Add, edit or delete an Active Directory

This article applies to our On-Premise Appliance Filter and Firewall product only, not to Cloud.

 

You can add an Active Directory to your list of Directories.

Before you begin

Appliance hostname

If you have only one domain, we recommend that the appliance hostname is on the Active Directory domain, for example if using domain.local the appliance could be called appliance.domain.local

Change the hostname if required. You will need to update your Certificates.

Conditional DNS Forwarding

Ensure you have Conditional DNS Forwarders configured for your domain:

  • Add the IP address of a domain DNS server, and a domain declaration in the domain.local format.
  • Optionally, add any reverse DNS addresses into the Domains field - for example: 168.192.in-addr.arpa

In Active Directory

Decide which user account in Active Directory to use for the setup.

  • We recommend creating a new standard user account for this purpose, with a password that does not expire.
  • It should not be an existing domain administrator.
  • It must have permission to modify the Computer’s container, including being able to create keytab files across the domain or forest.

Time

To prevent syncing issues, ensure the time set on your Smoothwall appliance matches the time set in your Active Directory server.

Manage Active Directory on your Smoothwall appliance

Add an Active directory

  1. Go to Services > Authentication > Directories.
  2. Select Add new directory.
  3. Ensure the Enabled checkbox is selected.
  4. If in a multi-tenant environment, select the tenant.
  5. Select the Type as Active Directory.
  6. Enter the full DNS Domain name. Other trusted domains are allowed access automatically.
  7. Enter the Username and Password of the user account and re-enter the password to make sure it is correct.
  8. To change caching behaviour, select Advanced options.
    • Cache timeout (minutes) is the time the Smoothwall appliance keeps a record of directory-authenticated users in its cache. The default is 10 minutes, or you can amend this.
    • Select the Cache Kerberos PAC groups Enabled checkbox to permanently cache group membership information from Kerberos tickets.
  9. Optionally, enter a comment.
  10. Select Add.

Edit or delete an Active directory

Go to Services > Authentication > Directories, hover over the directory and select Edit or Delete.

You can clear the Enabled box to keep the directory but not use it in Smoothwall.

If using Negotiate login (Kerberos login) or Negotiate in-line (Kerberos in-line)

After deleting the Active Directory, or clearing the Enabled checkbox, if you use Negotiate login and have applied the script outlined here, or use Negotiate in-line as your authentication method, you will also need to delete your account from your Active Directory controllers.

  1. Search for the Smoothwall computername on all Active Directory controllers.
  2. Find the computer account and delete it.
  3. Wait 10 minutes, then search again to check it was deleted as expected.

If you need to enable an Active Directory connection with the Smoothwall appliance again:

  1. Add the Username and Password for any new service users to the Active Directory in Smoothwall.
  2. If a hostname change is required, change the hostname. You will need to update your Certificates.
  3. Select the Enabled checkbox for the Active Directory in Smoothwall again.

Next step

You must map your Directory User Groups to the Smoothwall User Groups to authenticate users and apply Web Filter Policies.