config : waf http-authen http-authen-policy
waf http-authen http-authen-policy
Use this command to group HTTP authentication rules into HTTP authentication policies.
The FortiWeb appliance uses authentication policies with the HTTP authentication feature to authorize HTTP requests. For details, see the
FortiWeb Administration Guide.
To apply HTTP authentication policies, select them in an inline protection profile. For details, see
“config waf web-protection-profile inline-protection”.
To use this command, your administrator account’s access control profile must have either
w or
rw permission to the
wafgrp area. For more information, see
“Permissions”.
Syntax
config waf http-authen http-authen-policy
config rule
next
end
next
end
Variable | Description | Default |
<auth-policy_name> | Type the name of a new or existing HTTP authentication policy. The maximum length is 35 characters. To display the list of existing policies, type: edit ? | No default. |
cache {enable | disable} | Enable to cache client user names and passwords from remote authentication such as LDAP queries. Also configure cache-timeout <timeout_int>. This can be used can improve performance by preventing frequent queries. | No default. |
alert-type {none | fail | success | all} | Type the instances when alerts will be issued for HTTP authentication attempts: • none — No alerts are issued for HTTP authentication. • fail — Alerts are issued only for HTTP authentication failures. • success — Alerts are issued for successful HTTP authentication. • all — Alerts are issued for all failed and successful HTTP authentication. | none |
cache-timeout <timeout_int> | Type the query cache timeout, in seconds. The valid range is from 0 to 3,600 seconds. This option is available only when cache is enabled. | 300 |
auth-timeout <timeout_int> | Type the connection timeout for the query to the FortiWeb’s query to the remote authentication server in milliseconds. The valid range is from 0 to 60,000 milliseconds. If the authentication server does not answer queries quickly enough, to prevent dropped connections, increase this value. | 2000 |
<entry_index> | Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999. | No default. |
http-authen-rule <http-auth-rule_name> | Type the name of an existing HTTP authentication rule. The maximum length is 35 characters. To display the list of existing rules, type: set http-authen-rule ? | No default. |
Example
This example first configures a user group that contains both a local user account and an LDAP query.
config user user-group
edit "user-group1"
config members
edit 1
set type local
set local-name "user1"
next
edit 2
set ldap-name "user2"
set type ldap
next
end
next
end
Second, it configures a rule that requires basic HTTP authentication when requesting the URL /employees/holidays.html on the host www.example.com. This URL will be identified as belonging to the realm named “Restricted Area”. Users belonging to user-group1 can authenticate.
config waf http-authen http-authen-rule
edit "auth-rule1"
set host-status enable
set host "www.example.com"
config rule
edit 1
set request-url "/employees/holidays.html"
set authen-type basic
set user-group "user-group1"
set user-realm "Restricted Area"
next
end
next
end
Third, it groups two HTTP authentication rules into an HTTP authentication policy that can be applied in an inline protection profile.
config waf http-authen http-authen-policy
edit "http-auth-policy1"
config rule
edit 1
set http-authen-rule "http-auth-rule1"
next
edit 2
set http-authen-rule "http-auth-rule2"
next
end
next
end
Related topics