AuthPoint Deployment Guide

AuthPoint is managed from within WatchGuard Cloud. There are two types of WatchGuard Cloud account—Service Provider and Subscriber—each with a different view of WatchGuard Cloud.

If you have a Service Provider account, before you can set up AuthPoint you must go to the Inventory page and allocate AuthPoint users to your account. For more information, see Allocate Users to Your Account.

You configure and manage AuthPoint from the Configure Services section of WatchGuard Cloud.

To get to the AuthPoint management UI in WatchGuard Cloud:

1. Log in to WatchGuard Cloud at http://cloud.watchguard.com/.
   The WatchGuard Cloud Dashboard page is shown.
2. (Service Providers) If you have a Service Provider account, you have a different view of WatchGuard Cloud. Click Pivot to Subscriber View to switch to your Subscriber account. Your Subscriber account is where you configure and manage AuthPoint. For more information about the Subscriber view, see WatchGuard Cloud for Service Providers.

3. From the navigation menu, select Configure > AuthPoint.
   The AuthPoint Summary page opens.

The AuthPoint Gateway is a lightweight software application that you install on your network to synchronize user account information between your LDAP or Active Directory server and AuthPoint.

The Gateway functions as a RADIUS server and is required for RADIUS authentication and for LDAP synced users to authenticate with SAML resources. You must install the Gateway so that AuthPoint can communicate with your RADIUS clients and LDAP databases.

Before you install the Gateway, you must configure it in the AuthPoint management UI.

1. From the AuthPoint navigation menu, select Gateway.
2. Click Add Gateway.

3. In the Name text box, type a descriptive name for the Gateway.

4. Click Save.
5. On the Gateway page, next to your Gateway, click and select Gateway Registration Key.

6. In the Gateway Registration Key window, copy the registration key. You need this value to install the Gateway.

   The Gateway registration key is a one-time use key. If the installation of the Gateway fails, you must generate a new key to use for the installation.

7. From the navigation menu, select Downloads.
8. In the Gateway Installer section, click Download.

9. Run the downloaded Gateway installer anywhere on your network that has Internet access and that can connect to your RADIUS clients and LDAP server(s).
   
   WatchGuard AuthPoint Gateway Setup dialog opens.
10. In the Gateway Registration Key text box, type or paste the Gateway registration key from AuthPoint.
11. Click Install.

12. Click Finish.

13. In the AuthPoint management UI, on the Gateway page, check the circular icon next to your Gateway name. A green icon indicates that the Gateway is successfully installed and can communicate with AuthPoint.

    If the installation of the Gateway fails, you must generate a new registration key to use for the installation. For more information, see Gateway Registration Key.

External identities connect to user databases to get user account information and validate passwords. To sync users from a Lightweight Directory Access Protocol (LDAP) database, you must add an external identity.

From the AuthPoint management UI:

1. Select External Identities.
2. From the Choose an External Identity Type drop-down list, select LDAP. Click Add.

3. In the Name text box, type a descriptive name for the external identity.
4. In the LDAP Search Base text box, type your LDAP database. In this example, the domain is example.com so we type dc=example,dc=com. Tip!The standard format for the search base setting is: ou=<name of organizational unit>,dc=<first part of the distinguished server name>,dc=<any part of the distinguished server name that appears after the dot>.

   For more information about LDAP syntax and how to use a search base to limit the directories on the authentication server where the external identity can search for users, see Find Your Active Directory Search Base.

5. In the System Account and Passphrase text boxes, type the credentials for a user that has permissions to perform LDAP searches and binds. If this user is not in the default Users folder, select the slider and type the full distinguished name of the user. Tip!The standard format for the distinguished name of a user is: cn=<name of user>,ou=<name of organizational unit>,dc=<first part of the distinguished server name>,dc=<any part of the distinguished server name that appears after the dot>.

   In this example, we have a user named administrator that is in an OU called AuthPoint (not the default Users folder). So we must select the slider and type the distinguished name of our user as CN=administrator,OU=AuthPoint,DC=example,DC=com.

   The System Account user does not have to be an administrator.

6. From the Synchronization Interval drop-down list, specify how often you want to synchronize the LDAP database. If you select Every 24 hours, you must also specify what time the synchronization starts each day.
7. For Type, select whether this is an Active Directory or a different type of LDAP database. For other databases, you must specify each attribute value. You do not have to do this for Active Directory because the attribute values are known.
8. In the Domain text box, type your LDAP domain name.
9. If this not an Active Directory, type a value for each attribute.

10. In the Server Address text box, type the IP address of your LDAP server.
11. In the Server Port text box, type the port for your server.

12. (Optional) To add a redundant address for your external identity, click Add Redundant Address and type a different address and port for the same LDAP datadabse.
13. Click Save.

Next you must add your external identity to the configuration for your AuthPoint Gateway. Once you do that, you can test the connection to your LDAP database.

1. From the navigation menu, select Gateway.
2. Click the Name of your Gateway.
3. In the LDAP section, in the Select an LDAP external identity list, select your LDAP or Active Directory server.

4. Click Save.
5. From the navigation menu, select External Identities.
6. Next to the external identity you added for your LDAP database, click and select Check Connection.

AuthPoint is now connected to your LDAP database. You can create a query to sync users, but before you do that we recommend that you add resources for all of the applications and services that you want to require authentication for.

In AuthPoint, resources are the applications that you define for use with AuthPoint. When you add a resource, you provide the information required for AuthPoint to connect to that resource.

When you add and configure a resource in AuthPoint, authentication is required to log in to that resource. For each resource, only users that are in a group with an access policy for that resource can authenticate and log in to the resource.

See AuthPoint Integration Guides for more information about how to set up authentication with specific third-party services and applications.

Once you have added and configured resources in AuthPoint, you must create groups for your users and add access policies for your resources to each group.

In AuthPoint, groups are how you define which resources your users have access to. Access policies are added to AuthPoint groups to specify which resources require MFA for the users in that group and which authentication methods they can use (OTP, Push, and QR code).

Because groups specify how users authenticate, no user can be added to more than one group. This prevents potential conflicts between the access policies of each group.

You must add at least one group before you can add or sync users to AuthPoint.

To add a group to AuthPoint:

1. Select Groups.
2. Click Add Group.
3. In the New Group section, in the Name text box, type a descriptive name for the group.
4. (Optional) In the Description text box, type a description of the group.
5. In the Access Policy section, click Add Policy.
   The Add Policy dialog box appears.
6. From the Resource drop-down list, select a resource that users in that group must authenticate to log in to.
7. (Optional) To require that users type their password before they authenticate for this resource, select the Require Password Authentication slider.
8. Select the authentication methods you want to allow for this resource. For RADIUS resources, you can only choose OTP or push. For more information about authentication methods, see About Authentication.
9. Click Add.
10. (Optional) Repeat the previous steps to add access policies for additional resources to the group.
11. Click Save.

Safe locations are a list of public IP addresses that are considered safe. If you try to log in from a computer that uses one of the specified IP addresses (a safe location), you are not required to use MFA. You can log in with only your user name and password.

To configure safe locations, you must create a safe location and then assign it to one or more user groups. You create and edit safe locations on the Add Group or Edit Group pages.

Safe locations only apply to the groups they are assigned to. Users in a group that a safe location is not assigned to must still authenticate when they sign in from the safe location.

To configure a safe location:

1. On the Groups page, click the Name of the group you want to add a safe location to. You can also click Add Group if you want to create a new group to add a safe location to.

2. In the Safe Locations section, click Add Safe Location.

3. In the Name text box, type a name to identify this safe location. This helps you identify the safe location when you add it to other groups.
4. In the IP Mask text box, type a public IP address or netmask that defines the range of public IP addresses you want to consider as a safe location. You can specify multiple IP addresses and ranges in one safe location.

5. Click Save.
   The Add Safe Location window closes and the safe location is saved and added to your group.

6. Click Save.

Each safe location that you create can be assigned to multiple AuthPoint groups. You do not have to create the same safe location for each of your groups.

To add an existing safe location to a group:

1. Click the Name of the group you want to add a safe location to.
2. In the Safe Locations section, select a safe location from the list.

To sync users from an LDAP database, you must create a query for the external identity that you added. The queries you add to an external identity specify which users to sync from your Active Directory or LDAP database. They pull user information and create AuthPoint users for the users that are found.

There are two ways to query users:

• Group Sync — Select the LDAP groups you want to sync users from and AuthPoint creates the query for you
• Advanced Queries — Create your own LDAP queries to specify which groups or users to sync

In this example, we show the steps to use the group sync feature.

Before you continue, make sure that each user account has a valid email address. If the email address for a user account is not correct, the user cannot receive the email message to set a password and activate a token.

If the selected LDAP groups have more users than you have available licenses for, the sync only creates as many users as your license supports.

LDAP users that do not have a user name or email address are not included in the synchronization.

To sync LDAP groups:

1. Select External Identities.
2. Next to your external identity, click and select Group Sync.

3. On the Group Sync page, click Add New Group to Sync.

4. In the Add Group Sync window, from the Select LDAP Groups drop-down list, select the LDAP groups you want to sync users from. You can select multiple groups.

5. From the Select the Group drop-down list, select the AuthPoint group to add the users to.

   For each group sync, all users are added to the same AuthPoint group. To add users to separate AuthPoint groups, you must create a separate group sync for each LDAP group whose users you want in a different AuthPoint group.

6. Click Save.
   The Add Group Sync window closes.

After you add a query to find your users (manually or with group sync), AuthPoint syncs with your Active Directory or LDAP database at the next synchronization intervalThis is defined in the Synchronization Interval drop-down list on the LDAP Configuration page for your external identity. and an AuthPoint user account is created for each user identified by the query.

The created user accounts appear on the Users page with a green Activated status icon next to the user name. The Activated status icon indicates that the user has been created and is currently active (not blocked). You can identify users synced from an external identity by the LDAP tag next to their name in the list of users.

Each user is sent an email that they use to activate their token in the AuthPoint mobile app. When a user activates their token, their token information is shown in the Token column with a green Activated status icon next to the token.

Users synced from an external identity use their existing password for authentication. They do not receive the email to set an AuthPoint password.

To start a sync immediately, on the External Identities page, next to the your external identity, click and select Start Synchronization.