Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=authentication-server-google-ldap

Google Secure LDAP

You can use Google Secure LDAP for authentication.

Requirements

You must have Google Secure LDAP configured in the Google Admin console. See About the Secure LDAP service.

Configure Google

Warning

This information was correct at the time of writing. Review the Google documentation to make sure you're following the most current steps. See the following links:

You must perform some steps in the Google Admin console before you can configure your firewall to use Google Secure LDAP for authentication. You must create an LDAP client for your firewall, download the certificate, and generate access credentials. Do as follows:

  1. Sign in to the Google Admin console.
  2. Go to Apps > LDAP.
  3. Click ADD CLIENT.
  4. Enter the LDAP client name and Description.
  5. Click CONTINUE.
  6. Configure the Access permissions according to your organization's requirements. See Configure access permissions.
  7. Click ADD LDAP CLIENT.
  8. Click Download certificate to download a .zip file that contains the certificate (.cer) and the private key (.key) files.
  9. Extract the certificate and the private key files to the location of your choice. Take note of the location.
  10. Click CONTINUE TO CLIENT DETAILS.
  11. Expand Authentication by clicking the card.
  12. Click GENERATE NEW CREDENTIALS.

  13. Take note of the Username and Password.

    Warning

    After you close this window, you can't view the password again. If the username or password in your firewall is incorrect, you must generate new credentials in the Google Admin console and reconfigure your firewall.

  14. Click CLOSE.

  15. Expand Service status by clicking the card.
  16. Click ON for everyone.

  17. Click SAVE.

    Google Secure LDAP is now ready for your firewall's authentication requests.

Configure Sophos Firewall

You can configure your firewall once you've completed the necessary steps in the Google Admin console. You must upload the Google certificate to your firewall and add Google Secure LDAP as an authentication server.

Upload the certificate

You must upload the Google certificate to your firewall to select it during your LDAP server configuration. Do as follows:

  1. Go to Certificates > Certificates and click Add.
  2. Enter a name.
  3. Select CER (.cer) from the drop-down list.
  4. For Certificate, click Choose File, select the certificate file you extracted earlier, and click Open.
  5. For Private key, click Choose File, select the private key file you extracted earlier, and click Open.
  6. Click Save.

Add a server

To use Google Secure LDAP for authentication, you must add it as an authentication server. Do as follows:

  1. Go to Authentication > Servers.
  2. Click Add.
  3. Select LDAP server as the Server type.
  4. Enter the name of the server.

  5. Configure the following settings:

    • Server IP/Domain: ldap.google.com
    • Version: 3
    • Connection security: SSL/TLS
    • Port: 636
    • Anonymous login: Turned off.
    • Bind DN: The username from your Google LDAP client's access credentials.
    • Password: The password from your Google LDAP client's access credentials.
    • Append base DN: Turned off.

  6. Select your Google certificate from the Client certificate drop-down list.

  7. Enter the Base DN or click Get base DN to get it from Google.

  8. Configure the following attributes:

    • Authentication attribute: UID
    • Display name attribute: CN
    • Email address attribute: mail
    • Group name attribute: memberOf
    • Expiry date attribute: expiry

  9. Optional: Click Test connection to test the firewall's connection with Google Secure LDAP.

  10. Click Save.

Next steps

  • Create an LDAP group. See Add a group.
  • Set your Google Secure LDAP server as an authentication method. See Services.