TRITON - Web Security Help, Version 7.7 - Websense

User IdentificationIdentification of hybrid filtering usersTRITON - Web Security Help | Web Security Solutions | Version 7.7.xRelated topics: Websense Directory Agent, page 330 When users are not identified, page 332 Authentication priority and overrides, page 324 Working with hybrid filtering clients, page 88Select Settings > Hybrid Configuration > Hybrid User Identification to configurehow users are identified by the hybrid service, and to test and configure users’connections to the service. You can configure multiple authentication or identificationoptions for your hybrid users if required.To ensure that the appropriate per-user or per-group policy is applied to hybridfiltering users, whether from a filtered location or when off-site, Websense WebSecurity Gateway Anywhere provides options for identifying hybrid filtering userstransparently:Websense Web Endpoint is installed on client machines to provide transparentauthentication, enforce use of hybrid filtering, and pass authentication details tothe hybrid service. See Web Endpoint deployment overview, page 325.Websense Authentication Service provides clientless transparent authenticationvia a gateway hosted on your network. See Deploying Websense AuthenticationService, page 328.If you do not deploy either Web Endpoint or Authentication Service, the hybridservice can identify users transparently or manually when they connect to hybridfiltering.Users can only be identified transparently via NTLM if they are logging on from aknown IP address, defined as a filtered location (see Define filtered locations,page 211). Note that NTLM identification is not available for off site users.The hybrid service can be configured to automatically generate passwords for allusers whose information is collected by Directory Agent (see Configure useraccess to hybrid filtering, page 220).If you do not enable any form of transparent authentication:• Off site users without Web Endpoint or Authentication Service are promptedfor an email address and password when they open a browser and connect tothe Internet.• Other hybrid filtering users are filtered based on their IP address if WebEndpoint, Authentication Service, or NTLM identification are not available.Indicate how the hybrid service should identify users requesting Internet access. Theseoptions are also used as a fallback if either the endpoint or Authentication Servicefails.322 Websense Web Security Solutions