waf http-authen http-authen-rule

Use this command to configure HTTP authentication rules.

Authentication rules are used by the HTTP authentication feature to define sets of request URLs that will be authorized for each user group.

You apply authentication rules by adding them to an authentication policy, which is ultimately selected within an inline protection profile for use in web protection. For details, see waf HTTP-authen HTTP-authen-policy.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf HTTP-authen HTTP-authen-rule

edit "<auth-rule_name>"

set host "<protected-hosts_name>"

set host-status {enable | disable}

config rule

edit <entry_index>

set authen-type {basic | digest | ntlm}

set request-url "<path_str>"

set user-group "<user-group_name>"

set user-realm "<realm_str>"

end

Variable	Description	Default
"<auth-rule_name>"	Enter the name of a new or existing rule. The maximum length is 63 characters. To display the list of existing rules, enter: `edit ?`	No default.
host "<protected-hosts_name>"	Enter the name of a protected host that the `Host:` field of an HTTP request must be in order to match the HTTP authentication rule. The maximum length is 256 characters. This setting applies only if `host-status` is `enable`.	No default.
host-status {enable \| disable}	Enable to apply this HTTP authentication rule only to HTTP requests for specific web hosts. Also configure host "<protected-hosts_name>". Disable to match the HTTP authentication rule based upon the other criteria, such as the URL, but regardless of the `Host:` field.	`disable`
<entry_index>	Enter the index number of the individual entry in the table. The valid range is 1–9,999,999,999,999,999,999.	No default.
authen-type {basic \| digest \| ntlm}	Select which type of HTTP authentication to use, either: basic—Clear text, Base64-encoded user name and password. Supports local user accounts, and RADIUS and LDAP user queries. NTLM user queries are not supported. digest—Hashed user name, realm, and password. RADIUS, LDAP and NTLM user queries are not supported. ntlm—Encrypted user name and password. Local user accounts and RADIUS and LDAP user queries are not supported.	`basic`
request-url "<path_str>"	Enter the literal URL, such as `/employees/holidays.html`, that a request must match in order to trigger HTTP authentication. The maximum length is 256 characters.	No default.
user-group "<user-group_name>"	Enter the name of a user group that is authorized to use the URL in request-url "<path_str>". The maximum length is 63 characters. To display the list of existing user groups, enter: `set user-group ?`	No default.
user-realm "<realm_str>"	Enter the realm, such as `Restricted Area`, to which the request-url "<path_str>" belongs. The maximum length is 63 characters. Browsers often use the realm multiple times. It may appear in the browser’s prompt for the user’s credentials. Especially if a user has multiple logins, and only one login is valid for that specific realm, displaying the realm helps to indicate which user name and password should be supplied. After authenticating once, the browser may cache the authentication credentials for the duration of the browser session. If the user requests another URL from the same realm, the browser often will automatically re-supply the cached user name and password, rather than asking the user to enter them again for each request. The realm may be the same for multiple authentication rules, if all of those URLs permit the same user group to authenticate. For example, the user group `All_Employees` could have access to the request-url "<path_str>" URLs `/wiki/Main` and `/wiki/ToDo`. These URLs both belong to the realm named `Intranet Wiki`. Because they use the same realm name, users authenticating to reach `/wiki/Main` usually will not have to authenticate again to reach `/wiki/ToDo`, as long as both requests are within the same browser session. This field does not appear if authen-type is `ntlm`, which does not support HTTP-style realms.	No default.

Example

For an example, see waf HTTP-authen HTTP-authen-policy.