Avaya Secure Remote Access Bedienungsanleitung PDF herunterladen (Seite 15)

Secure Remote Access Technical Solution Guide v1.0

______________________________________________________________________________________________________

Design Recommendation: Use single-sign-on capabilities but restrict servers and domains to

which the VPN Gateway passes credentials, to prevent password stealing from non-approved

hosts.

When using token-based two-factor authentication systems that use a one-time password, the

credentials cannot be reused for applications that also require OTP authentication. In this case,

the solution supports several interworking options with third-party products that can insert a

cookie in the browser with an encrypted authentication token after the OTP VPN logon step.

This cookie is then inspected by the compatible applications to allow access. This solution

combines the benefits of OTP/two-factor authentication with web-based single sign-on.

Supported third-party products include Computer Associates SiteMinder and RSA ClearTrust.

You can also combine OTP/two-factor VPN logon with standard username/password reusable

credentials for intranet application single sign-on. In this case, use the Secondary Authentication

option to allow the user to provide both OTP and reusable credentials at VPN logon.

4.2.1.2 Authorization

The authorization process determines which specific resources can be accessed by an

authenticated user.

4.2.1.2.1 Group model

The group model is fundamental to authorizing user access to intranet resources. During the

authentication process, a user is associated with one or more groups. Each group is associated

with unique:

Portal links to applications and file-sharing directories

Access control lists, including destination subnet addresses, HTTP URL paths, and

destination hostnames

TunnelGuard endpoint compliance policies

IP pool addresses for IPsec and NetDirect clients

Permitted access modes (IPsec, SSL)

Session and idle timeout values

If a user belongs to more than one group, the group settings are logically joined so that the user

sees all appropriate portal links and has access to all appropriate resources for the set of groups.

1 2 ... 10 11 12 13 14 15 16 17 18 19 20 ... 32 33

Keine Kommentare

Avaya Secure Remote Access Bedienungsanleitung Seite 15