topic Re: LDAP Account unit in General Topics

LDAP Account unit

israelfds95 — Sun, 11 May 2025 08:26:08 GMT

I've been studying Identity Awareness and digging deeper to close some knowledge gaps. So I've been reading guides, SKs, and also using ChatGPT Plus to clarify some questions and research a few things based on the files and information I shared with it.

One of the questions I asked was:

Which Identity Awareness options (Browser-authentication, AD Query, Identity Agent, Terminal Server, Identity Collector, RADIUS Accounting, Identity Web API, and Remote Access) actually require an LDAP Account Unit to work, and which ones don't?

And it replied:

"Almost all identity sources require the LDAP Account Unit — not for authentication, but for authorization, meaning to associate users with groups used in Access Roles."

I found that really useful. What do you think?

Re: LDAP Account unit

israelfds95 — Sun, 11 May 2025 08:35:08 GMT

I found that really useful. What do you think?

Re: LDAP Account unit

Lesley — Sun, 11 May 2025 08:59:18 GMT

Hi,

There are more blades using the LDAP account unit. Please refer to: https://support.checkpoint.com/results/sk/sk101372

"Additionally, LDAP Account Units are used in the SmartDashboard, when opening, editing or fetching LDAP attributes."

With this they mean the access roles (that you can use for example an ad group in a firewall rule).

Re: LDAP Account unit

the_rock — Mon, 12 May 2025 00:24:08 GMT

See if below discussion helps. Also, I believe ldap account unit is needed regardless, as thats how users are pulled no matter what method you use.

Andy

https://community.checkpoint.com/t5/Security-Gateways/New-IA-Implementation/m-p/185851#M34184

Re: LDAP Account unit

G_W_Albrecht — Mon, 12 May 2025 07:38:04 GMT

This is fully explained in sk86441: ATRG: Identity Awareness

Re: LDAP Account unit

the_rock — Mon, 12 May 2025 11:33:17 GMT

SK @G_W_Albrecht sent is the answer, for sure.

Andy