SmartConsole Administrator external authentication

[Mani141087]

Hi all

We want to authenticate SmartConsole Administrators with Active Directory. I have found this sk145392.
But there are a lot of limitations, and as I understand, only possible from a Security Management Server, not from a Security Gateway, where the Management Server is activated too. Right?

We have both, Management Server and Management activated on Gateway's...

So Active Directory authentication can solve only partial our needs.

I’m looking for other options. Key Points are:
- Not creating administrator in smartconsole
- Using AD-Group, where die smartconsole administrators are managed

As I worked with Radius and Tacacs in the past, I know it is possible to define the AD-Group there and if the Radius-Client (Management-Server or Gateway) ask to authenticate a user, this will be looked up by radius in Active Directory and so on.

But in the Checkpoint Documentation I see only if radius is configured, create also a administrator in smartconsole. Exactly what we don’t like 😊

Any options, to solve this?

Regards,

Mani

[PhoneBoy]

There's an SK that addresses this topic: https://support.checkpoint.com/results/sk/sk145392

[Bob_Zimmerman]

Specifically, while management users have long been able to use central authentication, this article is the only way to use central identification and central authorization. There is no way to build a RADIUS group object for administrators. If you can't use it because of the limitations, your only other option is to explicitly define accounts for all of the admins.

Note that you can define administrative accounts via the management API, so you don't have to click around in the UI a bunch.