Fireware “How To”
Authentication
How do I find my Active Directory authentication search base?
Introduction
Active Directory is Microsoft’s Windows-based application of LDAP directory structure. Active Directory lets you
expand the concept of domain hierarchy used in DNS to an organizational level. It keeps information and settings for
an organization in a central, easy-to-access database.
When you configure the Firebox to authenticate users using an existing Active Directory authentication server, you
add a search base. The search base gives a place in the Active Directory hierarchical structure to start the search for
user account entries and can help to make the authentication procedure faster. This document explains how to find
and document your Active Directory authentication search base.
Is there anything I need to know before I start?
Before you start, you must have an operational Active Directory server, containing account information for all users
who you want to configure authentication for on the Firebox.
Determining Your Active Directory Search Base
With any Active Directory installation, the most basic and fundamental search base you can add is your fully qualified domain name in distinguished name format. While this search base will most certainly contain your user
accounts somewhere in the hierarchy below it, it is not always the most efficient search base to include in your Firebox configuration.
1
1
On your Active Directory server, go to Start > Programs > Administrative Tools > Active Directory Users and
Computers.
2
Find your domain name in the tree. Expand the tree to find the path through your Active Directory hierarchy.
Look for the lowest organizational unit that contains all users who you want to authenticate through the Firebox.
Remember that organizational units can contain other organizational units.
3
Once you have identified the organizational unit that contains the user base you want to authenticate, document
the path through the tree to this organizational unit. Start at the lowest organization unit and document all
higher organization units as you move up the tree to your domain name. Organizational units are identified with
the format “ou=organizational unit name” and are comma-delimited. Domain name components are identified
with the format “dc=domain name component” and are appended to the end of the search base string and
comma-delimited.
Example:
Look at the screen shot above. In this example, all the users that must authenticate to the Firebox are in the
Active Directory organizational unit “Outside Sales”. The search base string to enter in the Firebox configuration
would be:
OU=Outside Sales,OU=Sales,OU=Accounts,DC=Kunstlerandsons,DC=com
Frequently Asked Questions About This Procedure
When I type my search string, do I use uppercase or lowercase letters?
It does not matter. Windows is not case-sensitive.
All the users in my domain are in the Users folder. What is my search base?
The Users folder is a container, not an organizational unit. You identify a container with the format “cn=container
name.” If all the users are in the Users container you can use this format for the search base:
CN=Users,DC=Domain name component,DC=Domain name component
For the Kunstler and Son example, the search base would be:
CN=Users,DC=Kunstlerandsons,DC=com
Some of my users are in the Users folder, and some users are in organizational units. What is my search base?
If your domain has some users in the Users container, and other users in organizational units, the lowest path in
the Active Directory that contains all the accounts is the domain itself. If your domain is like this, your search base
must be:
DC=Domain name componenet,DC=Domain name component
For the Kunstler and Sons example, the search base would be:
DC=Kunstlerandsons,DC=com
SUPPORT:
COPYRIGHT © 2006 WatchGuard Technologies, Inc. All rights reserved.
WatchGuard, the WatchGuard logo, Firebox, and Core are registered trademarks or trademarks of WatchGuard Techwww.watchguard.com/support
nologies, Inc. in the United States and/or other countries.
U.S. and Canada +877.232.3531
All Other Countries +1.206.613.0456
2
">
