[FW-1] authentication: which SDK should I use?

["Wilson, Jeff" <Jeff_Wilson@FW1-NOSPAMBAYLOR.EDU>]

I want to automate authentication to Checkpoint.  Out of frustration,
I've written a GUI client that merely scripts the telnet session to port
259.  This is STUPID, since passwords cross the wire in clear text.  It
approaches INSANE when wireless access points get involved.

I do not want to use VPN to authenticate because of the number of users
(PocketPC, MacOS, Linux, all flavors of WinTel).  I would like to have a
server based authentication (such as a CGI script running over SSL).  My
idea is to utilize some OPSEC SDK to insert authenticated users into
Checkpoint's state table after they satisfy my SSL/CGI authentication
scheme.  (A side benefit is that this approach gets me out of the client
development business:  for every platform that has an SSL-capable
browser, I can provide access!)

>From what I have read of the SDKs, it looks like this kind of "front
end" authentication is not supported.  As far as I can tell, all that
the SDKs support are "back end" solutions (support for RADIUS
development, or something similar).  Am I misunderstanding?  Can someone
point me in the right direction?  So far, all that Checkpoint will tell
me is, "Use our VPN client."  No thanks.

<client>  -->  <my-auth-server>  -->  <firewall-1>  -->  <radius>  -->
<ldap>

Help?

 Regards,
 Jeff Wilson
 Baylor University, Waco, TX
 Student Technology Services=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================