[MK In some cases, users will want the WAF to be the point of authentication, I feel this should be in “other functionality” do others agree? Authentication Considerations Scheme A. Client Side Are client certificates supported in all relevant modes for the Certificates deployment? For termination mode, can the content from client certificates be sent to the application using some alternative transport method (e.g. request headers). B. Basic Authentication C. Digest Authentication D. NTLM Authentication E. Other Many applications use an outside software or service for authentication. For example, higher security environments might require a two-factor authentication for users. These solutions might use a combination of the above methods in combination with proprietary capabilities. Verify the WAF supports the specific authentication product or service in use. Reverse Transparent Transparent Out of Embedded proxy reverse bridge line proxy Network Yes No No No No architecture changes Software Yes (1) No No No Yes - configuration requires changes installation on each web server that needs protection Site/application In some In some No No No changes cases (1) cases (1)
[MK In some cases, users will want the WAF to be the point of authentication, I feel this should be in “other functionality” do others agree? Authentication Scheme Considerations A. Client Side Certificates Are client certificates supported in all relevant modes for the deployment? For termination mode, can the content from client certificates be sent to the application using some alternative transport method (e.g. request headers). B. Basic Authentication C. Digest Authentication D. NTLM Authentication E. Other Many applications use an outside software or service for authentication. For example, higher security environments might require a two-factor authentication for users. These solutions might use a combination of the above methods in combination with proprietary capabilities. Verify the WAF supports the specific authentication product or service in use. Reverse proxy Transparent reverse proxy Transparent bridge Out of line Embedded Network architecture changes Yes No No No No Software configuration changes Yes (1) No No No Yes - requires installation on each web server that needs protection Site/application changes In some cases (1) In some cases (1) No No No
WAFEC_2_Environment_Support.docx