topic Re: Identity Collector Single User assumption in Firewall and Security Management

Identity Collector Single User assumption

NorthernNetGuy — Thu, 11 Oct 2018 14:04:55 GMT

Does Identity Collector have the ability to assume that only one user is connected per computer, as AD Query does?

I like that identity collector can ignore RDP events from the initiating computer, but I'm unsure if it has the ability to do single user assumption, or if this is assumed by default. We have many shared computers where we want the current logged in user to be the assumed single user.

Re: Identity Collector Single User assumption

Kaspars_Zibarts — Thu, 11 Oct 2018 16:40:33 GMT

It's partially true. Only single user is supported per IP address but the latest security event will determine user-IP association. For example, user A currently associated with IP x.x.x.x. Then this user runs an application as another user B on the same machine. That will trigger security event that will be passed onto IDC and as a result now IP x.x.x.x will be associated with user B.

At least that's how it works for us and is causing headaches as we have typically two user IDs on aa machine. I know that version that supports two user IDs per IP is coming out but it doesn't sound that will help you.

Royi Priov‌ might have better comments

Re: Identity Collector Single User assumption

NorthernNetGuy — Thu, 11 Oct 2018 18:46:49 GMT

Are you saying that the Identity Collector does single user assumption? In example, the most recent user login event for an IP is the one that is associated with the IP, and previous user associations are revoked.

This is the only case I need from Identity Collector, as I can make exemptions for any machines that have simultaneous remote sessions (for us would only be a few servers, all other computers only allow one user signed in at a time).

Re: Identity Collector Single User assumption

Kaspars_Zibarts — Fri, 12 Oct 2018 05:16:13 GMT

That's correct sir! I was about to suggest exclusion list but left it out. Great to hear of it works for you

Re: Identity Collector Single User assumption

Royi_Priov — Sun, 14 Oct 2018 06:32:21 GMT

Kaspars Zibarts‌ - thanks for tagging me.

Hi David,

PDP saves only one user and machine per IP.

It means, that "Assume that only one user is connected per computer" option (which is configurable in AD Query) is always enabled in Identity Collector.

I saw you have mentioned this is the desired behavior for you. If there is someone needs this to be changed (to be configurable), you are welcome to open RFE with your local office and discuss it with me.

Thanks,

Royi Priov - Identity Awareness R&D.

Re: Identity Collector Single User assumption

SerB — Thu, 22 Oct 2020 08:52:01 GMT

>At least that's how it works for us and is causing headaches as we have typically two user IDs on aa machine. I know that version that supports two user IDs per IP is coming out but it doesn't sound that will help you.

Did they add this? I've been searching for information today and all I was able to find was your old message.

Re: Identity Collector Single User assumption

THHQ_IT_Ops — Tue, 20 Apr 2021 10:00:17 GMT

Hi Royi Priov,

Sorry to get back on this old topic, but I need some clarifications on "Single User Assumption" on Identity Collector.

We were using AD query as Identity Awareness source with option "Assume that only one user is connected per computer" disabled,
we are currently on version R80.40.

Recently we decided to migrate to Identity Collector instead. It works well but we noted that now there is only one identity per IP identified by Indentity awareness, we checked Gateway and Identity collector Settings, it seems with this method there is not the prossibility to have multiple identities for on IP.

Do you confirm Identity Collector only works like that ?

Is there a hided setting to allow Multiple ID's per IP with Identity Collector ??

Best Regards.

Paulo

Re: Identity Collector Single User assumption

Luis_Esteban — Wed, 13 Sep 2023 12:43:06 GMT

Hi,

We're in the same situation as THHQ_IT_Ops, is there a possibility to allow more than one identity per IP when using identity collector? or should I survive with that issue?

Thanks in advance

Re: Identity Collector Single User assumption

PhoneBoy — Wed, 13 Sep 2023 16:44:11 GMT

Multiple users are supported on Windows 10 by deploying MUHv2 to the relevant machines:
See: https://support.checkpoint.com/results/sk/sk177024
Without deploying an agent, I believe this is still an RFE that should be addressed with your local Check Point office.

Re: Identity Collector Single User assumption

Luis_Esteban — Fri, 13 Oct 2023 11:24:13 GMT

I found the solution here Identity Awareness Gateway does not recognize multiple user identities from the same IP address (checkpoint.com)