SMTP Authentication using an Active Directory group

This article applies to:

• Trustwave SEG 7.2.2 and above

Question:

• How do I configure SMTP Authentication for Active Directory users?

Procedure:

In SEG 7.2.2 and above, you can validate SMTP authentication for users against an AD group. In this case you do not need to enter individual accounts in the Configurator.

This functionality is implemented on the email processing servers. To use this functionality, the email processing servers must be joined to Active Directory and the network ports required by AD must be open for the email processing servers.

This functionality does NOT use the AD connector configured in MailMarshal.

To configure this functionality:

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Receiver key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Receiver
   • 10.X: value names have the prefix Receiver. (Receiver dot).
   • For full details of the location for each product version, see article Q10832.
3. Add the following value entries:
   • ADAuthenticationEnabled (DWORD)
     • Value: 1 to enable this functionality (0 to disable)
   • ADAuthenticationPath (REG_SZ)
     • Value: The CASE SENSITIVE full DN path of the user group such as
       CN=Auth Users,DC=test,DC=com
   • ADAuthenticationDomain (REG_SZ)
     • Value: The name of the AD domain to use if a domain is not provided when authenticating (in pre-2000 domain format)
4. Commit configuration.
5. Restart the Receiver service.

Operation:

To use this function:

• Users must be members of a specific group (not just an OU)
• Passwords MUST be sent in clear text to use this feature.
• To improve security, use authentication over TLS.

If ADAuthenticationEnabled is set, the following process occurs for each authentication attempt:

1. Check if the requested username includes a \ character. If not, use the domain name specified under ADAuthenticationDomain
   • Note: usernames in User@Domain format will not work.
2. Check that the domain exists and the user can be found in the domain. If this step fails, go to step 5 below.
3. Get the groups the user is a member of, and compare the groups returned to the ADAuthenticationPath value.
4. If the user is a member of the group, authenticate against the domain and return success or failure depending on the result.
5. If the user is not a member of the group, but the account is found in the accounts table in MailMarshal, then authenticate against the password set in MailMarshal and return success or failure depending on the result.
   • If the account is entered in MailMarshal with a blank password, authenticate against the domain.

Notes

Take due care when editing the Registry.