Re: [FW-1] authentication using Active Directory and certificates

[t-systems-fitz <t-systems-fitz@FW1-NOSPAMWEB.DE>]

Hi Vaclav,

if you use certificates, the management server use the dn of the certificate
as username and makes a ldapsearch for it in the AD.
So let say the dn of the certificate is CN=Smith
John,email=John.Smith@dns.cz, then FW1 would make an ldapsearch for this
user in the configured ldapbranch.
If you don't use ldap over ssl, sniff the network traffic of the ldapsearch
and the ldapanswer of the AD-Server and you will see your problem.

mfg fitz, CCSE

>Hi,
>I have a problem with SecuRemote authentication on Firewall-1 NG FP2. I am
using Active Directory as an LDAP server and a Microsoft CA. The IKE
>password authentication works fine but when I try to authenticate by a
certificate SecuRemote says that the user is unknown.
>Thanks for any advice.
>Vaclav Brozik

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================