Example: Enforcing complex passwords. Fortinet FortiWeb 5.1 Patch 3

Setting name Description

SSO Domain

Type the domain suffix of

Host: names that will be allowed to share this rule’s authentication sessions, such as

.example.com. Include the period (

. ) that precedes the host’s name.

Alert Type

Select whether to log authentication failures and/or successes:

• None — Do not generate an alert email and/or log message.

• Failed Only — Alert email and/or log messages are caused only by authentication failures.

• Successful Only — Alert email and/or log messages are caused only by successful authentication.

• All — Alert email and/or log messages are caused for all HTTP authentication attempts, regardless of success or failure.

Event log messages contain the user name, authentication type, success or failure, and source address (for example,

User jdoe [Site

Publish] login successful from 172.0.2.5) when an end-user successfully authenticates. A similar message is recorded if the authentication fails (for example,

User hackers [Site Publish] login failed from 172.0.2.5).

4. Click OK.

5. Go to Application Delivery > Site Publish > Site Publish Policy.

6. Click Create New.

7. In Name, type a unique name that can be referenced in other parts of the configuration. Do not use spaces or special characters. The maximum length is 35 characters.

8. Click Create New and in Rule, select the name of a site publishing rule.

9. Repeat the previous step for each web application that will be part of the SSO domain.

10.Click OK.

11.Select the site publishing policy in an inline web protection profile (see

“Configuring a protection profile for inline topologies” on page 495 ). The profile must be used in the policy

applying your domain’s virtual servers.

12.To verify the configuration, log in to one of the web applications, then log in to another web application in the same domain that should be part of the SSO domain.

See also

•

Offloading HTTP authentication & authorization

Example: Enforcing complex passwords

Fortinet

Example Co. web hosting needs to enforce reasonably secure passwords on web applications that do not provide this feature themselves. Since end users already authenticate with the web applications, Example Co. does not need to configure FortiWeb with user accounts to apply authentication — in other words, authentication offloading is not required. Instead, they simply need to enforce the security policy in the authentication transactions that already exist between the clients and web servers.

To do this, Example Co. would configure and apply an input rule (see

“Validating parameters

(“input rules”)” on page 447 ). This rule either could use a predefined data type to require

password complexity (Level 2 Password — see “Predefined data types” on page 173 ), or could

254 FortiWeb 5.1 Patch 3 Administration Guide

use a custom-defined data type to allow or require additional special characters for additional strength (see

“Defining custom data types” on page 455

).

Fortinet 255 FortiWeb 5.1 Patch 3 Administration Guide