Difference between AD query and User Directory

SAROU237 — Mon, 07 Dec 2020 19:03:19 GMT

Hello,

In the " identity awareness" software blade, I don't understand the difference between :

- AD QUERY

- USER DIRECTORY

The 2 of them Get identity data from Active Directory .So what is the difference ?

Re: Difference between AD query and User Directory

PhoneBoy — Mon, 07 Dec 2020 21:11:58 GMT

User Directory is a legacy feature that is tied with LDAP.
Recommend reading this thread for more background: https://community.checkpoint.com/t5/General-Topics/User-Directory-vs-Identity-Awareness/m-p/21862#M4083

AD Query is one of the many methods used for acquiring identities.
Specifically, it subscribes to a given Active Directory server over WMI and receives specific types of events correlated with a user login.
Others include:

Identity Collector, which is far more scalable than AD Query
Identity Agents (including MUH for terminal servers)
Captive Portal
RADIUS Accounting
Identity Awareness API (allows integration with third party systems)

Note that in all cases, this only achieves an IP to username mapping.
To get the actual groups associated with a given user, an LDAP query from the gateway is used.

topic Re: Difference between AD query and User Directory in General Topics

Difference between AD query and User Directory

Re: Difference between AD query and User Directory