Authentication with AD based on groups

RE: Authentication with AD based on groups

Paul Nikelson — Fri, 12 Oct 2018 12:11:20 GMT

Thank you!! I wanted to do the same something in my site: https://descargar-geometrydash.com/ and I could do it.

Now, I will try to replicate to other sites I am managing.

RE: Authentication with AD based on groups

Michael Dunn — Mon, 06 Nov 2017 09:39:52 GMT

Go to the Policy Test menu item. Enter in the destination and user name and test.

If the "Policy" that it hits is Default Policy, then you have a problem with Default Groups.

If the Policy is the name of one of your additional policies, you have a problem with that one, check the first tab.

RE: Authentication with AD based on groups

ChristianZittar — Sun, 05 Nov 2017 05:03:24 GMT

Dear Michael,

thanks for the informations.

Under Default Groups I have selected the radio button, Only selectewd Entries

Under System Authentication is Block Access

Under Recent Activity Search I have the usernames.

RE: Authentication with AD based on groups

Michael Dunn — Fri, 03 Nov 2017 15:41:34 GMT

Under Default Groups, make sure that your radio button is selected as you are trying to configure.

Under System Authentication, authentication failure, make sure that you Block access.

If it is still allowing access that it shouldn't, under the Recent Activity Search, is it showing the usernames or the IPs?

RE: Authentication with AD based on groups

ChristianZittar — Tue, 31 Oct 2017 03:51:47 GMT

Thanks Karlos,

I saw the points in the menus.

But one question is coming up everytime:

Why does everyone has access to the internet although I configured in the Group Policy default groups menu, that only specific groups are allowed to!?

But I have users which are not member of this group ghttp which are still allowed to access the internet....

Any thoughts?

Or is your suggestion to fix it with additional Policy my solution already?

Thanks in advance,

Holger

RE: Authentication with AD based on groups

Karlos — Mon, 30 Oct 2017 18:42:22 GMT

Hi Holger,

There's several ways to achieve this goal, here is one way:

First, make sure you set up AD Authentication on your appliance:

- Sophos Web Appliance: requirements and best practices to setup authentication

- Configuring Active Directory Access

Then you can set up your default policy to block all

Lastly, you can set up an Additional Policy - specify AD group ghttp and allow the categories you would like for them to be able to access

Cheers,

Karlos