This article describes how to implement single sign on authentication with Active Directory integration.

Cyberoam – ADS integration feature allows Cyberoam to map the users and groups from Active Directory for the purpose of authentication.

Prerequisites:

·       NetBIOS Domain name

·       FQDN Domain name

·       Search DN

·       Active Directory Server IP address

·       Administrator Username and Password (Active Directory Domain)

Configuring ADS authentication

Logon to Cyberoam Web Admin Console and follow the below given steps:

Step 1: Create ADS user groups

Step 2: Define Authentication parameters

Go to User>Authentication Settings

Select ‘Active Directory’ under Configure Authentication & Integration parameters

Select Default Group.

Cyberoam will create user(s) in the respective groups if groups are already created in Cyberoam otherwise user will be created in the group selected as Default group.

Click Update to save the settings

 

Step 3: Configure Cyberoam to use Active Directory

 

 

Step 5: Test Active Directory integration

Go to Help>Downloads and click HTTP to open the HTTP client login page.

Specify username and password

Single Sign on Implementation

Step 6: Use the following procedure for implementing Single Sign On (SSO) for ADS if the SSO Client is to be installed on Windows 2000, Windows XP or Windows 2003:

Step 6.2: Create directory SSOsetup and unzip SSCyberoamAutoSetup.zip.

Following files will be extracted:

1.         SSCyberoamSetup.exe

2.         SSCyberoamConfigSetup.exe

3.         SSCyberoamConfig.ini

4.         ElitecoreAdmin.exe

5.         ElitecoreRun.exe

Step 6.3: Run ElitecoreAdmin.exe to create Admin.ini file to store the user account credentials which has administrative rights (local administrative rights) for all desktop computers. Administrative right is required to run SSCyberoam setup and install Client on the user machine.

Specify username, password, and windows domain name (NetBIOS Domain Name) from where users will log on. If you do not know NetBIOS name, refer to 'Determine NetBIOS Name, FQDN and Search DN'.

This will create Admin.ini file in the SSOsetup directory.

Admin.ini file is passed as a parameter to Elitecorerun.exe to run SS Cyberoam setup.

Step 6.4: Setup your configuration in SSCyberoamConfig.ini file using following syntax:

Domain Name=xyz.com (FQDN Domain name is the domain from where users will log on)

Server=aaa.bbb.ccc.ddd (IP address of Cyberoam Interface which is connected to Active Directory)

Domain Controller=ADS

Step 6.5: Copy following files to “cyberoam” directory under “NETLOGON” of the domain controller:

1.         SSCyberoamSetup.exe

2.         SSCyberoamConfigSetup.exe

3.         SSCyberoamConfig.ini

4.         Admin.ini

5.         ElitecoreRun.exe

6.    SSCyberoam_7310.exe

You can access NETLOGON directory using: \\adsservername\netlogon

Step 6.6: Configure logon script

Log on script is executed every time user logs on to the local computer. Each user could have an individual log on script or all users could share the same logon script.

Default location of logon script: NETLOGON directory

Go to step 6.6.1 if logon script is already created

Go to step 6.6.2 if logon script is not created

Step 6.6.1: Update logon script (If logon script is already created)

Download logon script batch file 

Edit the existing logon script by using any Text Editor and add the lines specified in the batch at the end of the script.

Note:

·     Replace adsservername with the Active Directory domain controller's computer name.

·     Do not keep any space before or after any slash (\)

If all users share the common logon script then, you need to update only the common script else you need to update all the scripts created for each user.

Step 6.6.2: Create logon script (If logon script is not already created)

a) Download logon script batch file and save as “cyberoam.bat” in the NETLOGON directory

Note:

·     Replace adsservername with the Active Directory domain controller's computer name.

·     Do not keep any space before or after any slash (\)

b) Define logon script - cyberoam.bat (created in step 6.6.2) as a default logon script for all the users using following method:

Log on to Cyberoam Web Admin Console

Go to User -> Migrate Users and click "User Logon Script Updation Utility" from to download updatelogonscript.bat file

Execute this script file from the domain controller itself or any other machine which is part of the domain as follows: updatelogonscript.bat cyberoam.bat

Please note you will require administrative privilege to run the script

When the user logs on for the first time after the above configuration, logon script runs SSCyberoamSetup.exe and installs Cyberoam Single Sign On Client (Cyberoam SSO Client) on the user machine. Cyberoam will authenticate user based on the details specified in SSCyberoamConfig.ini and Windows username.

Note:

On every log on attempt, SSCyberoamSetup.exe is executed which installs Cyberoam SSO Client if Client is not available on user machine.

Step 6.7: Check whether Cyberoam SSO Client is installed and configured properly from any of the local machine.  

a) Check for “Single SignIn Cyberoam Client” folder from Start Programs. If client is installed properly, Single SignIn Cyberoam Client folder will be created.

Step 7: This completes the implementation of single sign on authentication with Active Directory integration.

Determine NetBIOS Name, FQDN and Search DN

On the ADS server:

• Go to Start>Programs > Administrative Tools > Active Directory Users and Computers
• Right Click the required domain and go to Properties tab
• Search DN will be based on the FQDN. In the given example FQDN is elitecore.com and Search DN will be DC=elitecore, DC=com