To use an Active Directory server to authenticate users, when you configure the settings for your Management Server you must define the connection information for the Active Directory server.
Although the primary administrator account is always managed by the Management Server, you can use an Active Directory server to manage other user accounts. Then, when a user from an external authentication server logs in to the Management Server, the server sends that information to the external Active Directory server. The Active Directory server tells the Management Server whether the user is valid and to what groups he or she belongs. The Management Server then compares the user and groups with its list of users and groups and the role policies they are associated with.
Before you can use the users and groups from your Active Directory server for role-based administration, you must enable your Management Server to connect to your Active Directory server. You must also specify at least one Active Directory domain with correct Service Records (SRV), and make sure that LDAPS is enabled on your Active Directory server. To connect to the Active Directory server for LDAPS authentication, the Management Server submits a DNS query to the domain specified for the server.
To make a secure connection to your Active Directory server, your Management Server must be able to validate the SSL server certificate your Active Directory server uses. SSL certificates that are signed by most well-known, public Certificate Authorities (CAs) are automatically trusted. For the list of trusted public Certificate Authorities, see the readme.txt file on the computer where the Management Server is installed, in this location: C:\ProgramData\WatchGuard\wgauth\certs\readme.txt. Tip!
To use a certificate signed by a private CA that is not in the list, you must import the CA certificate to the Management Server, as described in the procedure below. It is not necessary to import any intermediate certificates to the Management Server. The Management Server receives the server certificate and intermediate certificates from the Active Directory Server. The Management Server uses the root CA certificate to validate the certificate chain.
To use Active Directory authentication with your Management Server, you must enable LDAPS (LDAP over SSL) in the Active Directory domain. For more information, see the Microsoft website or review the documentation for your Active Directory server.
To enable and configure Active Directory authentication, from WatchGuard Server Center:
- In the Servers tree, select Management Server.
- Select the Active Directory tab.
The Active Directory page appears. - Select the Enable Active Directory authentication check box.
- To add, edit, or remove a domain in the Domain Name list, click Add / Remove. You can have multiple domain names in this list.
The Add Domains dialog box appears.
- To add a domain name to the list, in the Specify domain name text box, type the Active Directory domain.
Make sure to specify the same domain in the SRV record for your Active Directory server. Tip!
The Active Directory domain controller uses SSL to connect to the Active Directory server. - Click Add.
- To add more domain names to the list, repeat Steps 4–6.
- To remove a domain name from the list, select a domain name in the list and click Remove.
- Click OK to close the Add Domains dialog box.
The domain names you selected appear in the Domain Name list. - To verify the SSL certificate, select the Validate the domain controller's SSL certificate check box.
- To import a CA certificate, click Import and browse to select the CA certificate file.
- To test your connection for Active Directory authentication, click Test.
The AD Authentication Test dialog box appears.
- In the AD Authentication Test dialog box , type the user credentials for the test connection to your Active Directory server.
Make sure to type the user name in the UPN format [email protected]. - Click OK.
The Management Server tests the connection to your Active Directory server. - Click Apply to save your changes.