McAfee EPOCDE-AA-BA Product Guide - Page 55

Configuring advanced server settings Configuring Active Directory user login 7 • Users provide valid credentials, using the format. For example, a user with Windows credentials jsmith1, who is a member of the Windows domain named eng, would supply the following credentials: eng\jsmith1, along with the appropriate password. • An Active Directory server that contains information about this user has been registered with ePolicy Orchestrator. • The user is a member of at least one Domain Local or Domain Global group that maps to an McAfee ePO permission set. Windows authentication and authorization strategies There are a variety of approaches you can take when planning how to register your LDAP servers. Taking the time in advance to plan your server registration strategy will help you get it right the first time and reduce user authentication problems. Ideally, this is a process you go through once, and only change if your overall network topology changes. Once servers are registered and Windows authentication configured, you shouldn't need to modify these settings very often. Authentication versus authorization Authentication involves verifying the user's identity. This is the process of matching the credentials supplied by the user to something the system trusts as authentic. This could be an ePolicy Orchestrator server account, Active Directory credentials, or a certificate. If you want to use Windows authentication, you will need to examine how the domains (or servers) containing your user accounts are organized. Authorization is after you've verified the user's credentials. This is where permission sets are applied, determining what the user can do within the system. When using Windows authentication, you can determine what users from different domains should be authorized to do. This is done by attaching permission sets to groups contained within these domains. User account network topology How much effort will be required to fully configure Windows authentication and authorization depends on your network topology, and the distribution of user accounts across your network. • If the credentials for your prospective users are all contained in a small set of domains (or servers) contained within a single domain tree, merely register the root of that tree, and you're done. • If your user accounts are more spread out, you will need to register a number of servers or domains. Determine the minimum number of domain (or server) sub-trees you will need and register the roots of those trees. Try to register them in the order they'll be most used. As the authentication process goes down the list of domains (or servers) in the order they're listed, putting the most commonly used domains at the top of the list will improve average authentication performance. Permission structure For users to be able to log on to an ePolicy Orchestrator server using Windows authentication, a permission set must be attached to the Active Directory group their account belongs to on their domain. When determining how permission sets should be assigned, keep in mind the following capabilities: • Permission sets can be assigned to multiple Active Directory groups. • Permission sets can be dynamically assigned only to an entire Active Directory group. They cannot be assigned to just some users within a group. McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 55