- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
Account Lifetime Expiry for LDAP imported users
05/15/2020 
7 People found this article helpful
91,534 Views
Description
Administrators might run into requirement where imported users from active directory or LDAP server should be valid for a specific period of time on firewall and once the account lifetime is over, the user should not be able to connect either locally or from remote location.
Currently firewall has an option of account lifetime on the locally created users on firewall or for imported user from LDAP server. However, the option does not work as expected.
EXAMPLE:
Lets take an example where we have created a local user and integrated a LDAP server from local network and imported a user from that LDAP server as shown below :
Let us set the account life time for both of these users as 1 minutes on firewall as shown below:
Notice that after one minute of account lifetime expiry, you will see the following representation on the SonicWall GUI, :
However, if you now test these users, say like connecting via Global VPN Client, you will see following behavior:
a) With Local user:
Firewall will not allow the local user to connect as its account life-time was expired and the GVC client will be displaying the logs as:
b) With LDAP user :
Firewall fails to check the ldap imported user's account lifetime and allows the user to connect even though the user-account on firewall shows expired.
Cause
The reason for such behavior from firewall is because it skips few attributes while importing the user from LDAP.
Basically the user account imported on firewall is not the actual user account but a copy from LDAP server. Hence even though the account has expired from SonicWall database, but it is actually active on the LDAP server.
This has been identified by our product management team and has been put as an enhancement request to check the ldap user account lifetime expiry value directly from firewall, just like local user.
Resolution
The workaround to achieve this requirement will be controlling the account lifetime from the LDAP server directly, either through 'Logon Hours' or the 'Account Expire' option, before importing the user on firewall as shown:
ISSUE ID:
DTS#222096
RFE#3044
Related Articles
Categories
- Firewalls > NSa Series > User Login
- Firewalls > SonicWall NSA Series > User Login
- Firewalls > SonicWall SuperMassive 9000 Series > User Login
- Firewalls > TZ Series > User Login
YES
NO