Type a unique name that can be referenced in other parts of the configuration, such as cms-publisher1.

Do not use spaces or special characters. The maximum length is 35 characters.

Select one of the following options:

• Simple String — Published Site contains a literal FQDN (fully qualified domain name).
• Regular Expression — Published Site contains a regular expression designed to match multiple host names or FQDNs.

Enter one of the following:

• The literal Host: name, such as sharepoint.example.com, that the HTTP requests that match the rule contain (if Request Type is Simple String)
• A regular expression, such as ^*\.example\.edu, that matches all and only the host names that the rule should match (if Request Type is Regular Expression).

The maximum length is 255 characters.

Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see Regular expression syntax.

Enable to allow Android clients to access to Microsoft Exchange servers through Exchange ActiveSync protocol.

Note: If Exchange ActiveSync is enabled, single sign-on (see SSO Support), authentication cookie (see Authentication Cookie Timeout) and Kerberos authentication (see Authentication Delegation) will be not available, and HTTP Basic Authentication (see Client Authentication Method) will be the only method to authenticate the clients.

Select one of the following options:

• HTML Form Authentication — FortiWeb authenticates clients by presenting an HTML web page with an authentication form.
• HTML Basic Authentication — FortiWeb authenticates clients by providing an HTTP AUTH code so that the browser displays its own dialog.
• Client Certificate Authentication — FortiWeb validates the HTTP client’s personal certificate using the certificate verifier specified in the associated server policy or server pool configuration.

Used when Authentication Delegation is Kerberos Constrained Delegation or No Delegation.

Note: This option requires you to select a value for Certificate Verification in the server policy or Certificate Verification in the server pool configuration. If Exchange ActiveSync is enabled (see Exchange ActiveSync), only HTML Basic Authentication will be available.

Select one of the following options:

• Simple String — The optional Published Server Log Off Path setting is a literal URL.
• Regular Expression — The optional Published Server Log Off Path setting is a regular expression designed to match multiple URLs.

Optionally, enter one of the following values:

• If Log Off Path Type is Simple String, enter the URL of the request that a client sends to log out of the application.
• If Log Off Path Type is Regular Expression, enter a regular expression that matches the logoff URL.

Ensure that the value is a sub-path of the Path value. For example, if Path is /owa , the following values are valid:

/owa/auth/logoff.aspx

/owa/logoff.owa

When clients log out of the web application, FortiWeb redirects them to its authentication dialog.

Available only when Client Authentication Method is HTML Form Authentication.

Specify the length of time (in minutes) that passes before the cookie that the site publish rule adds expires and the client must re-authenticate.

Valid values are from 0 to 216000 minutes.

To configure the cookie with no expiration, specify 0 (the default). The browser only deletes the cookie when the user closes all browser windows.

Note: This will be not available if Exchange ActiveSync (see Exchange ActiveSync) is enabled.

Available only when Client Authentication Method is HTML Form Authentication or HTML Basic Authentication.

Select one of the following options:

• HTTP Basic — FortiWeb uses HTTP Authorization: headers with Base64 encoding to forward the client’s credentials to the web application.

  Typically, you select this option when the web application supports HTTP protocol-based authentication.

  Available only when Client Authentication Method is HTML Form Authentication or HTML Basic Authentication

• Kerberos — After it authenticates the client via the HTTP form or HTTP basic method, FortiWeb obtains a Kerberos service ticket for the specified web application on behalf of the client. It adds the ticket to the HTTP Authorization: header of the client request with Base64 encoding.

  Available only when Client Authentication Method is HTML Form Authentication or HTML Basic Authentication

• Kerberos Constrained Authentication — After it authenticates the client’s certificate, FortiWeb obtains a Kerberos service ticket for the specified web application on behalf of the client. It adds the ticket to the HTTP Authorization: header of the client request with Base64 encoding.

  Available only when Client Authentication Method is Client Certificate Authentication.

• No Delegation — FortiWeb does not send the client’s credentials to the web application.

  Select this option when the web application has no authentication of its own or uses HTML form-based authentication.

  Note: If the web application uses HTML form-based authentication, the client is required to authenticate twice: once with FortiWeb and once with the web application’s form. Kerberos and Kerberos Constrained Authentication will be not available if Exchange ActiveSync (see Exchange ActiveSync) is enabled.

To work with the Kerberos options, web applications require a specific Windows authentication configuration. See Configuring Windows Authentication for Kerberos authentication delegation.

If FortiWeb uses a RADUIS server configuration in the authorization server pool to autheticate the client and RSA SecurID is selected for that server configuration, any authentication delegation settings in this rule are ignored.

Use one of the following options to specify how FortiWeb determines the client username:

• SAN - UPN — Using the certificate’s subjectAltName (Subject Alternative Name or SAN) and User Principal Name (UPN) values. These values that contain the username in certificates issued in a Windows environment. For example:

  username@domain

• SAN - Email — Using the certificate’s subjectAltName (Subject Alternative Name or SAN) and the email address value in the certificate’s Subject information.
• Subject - Email — Using the email address value in the certificate’s Subject information.

Note: Because the email value can be an alias rather than the real DC (domain controller) domain, the most reliable method for determining the username is SAN - UPN.

Available only when Authentication Delegation is Kerberos Constrained Delegation.

Specify the Service Principal Name (SPN) for the web application that clients access using this site publish rule.

A service principal name uses the following format:

<service_type >/<instance_name>:<port_number>/<service_name>

For example, for an Exchange server that belongs to the domain dc1.com and has the hostname USER-U3LOJFPLH1, the SPN is http/USER-U3LOJFPLH1.dc1.com@DC1.COM.

For a Fortiwebsite publishing configuration, a valid SPN requires the suffix @<domain> (for example, @DC1.COM).

Available only when Authentication Delegation is Kerberos or Kerberos Constrained Delegation.

Select the keytab file configuration for the AD user that FortiWeb uses to obtain Kerberos service tickets for clients.

To add a keytab configuration, go to Application Delivery > Site Publish > Keytab File.

For instructions on how to generate the keytab file, see To create an Active Directory (AD) user for FortiWeb.

Available only when Authentication Delegation is Kerberos Constrained Delegation.

Specify the Service Principal Name (SPN) of the AD user that is a delegator. It is the SPN that you used to generate the keytab specified by Keytab File. (See To create an Active Directory (AD) user for FortiWeb.)

For example, host/forti-delegator.dc1.com@DC1.COM.

For a Fortiwebsite publishing configuration, a valid SPN requires the suffix @<domain> (for example, @DC1.COM).

Available only when Authentication Delegation is Kerberos Constrained Delegation.

Select to allow users in environments that require users to log in using both a domain and username to log in with just a username. Also specify Default Domain Prefix.

In some environments, the domain controller requires users to log in with the username format domain\username. For example, if the domain is example.com and the username is user1, the user enters EXAMPLE\user1.

Alternatively, enable this option and enter EXAMPLE for Default Domain Prefix. The user enters user1 for the username value and FortiWeb automatically adds EXAMPLE\ to the HTTP Authorization: header before it forwards it to the web application.

Available only when Authentication Delegation is HTTP Basic or Kerberos.

Enter a domain name that FortiWeb adds to the HTTP Authorization: header before it forwards it to the web application.

Available only when Default Domain Prefix Support is enabled.

When Authentication Delegation is Kerberos, ensure that the prefix you enter is the full domain name (for example, example.com).

Enable for single sign-on support.

For example, the website for this rule is www1.example.com and SSO Domain is .example.com. After FortiWeb authenticates the client for www1.example.com, the client can access www2.example.com without authenticating a second time.

Site publishing SSO sessions exist on FortiWeb only; they are not synchronized to the authentication or accounting server. Therefore, SSO is not shared with non-web applications. For SSO with other protocols, see the documentation for your FortiGate or other firewall.

Note: This will be not available if Exchange ActiveSync (see Exchange ActiveSync) is enabled.

Enter the number of times that a user can attempt to log in before FortiWeb prevents the user from attempting to log in again.

FortiWeb determines whether the user exceeded this threshold based on the number of login attempts that happen within the time period specified by Within.

If the user exceeds the threshold and attempts to log in again during the time period configured by Account Block Period, FortiWeb returns an "Account blocked!" message to the user.

You can customize the web page that FortiWeb returns to the blocked user. See Customizing error and authentication pages (replacement messages).

Enable to use FortiGuard's Credential Stuffing Defense database to prevent against Credential Stuffing attacks. When this setting is enabled, FortiWebwill evaluate the username (Username Field) and password (Password Field) of the matched login requests against the Credential Stuffing Defense database to identify whether the paired username/password has been spilled. If it has, the specified Action triggers and Trigger Policy is applied.

Caution: FortiWeb has no built-in Credential Stuffing Defense database. At least one FortiGuard update is required to install the database, otherwise this feature is ineffective. For details, see Connecting to FortiGuard services.

Select the action that FortiWeb will take against a request when a paired username/password is found in Credential Stuffing Defense database:

• Alert — Accept the request and generate an alert email and/or log message.

• Alert & Deny — Block the request (or reset the connection) and generate an alert email and/or log message.
  

  You can customize the web page that FortiWeb returns to the client with the HTTP status code. See Customizing error and authentication pages (replacement messages).
  
  Note: Because the deny action is not supported in offline protection mode, this option has the same effect as Alert.

• Period Block — Block subsequent requests from the client for a specified number of seconds.
  

  You can customize the web page that FortiWeb returns to the client with the HTTP status code. See Customizing error and authentication pages (replacement messages).
  
  Caution: This option is not supported in offline protection mode

Type the number of seconds that you want to block a request when a paired username/password is found in Credential Stuffing Defense database.

This setting is available only if Action is set to Period Block. The valid range is from 1 to 3,600 (1 hour). The default value is 60. See also Monitoring currently blocked IPs.

When the credential stuffing defense generates an attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb uses when it takes the specified action:

• Low
• Medium
• High

The default value is Medium.