SSO Policy (Active Directory)

Navigation: Scenarios → SSO Policy

Configure Single Sign-On (SSO) so the TOORCE Firewall knows which Active Directory user is logged in on a LAN PC. User identity is then used in inline rules (Source Users / SSO groups) for identity-aware policies.

Network design

Domain users log in to Windows. The Logon Forwarder agent on the domain controller reads Security event 4624 and sends logon events to the firewall ingest API. The firewall maps users to SSO groups and applies rules.

Figure 1 — AD, Logon Forwarder, firewall SSO listener, and rule assignment

Component summary

Prerequisites

• Windows Active Directory domain controller reachable from the firewall
• LDAP service account for firewall → AD queries
• Firewall management access
• Logon Forwarder installer (Toorce Logon Forwarder Installer 1.0.13 or current build)
• Audit policy: Audit Logon enabled (event 4624)

Step 1 — Add Active Directory on the firewall

1. Go to Auth & Users → Active Directory (AD).
2. Click + Add New.
3. Fill in:

4. Click + Create Record and verify the AD connection test succeeds.

Full reference: Active Directory (AD)

Step 2 — Enable SSO listener on the LAN interface

The SSO listener must be enabled on the interface where domain clients connect (typically LAN).

1. Go to Network Settings → Interfaces.
2. Click Edit on the LAN interface (e.g. enp6s0).
3. Open the Admin Access tab (or interface SSO section).
4. Enable SSO listener on this interface.
5. Click Save.

Confirm SSO Server Listen Port under System Settings → General if your environment uses a custom port (default documented as 8443 for SSO services; agent ingest uses port 5000 — see Step 4).

See Network Interfaces

Step 3 — Install Logon Forwarder on the domain controller

Run the installer on the Active Directory server (or a dedicated forwarder host with Security log read access).

1. Launch Toorce Logon Forwarder Installer.
2. Set the install folder (default: C:\Program Files\LogonForwarder).
3. Set Endpoint URL to your firewall ingest address:

4. Enter API key if configured on the firewall (optional).
5. Timeout seconds: 10
6. Check Start service after install.
7. Click Install / Update.

Replace 192.168.100.1 with your actual firewall LAN/management IP.

Step 4 — Configure the agent and start the service

After installation, open Logon Forwarder (Admin UI) on the domain controller.

Remote destination

Audit policy

If disabled, click Create audit GPO or How to enable (GPO) so Security event 4624 is logged for domain interactive and RDP logons.

Service installation and runtime

1. Service EXE path: C:\Program Files\LogonForwarder\service\LogonForwarder.exe
2. Click Install (if not already installed).
3. Click Start — status should show Service: Running.

Step 5 — Test connection to the firewall

1. In Logon Forwarder, click Test connection.
2. Confirm success status (agent can reach http://<firewall-ip>:5000/ingest).
3. Click Save.
4. Log in to a domain PC on the LAN (interactive or RDP).
5. Open Recent logon events in the agent to confirm 4624 events are captured.
6. On the firewall, open Logs & Events → SSO Login Logs and verify new entries appear.

Step 6 — Add SSO groups on the firewall

Import or create SSO groups that mirror AD security groups used in policy.

1. Go to Auth & Users → Active Directory (AD) (or Local Users/Groups if SSO groups are managed there).
2. Sync or Add New group entries mapped to AD groups, for example:

3. Save each group and confirm members resolve from AD.

Groups must match AD group names/DNs used by logged-in users forwarded by the Logon Forwarder.

Step 7 — Assign SSO groups to an inline rule

Create or edit a firewall rule that matches traffic by SSO user/group instead of IP alone.

1. Go to Rules & Policies → Inline Rules → + Add New (or Edit).
2. Configure:

General

Interfaces

Source tab

Only users in the Finance AD group (identified via SSO) match this rule.

Destination

3. Click + Create Record.
4. Click Install Policy.

Source Users field reference: Inline Rules

Example policy set

Verification checklist

Troubleshooting

Related topics

• Active Directory (AD)
• Network Interfaces
• Inline Rules
• SSO Login Logs
• System Settings — General
• All Scenarios