config load-balance auth-policy
Use this command to configure an auth policy. The parameters of the policy set the matching terms that mandate authentication and reference the user group that has authorization. For example, you can define an auth-policy that has the following logic: if the Host header matches example.com and the URI matches /index.html, then the group example-group is authorized. FortiADC supports the Basic Authentication Scheme described in RFC 2617.
Figure 3 illustrates the client-server communication when authorization is required.
- The client sends an HTTP request for a URL belonging to a FortiADC virtual server that has an authorization policy.
- FortiADC replies with an HTTP 401 to require authorization. On the client computer, the user might be prompted with a dialog box to provide credentials.
- The client reply includes an Authorization header that gives the credentials.
- FortiADC sends a request to the server (local, LDAP, or RADIUS) to authenticate the user.
- The authentication server sends its response, which can be cached according to your user group configuration.
- If authentication is successful, FortiADC continues processing the traffic and forwards the request to the real server.
- The real server responds with an HTTP 200 OK.
- FortiADC processes the traffic and forwards the server response to the client.
Before you begin:
- You must have created the user groups to be authorized with the policy. You also configure users and authentication servers separately.
- You must have read-write permission for load balancing settings.
After you have configured an auth policy, you can select it in the virtual server configuration. Note the following requirements:
- Virtual server type must be Layer 2 or Layer 7.
- Profile type must be HTTP or HTTPS.
- The profile option once-only must be disabled.
Syntax
config load-balance auth-policy
edit <name>
config members
edit 1
set auth-path <path>
set host <hostname>
set host-status {enable|disable}
set user-group <datasource>
set user-realm <string>
next
end
next
end
auth-path |
Require authorization only if the URI of the HTTP request matches this pathname. If none is specified, requests to any URI require authorization. The value is parsed as a match string prefix. For example, |
host |
Specify the HTTP Host header. If host-status is enabled, the policy matches only if the hostname header matches this value. Complete, exact matching is required. For example, |
host-status |
If enabled, require authorization only for the specified host. If disabled, ignore hostname in the HTTP request header and require authorization for requests with any Host header. Disabled by default. |
user-group |
User group that is authorized to access the protected resource. |
user-realm |
Realm to which the auth-path URI belongs. If a request is authenticated and a realm specified, the same credentials should be valid for all other requests within this realm. |