topic Re: User directory in General Topics

User directory

SAROU237 — Fri, 11 Dec 2020 23:55:31 GMT

In user directory :

User Directory lets you configure:

"Mutiple account unit" An account unit, is it a group of user? Exemple: group of user in service marketing
Decide how many Account Units you will need. "
"You can have one for each User Directory server, or you can divide branches of one User Directory server among different Account Units. " do you have an example ?

Thank you

Re: User directory

PhoneBoy — Sat, 12 Dec 2020 03:06:22 GMT

When you query an LDAP server (usually but not always Active Directory), you generally query a specific part of its hierarchy.
In Check Point, this is defined as part of the Account Unit (AU).
You may need to query more than one set of servers or a different part of the hierarchy on the same servers.
In either case, you would create a different AU to accommodate.

LDAP Groups are specific to an AU since they refer to a specific part of the hierarchy.

I believe there are examples in the documentation.

Re: User directory

SAROU237 — Sat, 12 Dec 2020 10:19:37 GMT

is account unit information like name,company, country?

we can query the ldap without creating account unit. so why do we need To create that ? please give me an example

Re: User directory

PhoneBoy — Sun, 13 Dec 2020 00:03:33 GMT

If you want to integrate with Active Directory at all, you need to create one or more Account Units that refers to the relevant branches of the directory.
The relevant branch(es) is/are highly specific to the directory in question.
The following might be helpful: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk31841
I also highly recommend reading the Security Management and Identity Awareness guides for the relevant version of code you're running.