User Verification and Key Concepts

user verification is the process that is supported to identifying a user, authorize and then determine whether a user can take specific actions the following sections describe the concept and steps behind how user role, sign in policy and authentication work in ivanti connect secure verifying user accessibility before you access your device, you need to create a user account in the system authentication server for verifying the user accessibility after creating the account through the admin console, sign in as the user on the user sign in page to verify user accessibility from the admin console, choose authentication > auth servers select the system local link select the users tab click new type testuser1 as the username and enter a password, and then click save changes the testuser1 account is now created use another browser window to enter the machine's url to access the user sign in page the url is in the format https //a b c d, where a b c d is the machine ip address you entered in the serial console when you initially configured your device click yes when prompted with the security alert to proceed without a signed certificate the user sign in page appears, indicating that you have successfully connected to your device enter the username and password you created for the user account and then click sign in to access the home page for users enter the url to an internal web server in the address box and click browse the ics opens the web page in the same browser window, so to return to the ics home page, click the center button on the toolbar that appears on the target web page enter the url to your external corporate site on the ics home page, and click browse a web page opens in the same browser window, so use the button on the toolbar to return to the ics home page click browsing > windows files on the ics home page to browse through available windows file shares creating a test scenario to learn concepts and best practices the ics provides a flexible access management system that makes it easy to customize a user's remote access experience with roles, resource policies, authentication servers, authentication realms, and sign in policies to enable you to quickly begin working with these entities, your device ships with ics defaults for each entity that you will work with you can create each access management entity by performing the tasks in the following sub sections the ics supports two types of users administrators an administrator is a person who may view or modify ics's configuration settings you create the first administrator account through the serial console users a user is a person who uses the ics to gain access to corporate resources as configured by an administrator defining a user role your device is preconfigured with one user role called “users ” this predefined role enables the web and file browsing access features, enabling any user mapped to the users role to access the internet, corporate web servers, and any available windows file servers you can view this role on the user roles page after you enable an access feature for a role, configure the appropriate corresponding options that are accessible from the access feature's configuration tab to define a user role in the admin console, choose users > user roles click new role enter test role in the name box and then click save changes wait for the ics to display the test role page with the general tab and overview link selected select the web check box under access features and then click save changes select web > options select user can type urls in the ive browse bar check box, and then click save changes after completing these steps, you have defined a user role when you create resource profiles, you can apply them to this role you can also map users to this role through role mapping rules defined for an authentication realm to quickly create a user role that enables web and file browsing, duplicate the users role, and then enable additional access features as desired defining a resource profile a resource profile is a set of configuration options that contain all the resource policies, role assignments, and end user bookmarks required to provide access to an individual resource within a resource profile, a resource policy specifies the resources to which the policy applies (such as urls, servers, and files) and whether the ics grants access to a resource or performs an action note that the ics is preconfigured with two types of resource policies web access the predefined web access resource policy, initial policy for local resources, allows access only to hosts belonging to domains within the secured network for a fresh installation, this predefined "initial policy for local resources" policy is in "deny" state by default to allow access to ipv6 hosts belonging to domains within the secured network, add the \[fd00 /8] / resource to the predefined web access resource policy, if not present already windows access the predefined windows access resource policy enables all users mapped to the users role to access all corporate windows file servers by default, this resource policy applies to the users role for a fresh installation, this predefined "initial file browsing policy" is in "deny" state by default delete the windows access resource policies if you are concerned about users having access to all your web and file content to define a resource profile in the admin console, choose users > resource profiles > web click new profile the web applications resource profile page appears fill in the following information in the type box, keep the default option ( custom ) in the name box, type test web access in the base url box, type http //www google com https //www google com/?gws rd=ssl under autopolicy web access control , select the check box next to the default policy (http //www google com 80/ ) and choose delete in the resource box, type http //www google com, https //www google com/?gws rd=ssl select deny from the action list, and click add click save and continue the test web access page appears click the roles tab select test role in the available roles box and click add to move it to the selected roles box click save changes the ics adds test web access to the web application resource policies page and automatically creates a corresponding bookmark that links to google com after completing these steps, you have configured a web access resource profile even though the ics comes with a resource policy that enables access to all web resources, users mapped to test role are still prohibited from accessing http //www google com https //www google com/?gws rd=ssl these users are denied access because the auto policy you created during the resource profile configuration takes precedence over the default web access policy that comes with the ics defining an authentication server an authentication server is a database that stores user credentials username and password and typically group and attribute information when a user signs into the host, the user specifies an authentication realm, which is associated with an authentication server the ics forwards the user's credentials to this authentication server to verify the user's identity the ics supports the most common authentication servers, including active directory, radius, ldap, rsa ace/server, and saml server, and enables you to create one or more local databases of users who are authenticated the ics is pre configured with one local authentication server for users called “system local ” this predefined local authentication server is a system database that enables you to quickly create user accounts for user authentication this ability provides flexibility for testing purposes and for providing third party access by eliminating the need to create user accounts in an external authentication server you can view the default local authentication server on the authentication servers page the ics also supports authorization servers an authorization server (or directory server) is a database that stores user attribute and group information you can configure an authentication realm to use a directory server to retrieve user attribute or group information for use in role mapping rules and resource policies to define an authentication server in the admin console, choose authentication > auth servers select local authentication from the new list and then click new server the new local authentication page appears enter test server in the name box and then click save changes wait for the ics to notify you that the changes are saved, after which additional configuration tabs appear click the users tab and then click new the new local user page appears enter testuser2 in the username box, enter a password, and then click save changes to create the user's account in the test server authentication server after completing these steps, you have created an authentication server that contains one user account this user can sign in to an authentication realm that uses the test server authentication server the admin console provides last access statistics for each user account on the respective authentication server pages, on the users tab under a set of columns titled last sign in statistic the statistics reported include the last successful sign in date and time for each user, the user's ip address, and the agent or browser type and version defining an authentication realm an authentication realm is a grouping of authentication resources, including an authentication server, which verifies a user's identity the ics forwards credentials submitted on a sign in page to an authentication server an authentication policy, which specifies realm security requirements that need to be met before the ics submits credentials to an authentication server for verification a directory server, which is an ldap server that provides user and group attribute information to the ics for use in role mapping rules and resource policies (optional) role mapping rules, which are conditions a user must meet for the ics to map a user to one or more roles these conditions are based on information returned by the realm's directory server, the person's username, or certificate attributes your ics is pre configured with one user realm called “users ” this predefined realm uses the system local authentication server, an authentication policy that requires a minimum password length of four characters, no directory server, and contains one role mapping rule that maps all users who sign in to the users realm to the users role the “testuser1” account you created is part of the users realm, because this account is created in the system local authentication server the “testuser2” account you created is not part of the users realm, because you create the user account in the new “test server” authentication server, which is not used by the users realm you can view the default user authentication realm on the user authentication realms page to define an authentication realm in the admin console, choose users > user realms the user authentication realms page appears click new the new authentication realm page appears enter test realm in the name box select test server from the authentication list click save changes wait for the ics to notify you that the changes are saved and to display the realm's configuration tabs click the role mapping tab if it is not already selected, and then click new rul e the role mapping rule page appears enter testuser2 in the text box under “ then assign these roles ” , select test role from the available roles list and click add to move it to the selected roles box click save changes after completing these steps, you have finished creating an authentication realm this realm uses test server to authenticate users and a role mapping rule to map testuser2 to test role because the test web access resource policy applies to test role, any user mapped to this role cannot access http //www google com defining a sign in policy a sign in policy is a system rule that specifies a url where a user may sign in to the host a sign in page to display to the user whether or not the user needs to type or select an authentication realm to which the ics submits credentials the authentication realms where the sign in policy applies to define a sign in policy in the admin console, choose authentication > signing in > sign in policies the signing in page appears click / under user urls the / page appears enter test after / in the sign in url box under authentication realm, select the user picks from a list of authentication realms option button select test realm from the available realms list click add to move it to the selected realms box (repeat this process for the users role if it is not already in the selected realms box ) click save changes after completing these steps, you have finished modifying the default users sign in policy optional steps you can perform these following optional steps to define a new sign in page that is associated with the /test/ sign in policy select authentication > signing in > sign in pages, and then click new page enter test sign in page in the name field, type #ff0000 (red) in the background color box, and then click save changes select authentication > signing in > signing in policies , and then click new url the new sign in policy page appears type /test/ in the sign in url box select default sign in page from the sign in page list, and click save changes select authentication > signing in > sign in policies , and then click /test/ under user urls the /test/ page appears select test sign in page from the sign in page list and then click save changes all ics devices are pre configured with one sign in policy that applies to users / this default user sign in policy ( /) specifies that when a user enters the url to the host, it displays the default sign in page for the user and requires the user to select an authentication realm (if more than one realm exists) the / sign in policy is configured to apply to the users authentication realm, therefore this sign in policy does not apply to the authentication realm you created using the test scenario the test scenario enables you to do the following tasks access the user console using the modified default sign in policy sign in as the user created in the test server to map to the test realm test your web browsing capabilities, which are dependent upon the proper configuration of test role and test web access to use the test scenario in a browser, enter the user url followed by /test to access the user sign in page the url is in the format https //a b c d/test, where a b c d is the machine ip address you entered in the serial console during initial configuration click yes when prompted with the security alert to proceed without a signed certificate if the user sign in page appears, you have successfully connected to your device if you performed the optional configuration steps in "defining a sign in policy", the header color is red enter the username and password you created for the user account in test server, type test realm in the realm box, and then click sign in to access the ics home page for users the ics forwards the credentials to test realm, which is configured to use test server upon successful verification by this authentication server, the ics processes the role mapping rule defined for test realm, which maps testuser2 to test role test role enables web browsing for users in the browser address bar, enter the url to your corporate web site and click browse the web page opens in the same browser window, so to return to the ics home page, click the home icon in the browsing toolbar that appears on the target web page on the ics home page, type www google com and click browse an error message appears because the test web access resource policy denies access to this site for users mapped to test role return to the ics home page, click sign out , and then return to the user sign in page enter the credentials for testuser1, specify the users realm, and then click sign in on the ics home page, type www google com and click browse the web page opens in the same browser window the test scenario demonstrates the basic access management mechanisms you can create very sophisticated role mapping rules and resource policies that control user access depending on factors such as a realm's authentication policy, a user's group membership, and other variables to learn more about access management, we recommend that you take a few minutes to review the online help to familiarize yourself with its contents when you configure your device for your enterprise, we recommend that you perform user access configuration before you make your device available from external locations, we recommend that you import a signed digital certificate from a trusted certificate authority (ca) default settings for administrators just like for users, the ics provides default settings that enable you to quickly configure accounts for administrators this list summarizes the ics default settings for administrators administrator roles there are two built in administrator roles administrators this built in role permits administrators to manage all aspects of the device the administrator user you create through the serial console is mapped to this role read only administrators this built in role permits users mapped to the role to view (but not configure) all settings you need to map administrators to this role if you want to restrict their access administrator local authentication server is a database that stores administrator accounts you create the first administrator account in this server through the serial console (all administrator accounts created through the serial console are added to this server ) you cannot delete this local server admin users authentication realm uses the default administrators local authentication server, an authentication policy that requires a minimum password length of 10 characters, no directory server, and one role mapping rule that maps all users who sign in to the admin users realm to the administrators role the administrator account you create through the serial console is part of the admin users realm minimum password length should be 10 characters when deploying ics va on azure cloud or aws cloud /admin sign in policy is the default administrator sign in policy the /admin specifies that when a user enters the url to the host followed by /admin, the ics displays the default sign in page for administrators this policy also requires the administrator to select an authentication realm (if more than one realm exists) the /admin sign in policy is configured to apply to the admin users authentication realm, therefore this sign in policy applies to the administrator account you create through the serial console