Web Gateway 7.1.5 Product Guide - McAfee

5
Authentication and access management
Filtering users
Options for retrieving user information
This section explains how to retrieve information for authenticating users yourself instead of having
them provided by the default process.
You might want to use the options described here when dealing, for example, with user requests that
provide no header information on the user name and password, or when you use an authentication
method, such as Kerberos, that provides no user group information.
Filling the Authentication.RawCredentials property with values
Configuring authentication basically means to configure a rule that evaluates user credentials, using the
Authentication.Authenticate property, and executes the Authenticate action, which asks a user to
submit credentials if the evaluation shows that this user is not authenticated.
Note: The logon window for submitting authentication credentials is presented to the user by the
Authenticate action. This is not part of processing the Authentication.Authenticate property, which is only the
criteria that must be matched to let the Authenticate action be executed.
The Authentication.Authenticate property gets the credentials it evaluates from the
Authentication.RawCredentials property. This property is internally “filled” with these values by the
proxy module. The proxy module gets the values from the relevant header of the request that a user
sends.
You can fill the Authentication.RawCredentials property with a user name and password yourself. For
this purpose, you need to encode these values in Base64 format.
You might do this to handle requests that do not include a header with user name and password.
However, if you know that a given user sends requests from a client with a particular IP address, you
can configure a rule that sets the Authentication.RawCredentials property to the relevant user name
and password when a request with that address is received.
Another rule, which includes the Authentication.Authenticate property, can then evaluate the
credentials and eventually execute the Authenticate action.
The two rules could look as follows:
Name
Set values for Authentication.RawCredentials
Criteria Action Event
Client.IP equals 10.143.104.45 –> Continue — Set Authentication.RawCredentials =
“Basic Ym9ic21pdGg6dGVzdHBhc3M=”
and:
Name
Authenticate with User Database
Criteria Action
Authentication.Authenticate equals false –> Authenticate
122 McAfee Web Gateway 7.1.5 Product Guide