Cisco ASA 5505 - Manual (Page 1517)

67-91
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 67 Configuring Connection Profiles, Group Policies, and Users
Configuring User Attributes
hostname(config-group-webvpn)# keep-alive-ignore 5
hostname(config-group-webvpn)#
Configuring Auto-Signon
To automatically submit the login credentials of a particular user of clientless SSL VPN to internal
servers using NTLM, basic HTTP authentication or both, use the auto-signon command in username
webvpn configuration mode.
The auto-signon command is a single sign-on method for users of clientless SSL VPN sessions. It passes
the login credentials (username and password) to internal servers for authentication using NTLM
authentication, basic authentication, or both. Multiple auto-signon commands can be entered and are
processed according to the input order (early commands take precedence).
You can use the auto-signon feature in three modes: webvpn configuration, webvpn group configuration,
or webvpn username configuration mode. The typical precedence behavior applies where username
supersedes group, and group supersedes global. The mode you choose will depend upon the desired
scope of authentication.
To disable auto-signon for a particular user to a particular server, use the no form of the command with
the original specification of IP block or URI. To disable authentication to all servers, use the no form
without arguments. The no option allows inheritance of a value from the group policy.
The following example commands configure auto-signon for a user of clientless SSL VPN named
anyuser, using either basic or NTLM authentication, to servers defined by the URI mask
https://*.example.com/*:
hostname(config)# username anyuser attributes
hostname(config-username)# webvpn
hostname(config-username-webvpn)# auto-signon allow uri https://*.example.com/* auth-type
all
The following example commands configure auto-signon for a user of clientless SSL VPN named
anyuser, using either basic or NTLM authentication, to the server with the IP address
10.1.1.0, using subnet mask 255.255.255.0:
hostname(config)# username anyuser attributes
hostname(config-username)# webvpn
hostname(config-username-webvpn)# auto-signon allow ip 10.1.1.0 255.255.255.0 auth-type
all
hostname(config-username-webvpn)#
Specifying HTTP Compression
Enable compression of http data over a clientless SSL VPN session for a specific user by entering the
http-comp command in the username webvpn configuration mode.
hostname(config-username-webvpn)# http-comp {gzip | none}
hostname(config-username-webvpn)#
To remove the command from the configuration and cause the value to be inherited, use the no form of
the command:
hostname(config-username-webvpn)# no http-comp {gzip | none}
hostname(config-username-webvpn)#
The syntax of this command is as follows:
• gzip—Specifies compression is enabled for the group or user. This is the default value.