8e6 Technologies Enterprise Filter Authentication R3000 User Manual

Page 36

HAPTER

1: I

NTRODUCTION

ILTERING

LEMENTS

6 T

ECHNOLOGIES

, R3000 I

NTERNET

ILTER

UTHENTICATION

SER

UIDE

6. For NT/LDAP users, if a user is authenticated, settings

for the user’s group or individual profile from the NT/
LDAP domain are applied and take precedence over any
IP profile.

a. If the user belongs to more than one group in an

authentication domain, the profile for the user is deter-
mined by the order in which the groups are listed in the
Group Priority list set by the global administrator. The
user is assigned the profile for the group highest in the
Group Priority list.

NOTE: On an LDAP domain, if a user belongs to a container, that
profile takes precedence over the group profile for that user.

b. If a user has an individual profile set up, that profile

supercedes all other profile levels for that user. The
user can have only one individual profile in each
domain.

c. If the user has a time profile, that profile takes prece-

dence over other profiles. A group time profile takes
precedence over a domain time profile, and an indi-
vidual time profile takes precedence over a group time
profile.

NOTE: A Radius profile is another type of authentication profile
and is weighted the same as NT/LDAP authentication profiles in
the precedence hierarchy.

7. An override account profile takes precedence over an

authentication profile or a time profile. This account may
override the minimum filtering level—if the override
account was set up in the master IP group tree, and the
global administrator allows override accounts to bypass
the minimum filtering level, or if the override account was
set up in the global group tree.

NOTE: An override account set up in the master IP group section
of the R3000 console takes precedence over an override account
set up in the global group section of the console.