Defining LDAP users and groups without browsing an LDAP server

You can include users and user groups in access policy rules for a managed engine even if SMC is not able to query an external LDAP or AD server.

1. Create an LDAP server. For more information, refer to the Create LDAP Server or Active Directory Server elements topic.
   Note: This step can be skipped, if the LDAP server is already created.
2. Create a new Authentication domain. For more information, refer to the Define Authentication domain elements topic.
   Important: Uncheck the SMC – Browse Users and Groups checkbox and select the Engine – Resolve Users and Groups checkbox to create your own users or user groups and use them in access policy rules for authentication when SMC is not able to communicate with the external LDAP or AD server.
3. Do one of the following:
   • Create users or user groups manually for the newly created External LDAP domain. For more information:
     • On how to create a user, refer to Create External User elements topic.
     • On how to create a user group, refer to Create External User Group elements topic.
   • Import users and user groups by using an LDAP Data Interchange Format (LDIF) file. For more information, refer to Import user and user groups into an Authentication domain topic.
4. Use the user or user group in the access policy. Below is an example access rule:

   Table 1.

   Source	Destination	Service	Action
   User or User Group	ANY	ANY	Allow
   User or User Group	Engine	Remote desktop	Deny