topic Re: Block active directory user on firewall without associated group on Spark 1570 in Spark Firewall (SMB)

Block active directory user on firewall without associated group on Spark 1570

jorgemsassuncao — Tue, 23 May 2023 10:21:20 GMT

Hello,
Is it possible to block internet access through the firewall to a specific user in the active directory without creating an AD group?
I have a Spark 1570 with Gaia Embedded R81.10.05

I know it's possible to list the AD groups but I can't list the users...

Re: Block active directory user on firewall without associated group on Spark 1570

PhoneBoy — Tue, 23 May 2023 19:20:46 GMT

Unfortunately, there is no way to refer to a specific user in LDAP, only the group(s) they are a part of.
This sounds like a permissions issue with your AD user.

Re: Block active directory user on firewall without associated group on Spark 1570

Tom_Hinoue — Wed, 24 May 2023 00:42:53 GMT

If its a Locally Managed appliance, this is a known limitation that you cannot select specific users from AD on SMB appliances.

See sk105977 - There is no option to add specific Active Directory users and organization units inside policy rules, when using Identity Awareness blade on SMB appliances

> This is the current design for locally managed SMB appliances. It is a best practice to use Active Directory groups to make maintenance easier.

Re: Block active directory user on firewall without associated group on Spark 1570

the_rock — Wed, 24 May 2023 01:17:48 GMT

AS @Tom_Hinoue said, it is limitation for locally managed appliance. If its centrally managed, should be doable with access role, if you add say a group from AD server that contains a single user.

Andy