Hierarchy authentication and access control

Types of authentication

Members of a hierarchy can be configured to authenticate users, or they can be configured to authenticate to each other.

User authentication can be enabled on proxy-cache servers that receive user requests.

Hierarchy authentication can be enabled at higher levels, where requests are sent from proxy-cache servers at lower levels in the hierarchy. Multiple NetCache appliances can use the same user name and password to log in to a parent that requires hierarchy authentication. For example, you could require a child to authenticate to a parent cache. Similarly, you could require authentication between a child and cluster members.

Planning hierarchy authentication

When creating a plan for hierarchies, you need to determine whether you want to require lower-level NetCache appliances to authenticate to other members of their hierarchy. If you decide to require authentication, consider

The level at which to enable authentication, and whether you should require user authentication or hierarchy authentication
How you want request records shown in log files
You must decide what kind of request records you want in the log files at each level in the hierarchy. Whether the log files on parents and cluster members show the child NetCache appliance or the client depends on how you set up your hierarchy authentication scheme.

For information about log file entries, see the log file information in the online Help.

Child authentication schemes

When making decisions about how the NetCache appliance you are configuring (the child) authenticates to other members of the hierarchy, consider that a child can be configured to authenticate to a parent or pass client authentication to a parent.

Parent authenticates child

If you enable user authentication on the parent, then the parent database (NetCache, LDAP, or RADIUS) must contain the child's user name and password information. The child must be configured to send its user name and password to the parent. In the NetCache log file entries, the child proxy-cache server is identified as the sender of the request.

Parent authenticates clients (passthrough):

If you enable passthrough for authentication, the child passes client authentication to a parent. User authentication must be enabled on the cache that is authenticating the user. It is not necessary to enable authentication on both the parent and the child. In the NetCache log file entries, the client is identified as the sender of the request.

Content filtering within the hierarchy

Content filtering is most effective when performed by the child cache. If access restrictions are imposed on the child, then restricted content that can be accessed from the parent cannot be cached on the child. For example, if a user authenticates to a parent that allows access to restricted content, that user can make the content available to all users who have access to the child.

Consider an international ISP (NetCache Canada) that wants to prevent access to specific Web content in the United States (NetCache USA). An effective scheme to control access to content could be set up as follows:

NetCache Canada identifies NetCache USA as a parent, and is configured to forward all requests for origin servers in the United States to NetCache USA.
NetCache Canada is configured to authenticate users. Access controls are set to prevent access to specific content from U.S. Web sites.
NetCache USA is configured to authenticate NetCache Canada. The database on NetCache USA must contain a user name and password to authenticate NetCache Canada.
Note
Access control settings on higher-level proxy-cache servers are effective if all child caches have exactly the same access restrictions.

Where to find more information

For information about setting up authentication and access control for hierarchy members, see the Security Guide.