AuthPoint Deployment Guide

You manage AuthPoint from WatchGuard Cloud. There are two types of WatchGuard Cloud account — Service Provider and Subscriber — each with a different view of WatchGuard Cloud.

If you have a Service Provider account, before you can set up AuthPoint, you must go to the Inventory page and allocate AuthPoint user licences to your account. For more information, see Allocate Users to Your Account.

You configure and manage AuthPoint from the Configure Services section of WatchGuard Cloud.

To navigate to the AuthPoint management UI in WatchGuard Cloud:

1. Log in to WatchGuard Cloud at http://cloud.watchguard.com/.
   The WatchGuard Cloud Dashboard page is shown.
2. From the navigation menu, select Configure > AuthPoint. If you have a Service Provider account, you must select an account from Account Manager.
   The AuthPoint Summary page opens.

The AuthPoint Gateway is a lightweight software application that you install on your network to synchronize user account information between your LDAP or Active Directory server and AuthPoint.

The Gateway functions as a RADIUS server and is required for RADIUS authentication and for LDAP synced users to authenticate with SAML resources. You must install the Gateway so that AuthPoint can communicate with your RADIUS clients and LDAP databases.

Before you install the Gateway, you must configure it in the AuthPoint management UI.

To configure and install the AuthPoint Gateway:

1. From the AuthPoint navigation menu, select Gateway.
2. Click Add Gateway.

3. In the Name text box, type a descriptive name for the Gateway.

4. Click Save.
5. On the Gateway page, at the bottom of the tile for your Gateway, click Registration Key.

6. In the Gateway Registration Key dialog box, copy the registration key. You need this value to install the Gateway.

   The Gateway registration key is a one-time use key. If the installation of the Gateway fails, you must generate a new key to use for the installation.

7. From the navigation menu, select Downloads.
8. In the Gateway Installer section, click Download.

9. Run the downloaded Gateway installer anywhere on your network that has Internet access and that can connect to your RADIUS clients and LDAP server(s).
   
   WatchGuard AuthPoint Gateway Setup dialog box opens.
10. In the Gateway Registration Key text box, type or paste the Gateway registration key you copied from AuthPoint.
11. Click Install.

12. Click Finish.

13. In the AuthPoint management UI, on the Gateway page, check the circular icon next to your Gateway name. A green icon indicates that the Gateway is successfully installed and can communicate with AuthPoint.

    If the installation of the Gateway fails, you must generate a new registration key to use for the installation. For more information, see Gateway Registration Key.

External identities connect to user databases to get user account information and validate passwords. To sync users from an external user database, you must add an external identity.

In this example, we show the steps to sync users from Active Directory or a Lightweight Directory Access Protocol (LDAP) database. To learn how to create an external identity to sync users from Azure Active Directory, see Sync Users from Azure Active Directory.

To add an external identity, from the AuthPoint management UI:

1. Select External Identities.
2. From the Choose an External Identity Type drop-down list, select LDAP. Click Add External Identity.

3. In the Name text box, type a descriptive name for the external identity.
4. In the LDAP Search Base text box, type your LDAP database. In this example, the domain is example.com so we type dc=example,dc=com. Tip!The standard format for the search base setting is: ou=<name of organizational unit>,dc=<first part of the distinguished server name>,dc=<any part of the distinguished server name that appears after the dot>.

   For more information about LDAP syntax and how to use a search base to limit the directories on the authentication server where the external identity can search for users, see Find Your Active Directory Search Base.

5. In the System Account and Passphrase text boxes, type the credentials for a user that has permissions to perform LDAP searches and binds. If this user is not in the default Users folder, select the toggle and type the full distinguished name of the user. Tip!The standard format for the distinguished name of a user is: cn=<name of user>,ou=<name of organizational unit>,dc=<first part of the distinguished server name>,dc=<any part of the distinguished server name that appears after the dot>.

   In this example, we have a user named administrator that is in an OU called AuthPoint (not the default Users folder). So, we must select the toggle and type the distinguished name of our user as CN=administrator,OU=AuthPoint,DC=example,DC=com.

   If the user is in the Users folder and the user name is different than the account name (sAMAccountName), you must type the account name in the System Account text box.

6. From the Synchronization Interval drop-down list, specify how often you want to synchronize the LDAP database. If you select Every 24 hours, you must also specify what time the synchronization starts each day.
7. For Type, select whether this is an Active Directory server or a different type of LDAP database. For other databases, you must specify each attribute value. You do not have to do this for Active Directory because the attribute values are known.
8. In the Domain text box, type your LDAP domain name.
9. If this not an Active Directory server, type a value for each attribute.

   If your Active Directory users use ADFS, you must keep the default sAMAccountName value for the attribute related to user login.

10. In the Server Address text box, type the IP address of your LDAP server.
11. In the Server Port text box, type the port for your server.

12. (Optional) To add a redundant address for your external identity, click Add Redundant Address and type a different address and port for the same LDAP database.
13. Click Save.

Next, you must add your external identity to the configuration for your AuthPoint Gateway. After you do that, you can test the connection to your LDAP database.

1. From the navigation menu, select Gateway.
2. Click the Name of your Gateway.
3. In the LDAP section, in the Select an LDAP external identity list, select your LDAP or Active Directory server.

4. Click Save.
5. From the navigation menu, select External Identities.
6. Next to the external identity you added for your LDAP database, click and select Check Connection.

AuthPoint is now connected to your LDAP database. You can create a query to sync users, but before you do that we recommend that you add resources for all of the applications and services that you want to require authentication for.

In AuthPoint, resources are the applications that you protect with AuthPoint. When you add a resource, you provide the information required for AuthPoint to connect to that resource.

When you add and configure a resource in AuthPoint, authentication is required to log in to that resource. For each resource, users must be a member of a group that has an authentication policy that includes that resource in order to authenticate and log in.

Users who are not a member of groups that have an authentication policy for a specific resource cannot authenticate to log in to that resource.

See AuthPoint Integration Guides for more information about how to set up authentication with specific third-party services and applications.

After you add and configure resources in AuthPoint, you must create groups for your users. In AuthPoint, groups are how you define which resources your users have access to. You add users to groups in AuthPoint, then you add the groups to the authentication policies that specify which resources users can authenticate to.

You must add at least one group before you can add authentication policies or add users to AuthPoint.

To sync external groups from Active Directory or Azure Active Directory, you must add an external identity and create a group sync with the Create new synchronized groups option enabled. This is covered in Step 9 — Sync users from your LDAP database.

To add a group to AuthPoint, in the AuthPoint management UI:

1. From the navigation menu, select Groups.
2. Click Add Group.

3. In the New Group section, in the Name text box, type a descriptive name for the group.
4. (Optional) In the Description text box, type a description of the group.

5. Click Save.
   Your group is listed on the Groups page.

Policy objects are the individually configurable components of a policy, such as network locations. You configure policy objects and then add them to authentication policies.

You can configure these types of policy objects:

• Network locations (previously called safe locations)

Network location policy objects enable you to configure a list of IP addresses. You can then configure specific authentication policies that only apply when users authenticate from these IP addresses. You might do this if you want to allow users to log in without MFA when they are in the office.

When you add a network location to an authentication policy, the policy only applies to user authentications that come from that network location. Users who only have a policy that includes a network location cannot get access to the resource when they authenticate outside of that network location (because they do not have a policy that applies, not because authentication is denied).

When you configure policies that include network locations, we recommend that you create a second policy for the same groups and resources without the network location to apply to users that are not in the network location. Make sure the policy with the network location has a higher priority than the policy without the network location.

Network locations require an Internet connection.

For RADIUS authentication and basic authentication (ECP), policies that include a network location will not be applied because AuthPoint cannot determine the IP address of the end user or the origin IP address.

To configure a network location policy object:

1. From the AuthPoint navigation menu, select Policy Objects.
2. From the Choose a Policy Object Type drop-down list, select Network Location. Click Add Policy Object.
   The Network Location page appears.

3. In the Name text box, type a name to identify this network location policy object. This helps you identify the network location when you add it to authentication policies.
4. In the IP Mask text box, type a public IP address or netmask that defines the range of public IP addresses you want to identify for this network location and press Enter or Return. You can specify multiple IP addresses and ranges in one network location.

   You cannot configure the IP address for a network location to 0.0.0.0 or 255.255.255.255.

5. Click Save.

After you add all your resources and groups in AuthPoint, you must configure authentication policies. Authentication policies specify which resources AuthPoint users can authenticate to and which authentication methods they can use (Push, QR code, and OTP).

When you configure an authentication policy, you specify:

• Whether the policy allows or denies authentications.
• Which authentication methods are required.
• Which resources the policy applies to.
• Which user groups the policy applies to.
• Which policy objects apply to the authentications.

A user who is not a member of a group that has an authentication policy for a specific resource cannot authenticate to log in to that resource.

When you configure policies, make sure you follow these requirements and recommendations:

• You must configure at least one group before you can configure authentication policies.
• For RADIUS authentication and basic authentication (ECPEnhanced Client or Proxy), policies that have a network location do not apply because AuthPoint does not have the IP address of the end user or the origin IP address.
• Policies with network locationsNetwork location policy objects are a list of IP addresses that you configure. only apply to user authentications that come from that network location. Users who only have a policy that includes a network location cannot access the resource when they authenticate outside of that network location. This is because they do not have a policy that applies, not because authentication is denied.
• If you configure policy objectsPolicy objects are the individually configurable components of a policy, such as network locations., we recommend that you create a second policy for the same groups and resources without the policy objects. Assign a higher priority to the policy with the policy objects.
• If you enable the push and OTP authentication methods for a policy, RADIUS resources associated with that policy use push notifications to authenticate users.
• You must enable the push authentication method for policies with MS-CHAPv2 RADIUS resources.
• RADIUS resources do not support QR code authentication.

To configure an authentication policy:

1. Select Authentication Policies.
2. Click Add Policy.

3. Type a name for the policy.
4. From the Select the authentication options drop-down list, select an option to specify whether to require MFA or to deny authentications for this policy.
   • Authentication options — Require MFA when users in the groups associated with this policy authenticate to the resources associated with this policy.
   • Authentication not allowed — Deny authentications when users in the groups associated with this policy try to authenticate to the resources associated with this policy

5. If you require MFA for this policy, select the check box for each authentication option users can select from when they authenticate. For more information about authentication methods, see About Authentication.

   If you enable the push and OTP authentication methods for a policy, RADIUS resources associated with the policy use push notifications to authenticate users.

   QR code authentication is not supported for RADIUS resources.

6. For policies that include an Office 365 resource, if you require authentication for a device or resource that is part of your Office 365 domain but cannot use MFA, such as a printer, select the Basic Authentication check box. Basic authentication is also called Enhanced Client or Proxy (ECP).
7. From the Groups drop-down list, select which groups this policy applies to. You can select more than one group. To configure this policy to apply to all groups, select All Groups.
8. From the Resources drop-down list, select which resources this policy applies to. To configure this policy to apply to all resources, select All Resources.

9. From the Policy Objects drop-down list, select which policy objects apply to this policy. For more information about policy objects, see About Policy Objects.

10. Click Save.
    Your policy is created and added to the end of the policy list.

    After you create a new policy, we recommend that you review the order of your policies. AuthPoint always adds new policies to the end of the policy list.

To sync users from an LDAP database, you must create a query for the external identity that you added. The queries you add to an external identity specify which users to sync from your Active Directory or LDAP database. They pull user information from the database and create AuthPoint users for the users that match the query.

There are two ways to query users:

• Group Sync — Select the LDAP groups you want to sync users from and AuthPoint creates the query for you.
• Advanced Queries — Create your own LDAP queries to specify which groups or users to sync.

In this example, we show the steps to use the group sync feature.

Before you continue, make sure that each user account has a valid email address. If the email address for a user account is not correct, the user cannot receive the email message to set a password and activate a token.

If the selected LDAP groups have more users than you have available licenses for, the sync only creates as many users as your license supports.

LDAP users that do not have a user name or email address are not included in the synchronization.

To sync LDAP groups:

1. Select External Identities.
2. Next to your external identity, click and select Group Sync.

3. On the Group Sync page, click Add New Group to Sync.

4. In the Add Group Sync window, from the Select LDAP Groups to Sync Users From drop-down list, select the LDAP groups you want to sync users from. You can select multiple groups.

5. From the Select an AuthPoint Group to Add Users To drop-down list, select the AuthPoint group to add the users to.

   For each group sync, all users are added to the same AuthPoint group. To add users to separate AuthPoint groups, you must create a separate group sync for each LDAP group that contains users you want in a different AuthPoint group.

6. To create new groups in AuthPoint based on the Active Directory groups that you sync users from, enable the Create new synchronized groups toggle. If you enable this option, users sync to the new groups based on group membership in the LDAP database, in addition to the selected AuthPoint group.

   The Create new synchronized groups option is only available for Active Directory and Azure Active Directory.

   To see and use this option, you must install version 6.1 or higher of the AuthPoint Gateway.

7. Click Save.
   The Add Group Sync window closes.

After you add a query to find your users (manually or with group sync), AuthPoint syncs with your Active Directory or LDAP database at the next synchronization intervalThis is defined in the Synchronization Interval drop-down list on the LDAP Configuration page for your external identity. and creates an AuthPoint user account for each user identified by the query.

To start a sync immediately, on the External Identities page, next to the your external identity, click and select Start Synchronization.

The created user accounts appear on the Users page with a green Activated status icon next to the user name. The Activated status icon indicates that the user has been created and is currently active (not blocked). You can identify users synced from an external identity by the LDAP tag in the Type column in the list of users.

Each user receives an email that they use to activate their token in the AuthPoint mobile app. When a user activates their token, their token information is shown in the Token column with a green Activated status icon next to the token.

Users synced from an external identity use their existing password for authentication. They do not receive the email to set an AuthPoint password.

If you enabled the Create new synchronized groups toggle, the synced groups are created in AuthPoint. The newly created groups appear on the Groups page. You can identify synced groups from Active Directory by the LDAP tag in the Type column in the list of groups.

If you change the name of a synced group in Active Directory, the name of the synced group in AuthPoint updates automatically to match. You cannot edit the synced groups in AuthPoint.

If you delete the group in Active Directory, or if you delete the group sync, the synced group is not deleted in AuthPoint. You must manually delete the synced group in AuthPoint.