WebAdmin - Access control - more granular settings

Have you looked at the Access Control tab of WebAdmin?   Where does User Portal play in your security plan?

Have you looked at the Access Control tab of WebAdmin?   Where does User Portal play in your security plan?

Hi,

there is no option and i do not want the users to download their config by themself.

Best regards

Stephan

I believe what you want to do is not possible, Stephan.  If Sophos Support tells you differently, please come back and let us know.

Cheers - Bob

But when this is not possible than user sync should also delete not existing or deactivated account from Sophos UTM.

Normally the people that create and delete users are not the ones administering the Firewall.

I currently have an open case with Sophos. I will create one after this one is solved ;)

Maybe the picture is not as bleak as you fear.

• All of our UTM usage, other than Admin, is linked to Active Directory users.  We use Active Directory authorization server for our primary domain, LDAP for other domans.   I have documented the LDAP setup in the Wiki.   Users do not need or receive a UTM account until they need remote access with OTP (WAF, VPN SSL, HTML5 VPN).
• For Remote Access with OTP, we add them to Active Directory groups, and then their UTM account is created when they use the User Portal to scan their QR code.  Obviously, other methods are available for issuing the QR code from WebAdmin
• At termination, disabling or deleting the Active Directory account will not remove the UTM account, but it will render it useless.
• For higher levels of automation, use the RestFUL API.    You seem to be an organization that would want to have these tasks integrated into an automated provisioning system. 

Does this help?

I already implemented the first 2 steps.

But for compliance reasons we need to delete the accounts also - i know about point 3.

I will have a look at the RestFUL API. As we are already use a script for deleting the users from AD maybe i can use this to delete also the accounts from UTM.

Thanks for your help.

Great job of hearing the question behind the question, Doug.

Cheers - Bob