About authentication components

Enhanced authentication with RADIUS with extensions

NetApp RADIUS extensions enhance the capabilities of standard RADIUS authentication. These NetApp vendor-specific extensions provide NetCache the ability to authorize requests based on IP address and URL, and to rewrite URLs and server names.

The primary goals when using NetApp RADIUS extensions in an e-Commerce deployment are for NetCache to obtain the user's identity but not to prompt for it and to simultaneously inform the NetCache appliance about authorization rules. The assumption in this case is that the IP address is known.

For example, many service providers maintain a mapping of IP addresses to users. A NetCache appliance queries a RADIUS server about the access permissions granted to a client that has a given IP address (referred to as RADIUS IP authentication).

The following illustration shows successful authentication based on client IP address; that is, the server did not have to prompt the client software for a user name and password.

As the previous illustration shows, the appliance sends the client IP address and requested URL to the RADIUS server. The RADIUS server passes the client IP address to the service provider's back-end server, which stores a list of customers. Because the IP address can be matched to the client IP address, the client is approved to view the stream.

The RADIUS server can allow the request (as shown in the previous illustration), deny it outright, or direct the NetCache appliance to prompt the user for authentication if the RADIUS server cannot match an IP address with a user.

Caution
NAT and firewalls can cause problems with RADIUS IP authentication.

Requirements for using NetApp RADIUS extensions are as follows:

The scheme can be used only if a RADIUS server is deployed.
The RADIUS server must be customized to use NetApp vendor-specific attributes for NetCache.
Several options must be configured on the NetCache appliance. (See Chapter 2, Planning for RTMON, for more information.)

RADIUS extensions are supported only for streaming media.

The following table summarizes the authentication, accounting, and authorization capabilities that are available with RADIUS extensions.

Component	Description
Authentication	Authentication is IP-based.
Accounting	The packet that the appliance sends to the RADIUS server contains the URL that the user requested. The RADIUS server extracts data about the URLs that your users have requested. That data can then be sent to another application server that can prepare the data for your analysis. The accounting capabilities provided by RADIUS extensions are more limited in scope than the capabilities provided by RTMON and provides "static" information. No real-time communication session is set up between the appliance and the RADIUS server for monitoring user activity, as is the case with RTMON. Using RADIUS extensions and RTMON together provides a robust solution for e-Commerce.
Authorization	Authorization functions are provided by the application server.

Component

Description

Authentication

Authentication is IP-based.

Accounting

The packet that the appliance sends to the RADIUS server contains the URL that the user requested. The RADIUS server extracts data about the URLs that your users have requested. That data can then be sent to another application server that can prepare the data for your analysis.

The accounting capabilities provided by RADIUS extensions are more limited in scope than the capabilities provided by RTMON and provides "static" information. No real-time communication session is set up between the appliance and the RADIUS server for monitoring user activity, as is the case with RTMON. Using RADIUS extensions and RTMON together provides a robust solution for e-Commerce.

Authorization

Authorization functions are provided by the application server.

Standard authorization methods

If the method that you are choosing to monitor and control your e-Commerce activities does not provide authentication (for example, RTMON), you can add an authentication component by selecting one of the standard authentication features that NetCache supports, or by using RADIUS extensions (if your network has a RADIUS server). NetCache supports the following standard authentication features:

Mechanisms for validating a clear-text credential
- RADIUS authentication server
  If your network has a RADIUS server, standard RADIUS authentication will provide basic authentication in which the user is prompted for a user name and password. If, however, you are interested in promptless user name and password authentication, you must use NetApp RADIUS extensions.
- LDAP authentication server
- NetCache local database
NetCache can also validate clear-text against a Windows domain.
Password encryption schemes
- NTLM (NT LAN Manager)
- Kerberos (Windows 2000)
NTLM and Kerberos can be used only with clients that support them.

The Security Guide and the Appliance Manager online Help discuss the standard authentication methods that NetCache supports.