Symantec™ Security Gateways Reference Guide - Sawmill

78 Controlling user accessAuthenticationFigure 6-1 shows the different types of users and their location with respect to the security gateway.Figure 6-1Types of usersAuthenticationAuthentication in rulesAuthentication methodsShould you create a user account for everyone who works at your company? No. In a private network,trusted users typically do not interface with the security gateway when accessing protected networkresources and services. But, external users, both static and dynamic, do pass through the security gatewayand require authentication.Depending on the type of user, user accounts are created in different locations. For static users, theadministrator defines the user on the security gateway. Static users are then authenticated by the securitygateway. For dynamic users, the administrator links the users to the authentication server. Theauthentication server contains the actual user account.Authentication creates an additional layer of security by requiring connecting users to verify their identity.Authentication is used to enhance access control for other aspects of the security gateway configuration,such as proxy rules. Generally, records are entered into a database and these records are used to verifyidentities and establish a security context for the connection.To support authentication methods that require them, the security gateway prompts for a user name andpassword. If the security gateway recognizes the user name, that user must be a gateway user. The securitygateway authenticates the user as defined in the rule. If the security gateway does not recognize the username, the security gateway assumes the user is dynamic and contacts the authentication server or serversdefined in the rule. Normally, dynamic authentication requires additional configuration settings, and is notset up simply by creating a rule.The security gateway supports several distinct authentication methods. Each has its own database andprotocol for establishing a security context. Some supported methods are third-party products managedexternal to the security gateway. The security gateway makes use of them as it would any application. Morethan one mechanism is queried in the course of an authentication decision.