchanges users "Password" with the AD in the whole Client less SSO process

1. You need to Integrate the Active Directory with the XG firewall and make sure the integration is successful.
community.sophos.com/.../123155 (Using SSL for integration is an optional config, I recommend use the normal config and if this document works try implementing the SSL)

2. How do you test if the integration is successful? just login to http://firewallip:8090 and authenticate with a user and verify if its successful and if the user is falling in the correct group in the XG firewall. you can check this under System --> Authentication --> Users

3. Follow this document from there on
community.sophos.com/.../123156

The only place where you might the problem is when you start the STAS service you might see a logon failure you need have to go to services and open the properties of the STAS and under logon (Re enter the password)

Make sure the WMI polling is working from the Active Directory, you can check it from the advanced tab on the STAS suite or from the windows machine itself

Start --> Run --> wbemtest.exe ==> \\ipofworkstation\root\cimv2 --> Query --> select username from win32_computersystem --> Click on Win32 computersystem = Nokey and properties you should see the username.

Note: WMI should be successful for the STAS to work smoothly because the STAS uses WMI as a log off mechanism to verify the users

Please let me know if you have an issue even after I can give you further instructions.

Thanks,
Kranthi

Hello Kranthi,
this is a very good guide.
The access to the Internet only works when the user once authenticate on http://IPADRESS-FW:8090. Then the users are created on the firewall. And from then does the Internet access.
Why it does not work automatically ?. Do you have any idea?
Best regards Eugen

Hey Kranthi,

I've followed these steps exactly.  everything appears to have installed and started up correctly, no errors.  but when, I look at my reports I still don't see usernames attached to the web activity.  right now, I am the only "user" who is connected to the XG unit for set up purposes. 

I am browsing web with no errors and I'm not seeing the captive portal at all. but again, not seeing username in the reports/logs.

I have run all of the tests in the STAS against my workstation and all checks out fine with no errors.

any other config changes or troubleshooting ideas would be appreciated.

 

Hi Kranthi Yadlapudi,

I have an issue installing the STAS Suite on Windows Server 2008. When installing, it fails saying “Could not install STAS Service”. Re-installing the suite does not cause the error to pop up again, but when looking under windows services, the service is still not there.

Why does the service not install? I am logged in as an administrator.

Kind Regards,

Werner