Web Gateway 7.1.5 Product Guide - McAfee

5
Filtering users
Authentication and access management
Contents
Filtering users
Standard authentication
Instant messaging authentication
Cookie authentication
Quota management
Administrator accounts
Users can be “filtered” on the appliance, which means you can allow web access only for those who are
able to authenticate. Administrators need to have accounts with roles and privileges. This gives you
control over who is active in your network.
The sections of this chapter explain the authentication process and how to configure it, for example, by
joining the appliance to a Windows domain to retrieve user information, or by using a database on an
LDAP or RADIUS server, or on another server.
They also explain how to guide users by configuring quotas for their web usage. Furthermore, they tell
you how to set up accounts and roles for administrators and grant them privileges.
Authentication process
This section explains what happens on the appliance during the authentication process. Understanding
this process should help you when you begin to configure authentication according to your own
requirements.
Authentication usually takes place in the request cycle of the filtering process. When users send
requests to the web, for example, to view a web page or download a file, the appliance intercepts these
requests and “considers” whether to block or allow them.
There can be many reasons for not allowing a request, for example, the URL of a requested website
could be on a blocking list. However, authentication usually does not look at the requested object, it
looks at the user. Can information be found in a directory or database to prove that the user can be
trusted? If yes, the user is authenticated.
This is what the authentication rules of the appliance check. A special authentication module retrieves
user information and passes it on to these rules to let them trigger actions, like asking an
unauthenticated user to authenticate or forwarding a request of an authenticated user to further
filtering. The methods the authentication module uses to retrieve the user information can be
configured under its settings.
Looking at the user need not be the only thing that happens in the authentication process. The rules for
this process can also include the checking of web objects. Then authentication can also happen in the
response cycle. For example, a rule might specify that when a web object is sent from the web in
response to a request, a user must authenticate to be allowed access to the object.
McAfee Web Gateway 7.1.5 Product Guide 119