# Define Authentication Method elements for external servers

Authentication Method elements represent the types of authentication provided third-party external authentication servers in user properties, and IPv4 or IPv6 Access rules.

##

You can use the following predefined Authentication Method elements without configuring a custom Authentication Method element:

- Network Policy Server — This Authentication Method for NPS is automatically used for authentication with Microsoft NPS and Active Directory.
- LDAP Authentication — You can use this Authentication Method in the properties of LDAP Server or Active Directory Server elements that provide simple password authentication against the external LDAP database.

To use other external authentication servers, or to use an Active Directory server for RADIUS-based authentication, you must define custom Authentication Method elements.

Each Authentication Method element can be associated with one or more servers, but each RADIUS Authentication Server or TACACS+ Authentication Server can only be associated with one Authentication Method element. When multiple servers are associated with the same Authentication Method element, the servers are used as alternative servers if the first contacted server does not respond. All servers associated with the same Authentication Method element must contain identical information for each authenticating user. It is not possible for the user to determine which of the alternative servers is contacted.

Authentication Method elements are used in the following configurations:

- In directory server element properties and in User and User group properties to specify the allowed authentication methods for the users.
- In the properties of a RADIUS or TACACS+ Authentication Server, or an Active Directory Server to specify the authentication method offered by the server.
- In the IPv4 or IPv6 Access rules to specify which authentication method users are required to use.

The RADIUS and TACACS+ protocols are generic communications protocols for user authentication. You can use many different types of authentication methods that use the RADIUS and TACACS+ authentication protocols, such as static passwords, one-time passwords, or any other user name/passcode-type authentication schemes.

Engines can also use the Internet Authentication Service (IAS) in previous Windows Server versions or the Network Policy Server (NPS) in Windows Server 2008 to authenticate end users. If you use a Windows Server’s IAS/NPS service for authentication, define Active Directory Server elements instead.

For more details about the product and how to configure features, click Help or press F1.

## Steps

1. Select User Authentication.
2. Browse to Authentication Methods.
3. Select New > Authentication Method.
4. Configure the settings, then click OK.

## Authentication Method Properties dialog box

Use this dialog box to configure an Authentication Method element for external authentication servers.

Option | Definition
--- | ---
Name | The name of the element.
Type | Select the type of authentication method that you want to use: RADIUS TACACS+ SAML OpenID
Authentication Servers | Shows the selected RADIUS or TACACS+ Authentication Server elements. Click Add to add an element to the list, or Remove to remove the selected element. Note: This field is only displayed, if you have selected the RADIUS or TACACS+ option from the Type drop-down list.
Identity Provider Metadata | Configure theIdentity Provider Metadata details to establish trusted and secure communication with the IdP: Click the Configure button. From the Import from drop-down list, select one of the following options: Note: The fields below the Import from drop-down list change as per the options selected from the Type drop-down list. URL IdP Metadata If the URL option is selected: In the URL filed, enter the URL from where the IdP metadata details can be fetched. Click the Check Connectivity button to check if the URL works. Click The OK button. If the IdP Metadata option is selected, do one of the following: Click the Import button: Click the Browse button. Navigate to the location where the metadata file is stored. Select the file and then click the Open button. Note: Only the xml file format is supported. Click the OK button. In the text field: Paste the IdP metadata details. ii. Click the OK button. Note: This field is only displayed, if you have selected the SAML option from the Type drop-down list.
Group Attributes | Enter group attribute names to look for in SAML response. Click Add to add a group attribute name to the list. Click Remove to remove the selected group attribute name from the list.
OpenID Discovery URL | Enter the URL from where SMC will fetch the details about the OpenID connect authorization server. Note: This field is only displayed, if you have selected the OpenID option from the Type drop-down list.
Client ID | Enter the public identifier for SMC Web Access application. Note: This field is only displayed, if you have selected the OpenID option from the Type drop-down list.
Client Secret | Enter the client secret that is used by SMC Web Access to authenticate itself. Note: This field is only displayed, if you have selected the OpenID option from the Type drop-down list.
Username Attribute Name | For OpenID: Enter the ID token that is claimed to be used as the username (default: preferred_username). For SAML: Enter the name of SAML2 attribute that defines the username. Note: This field is only displayed, if you have selected the OpenID or SAML option from the Type drop-down list.
Trust Certificate Authority | Select a certificate authority that is used to connect to the OpenID server. Click Select to select the element. Note: This field is only displayed if you have selected the OpenID option from the Type drop-down list.
Comment (Optional) | A comment for your own reference.