Account Lifetime Expiry for LDAP imported users

05/15/2020 3 3641

DESCRIPTION:

Administrators might run into requirement where imported users from active directory or LDAP server should be valid for a specific period of time on firewall and once the account lifetime is over, the user should not be able to connect either locally or from remote location.

Currently firewall has an option of account lifetime on the locally created users on firewall or for imported user from LDAP server. However, the option does not work as expected.

EXAMPLE: 

Lets take an example where we have created a local user and integrated a LDAP server from local network and imported a user from that LDAP server as shown below :

Let us set the account life time for both of these users as 1 minutes on firewall as shown below:

Notice that after one minute of account lifetime expiry, you will see the following representation on the SonicWall GUI, :

However, if you now test these users, say like connecting via Global VPN Client, you will see following behavior:

a) With Local user:

Firewall will not allow the local user to connect as its account life-time was expired and the GVC client will be displaying the logs as:

b) With LDAP user :

Firewall fails to check the ldap imported user's account lifetime and allows the user to connect even though the user-account on firewall shows expired.

CAUSE:

The reason for such behavior from firewall  is because it skips few attributes while importing the user from LDAP.

Basically the user account imported on firewall is not the actual user account but a copy from LDAP server. Hence even though the account has expired from SonicWall database, but it is actually active on the LDAP server.

This has been identified by our product management team and has been put as an enhancement request to check the ldap user account lifetime expiry value directly from firewall, just like local user.

RESOLUTION:

The workaround to achieve this requirement will be controlling the account lifetime from the LDAP server directly, either through 'Logon Hours' or the 'Account Expire' option, before importing the user on firewall as shown:

ISSUE ID:

DTS#222096

RFE#3044