How to -_implement_single_sign_on_authentication_with_windows_nt_domain_controller_integration
How To - Implement Single Sign On authentication with Windows NT Domain Controller Integration How To - Implement Single Sign On Authentication with Windows NT Domain Controller IntegrationThis article describes how to implement single sign on authentication with Windows NT DomainController integration.Cyberoam – Windows NT Domain Controller integration feature allows Cyberoam to map the users andgroups from Windows NT Domain Controller for the purpose of authentication.Prerequisites:• NetBIOS Domain name• Windows NT Domain Controller Server IP address• Administrator Username and Password (Windows NT Domain Controller)• IP address of Cyberoam Interface connected to Windows NT Domain ControllerConfiguring Windows NT Domain Controller authenticationLogon to Cyberoam Web Admin Console and follow the below given steps:Step 1: Create Windows NT Domain groupsGo to Group> Add Group and create all the groupsFor mapping the Windows NT Domain Controller user groups with the Cyberoam user groups, create allthe Windows NT Domain Controller user groups into Cyberoam before Windows NT Domain Controllerusers log on to Cyberoam for the first time. If the Windows NT Domain Controller groups are not createdin Cyberoam, all the users will be assigned to the Default group of Cyberoam.If all the Windows NT Domain Controller user groups are created in Cyberoam before users log on toCyberoam then user will be automatically created in the respective group when they log on to Cyberoam.Step 2: Define Authentication parametersGo to User>Authentication SettingsSelect ‘Windows Domain Controller’ under Configure Authentication & Integration parametersSelect Default Group.Cyberoam will create user(s) in the respective groups if groups are already created in Cyberoamotherwise user will be created in the group selected as Default group.Click Update to save the settings
How To - Implement Single Sign On authentication with Windows NT Domain Controller IntegrationStep 3: Configure Cyberoam to use Windows NT Domain ControllerClick Add to configure Windows NT Domain Controller parametersSpecify IP address of Windows NT Domain Controller and any details if required and click OK to save thedetails.
How To - Implement Single Sign On authentication with Windows NT Domain Controller IntegrationClick the server IP address which is to be used for authentication and click Update to save theconfiguration.Step 4: Test Windows NT Domain Controller integrationGo to Help>Downloads and click HTTP to open the HTTP client login page.Specify username and passwordUsername will be displayed on User>Manage Live Users page if user is able to log on to Cyberoamsuccessfully.
How To - Implement Single Sign On authentication with Windows NT Domain Controller IntegrationSingle Sign on ImplementationStep 5: Use the following procedure for implementing Single Sign On (SSO) for Windows NT DomainController if the SSO Client is to be installed on Windows 2000, Windows XP or Windows 2003:Step 5.1: Download SSCyberoamAutoSetup.zip from Help>Download page from Cyberoam Web AdminConsole on Domain Controller or on any of the client machine which is member of Domain and has theAdministrator user privileges.Step 5.2: Create directory SSOsetup and unzip SSCyberoamAutoSetup.zip.Following files will be extracted:1. SSCyberoamSetup.exe2. SSCyberoamConfigSetup.exe3. SSCyberoamConfig.ini4. ElitecoreAdmin.exe5. ElitecoreRun.exeStep 5.3: Run ElitecoreAdmin.exe to create Admin.ini file to store the user account credentials which hasadministrative rights (local administrative rights) for all desktop computers. Administrative right is requiredto run SSCyberoam setup and install Client on the user machine.Specify username, password, and windows domain name (NetBIOS Domain Name) from where userswill log on. If you do not know NetBIOS name, refer to Determine NetBIOS Name.This will create Admin.ini file in the SSOsetup directory. NetBIOS Domain NameAdmin.ini file is passed as a parameter to Elitecorerun.exe to run SS Cyberoam setup.Step 5.4: Setup your configuration in SSCyberoamConfig.ini file using following syntax:
How To - Implement Single Sign On authentication with Windows NT Domain Controller IntegrationDomain Name=XYZ (NetBIOS Domain name is the domain from where users will log on)Server=aaa.bbb.ccc.ddd (IP address of Cyberoam Interface which is connected to Windows NTDomain Controller)Domain Controller=PDCStep 5.5: Copy following files to “cyberoam” directory under “NETLOGON” of the domain controller:1. SSCyberoamSetup.exe2. SSCyberoamConfigSetup.exe3. SSCyberoamConfig.ini4. Admin.ini5. ElitecoreRun.exeYou can access NETLOGON directory using: pdcservernamenetlogonStep 5.6: Configure logon scriptLog on script is executed every time user logs on to the local computer. Each user could have anindividual log on script or all users could share the same logon script.Default location of logon script: NETLOGON directoryGo to step 5.6.1 if logon script is already createdGo to step 5.6.2 if logon script is not createdStep 5.6.1: Update logon script (If logon script is already created)Download the logon script batch file from http://kb.cyberoam.com/redirfile.asp?id=511&SID=Edit the existing logon script by using any Text Editor and add the lines specified in the batch at the endof the script.Note: • Replace pdcservername with the Windows NT Domain Controllers computer name. • Do not keep any space before or after any slash ()If all users share the common logon script then, you need to update only the common script else youneed to update all the scripts created for each user.Step 5.6.2: Create logon script (If logon script is not already created)a) Download the batch file from http://kb.cyberoam.com/redirfile.asp?id=511&SID= and save as“cyberoam.bat” in the NETLOGON directoryNote: • Replace pdcservername with the Windows NT Domain Controller’s computer name. • Do not keep any space before or after any slash ()b) Define logon script - cyberoam.bat (created in step 5.6.2) as a default logon script for all the usersusing following method:Log on to Cyberoam Web Admin ConsoleGo to User -> Migrate Users and click "User Logon Script Updation Utility" from to downloadupdatelogonscript.bat fileExecute this script file from the domain controller itself or any other machine which is part of the domainas follows: updatelogonscript.bat cyberoam.batPlease note you will require administrative privilege to run the script
How To - Implement Single Sign On authentication with Windows NT Domain Controller IntegrationWhen the user logs on for the first time after the above configuration, logon script runsSSCyberoamSetup.exe and installs Cyberoam Single Sign On Client (Cyberoam SSO Client) on the usermachine. Cyberoam will authenticate user based on the details specified in SSCyberoamConfig.ini andWindows username. Note: On every log on attempt, SSCyberoamSetup.exe is executed which installs Cyberoam SSO Client if Client is not available on user machine.Whenever the User tries to logon in Windows, the script “defaultlogonscript.bat” will be executed which inturn executes the Cyberoam logon program with the Windows Username and automatically logs in Userto the Cyberoam.If the User has logged in successfully using Single Sign on utility, then (S) will be shown next to theUsername e.g. Joe (S) in the Live User listStep 5.7: Check whether Cyberoam SSO Client is installed and configured properly from any of the localmachine.a) Check for “Single SignIn Cyberoam Client” folder from Start Programs. If client is installed properly,Single SignIn Cyberoam Client folder will be created.b) Check SSO version and server IP address fromHKEY_LOCAL_MACHINE/SOFTWARE/eLitecore/Cyberoam of the registry of the local machine.
How To - Implement Single Sign On authentication with Windows NT Domain Controller IntegrationStep 6: This completes the implementation of single sign on authentication with Windows NT DomainController integration.
How To - Implement Single Sign On authentication with Windows NT Domain Controller IntegrationDetermine NetBIOS Domain NameOn the Desktop of Domain Controller: • Go to Network Neighborhood ➞ Properties ➞ Identification tab NetBIOS Domain Name Document version:2.0-16/07/2007