waf http-authen http-authen-policy

Use this command to group HTTP authentication rules into HTTP authentication policies.

The FortiWeb appliance uses authentication policies with the HTTP authentication feature to authorize HTTP requests. For details, see the FortiWeb Administration Guide:

HTTPS://docs.fortinet.com/fortiweb/admin-guides

To apply HTTP authentication policies, select them in an inline protection profile. For details, see waf web-protection-profile inline-protection.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf HTTP-authen HTTP-authen-policy

edit "<auth-policy_name>"

set cache {enable | disable}

set alert-type {none | fail | success | all}

set cache-timeout <timeout_int>

set auth-timeout <timeout_int>

config rule

edit <entry_index>

set HTTP-authen-rule "<HTTP-auth-rule_name>"

end

Variable	Description	Default
"<auth-policy_name>"	Enter the name of a new or existing HTTP authentication policy. The maximum length is 63 characters. To display the list of existing policies, enter: `edit ?`	No default.
cache {enable \| disable}	Enable to cache client user names and passwords from remote authentication such as LDAP queries. Also configure cache-timeout <timeout_int>. This can be used can improve performance by preventing frequent queries.	No default.
alert-type {none \| fail \| success \| all}	Enter the instances when alerts will be issued for HTTP authentication attempts: `none`—No alerts are issued for HTTP authentication. `fail`—Alerts are issued only for HTTP authentication failures. `success`—Alerts are issued for successful HTTP authentication. `all`—Alerts are issued for all failed and successful HTTP authentication.	`none`
cache-timeout <timeout_int>	Enter the query cache timeout, in seconds. The valid range is 0–3,600. This option is available only when cache {enable \| disable} is enabled.	`300`
auth-timeout <timeout_int>	Enter the connection timeout (in milliseconds) for the query to the FortiWeb’s query to the remote authentication server in milliseconds. The valid range is 0–60,000. To prevent dropped connections if the authentication server does not answer queries quickly enough, increase this value.	`2000`
<entry_index>	Enter the index number of the individual entry in the table. The valid range is 1–9,999,999,999,999,999,999.	No default.
HTTP-authen-rule "<HTTP-auth-rule_name>"	Enter the name of an existing HTTP authentication rule. The maximum length is 63 characters. To display the list of existing rules, enter: `set HTTP-authen-rule ?`	No default.

Example

This example first configures a user group that contains both a local user account and an LDAP query.

config user user-group

edit "user-group1"

config members

edit 1

set type local

set local-name "user1"

edit 2

set ldap-name "user2"

set type ldap

end

Second, it configures a rule that requires basic HTTP authentication when requesting the URL /employees/holidays.html on the host www.example.com. This URL will be identified as belonging to the realm named “Restricted Area”. Users belonging to user-group1 can authenticate.

config waf HTTP-authen HTTP-authen-rule

edit "auth-rule1"

set host-status enable

set host "www.example.com"

config rule

edit 1

set request-url "/employees/holidays.html"

set authen-type basic

set user-group "user-group1"

set user-realm "Restricted Area"

end

Third, it groups two HTTP authentication rules into an HTTP authentication policy that can be applied in an inline protection profile.

config waf HTTP-authen HTTP-authen-policy

edit "HTTP-auth-policy1"

config rule

edit 1

set HTTP-authen-rule "HTTP-auth-rule1"

edit 2

set HTTP-authen-rule "HTTP-auth-rule2"

end