About access controls

What access controls do

Access control settings prevent unauthorized clients from accessing the NetCache appliance, and restrict the access of authorized clients to services. The appliance supports different types of rules that impose a variety of restrictions. Sets of rules, or access control lists (ACLs), are used to control access to the Internet, and to impose restrictions inside the intranet domain.

Internet setting

In an Internet setting, client access controls prevent unauthorized users outside your organization from resolving their Web requests through your cache and wide-area bandwidth. You can also set rules to limit access for authorized users.

Intranet setting:

In an intranet setting, client access controls can help enforce authentication and authorize exactly what users have access to.

Authorized access

When a user makes an authenticated request, NetCache checks the user against all groups in the NetCache user database, and attempts to match ACLs that are associated with those groups. If the request is not matched by user or group ACLs, then the request is checked against all other access control rules. If access is denied, a system message displays the rule and the name of the ACL that prevented access to NetCache services.

Note
See Chapter 1, Authenticating NetCache Users, for a description of NetCache client authentication and supported methods for authenticating administrators and users.

ACL rule checking

NetCache sequentially reads ACLs and checks for the first matching entry. When a match occurs, the action is executed. If no match occurs, no action is executed and rule checking continues.

The NetCache rule checking sequence is shown in the following table.

Stage	Description
1	Check global settings that control authentication for protocol requests.
2	Check ACL permission settings for the applicable group in the NetCache user database.
3	Check request-type (protocol specific) ACL.
4	Check Web accelerator ACL.
5	Check global ACL.
6	Verify whether the content filtering application (SmartFilter or WebWasher DynaBLocator) denies the request.
7	Check group permissions settings.
8	Allow the request.

Order of precedence

Types of rules and order of precedence are described in the following table.

Order	Type	Description
1	User and group	User and group rules explicitly allow, deny, or redirect requests. User and group ACLs have precedence over request-type, global, SmartFilter, and group access permissions.
2	Request-type (protocol specific)	Request-type rules control specific types of traffic. Access control rules are processed only for requests of a particular type, or protocol, such as HTTP. Request-type access controls have precedence over Global and SmartFilter access controls. If a request-type rule explicitly allows, denies, or redirects a request, NetCache follows this rule regardless of any rules configured in the Global Access Control option and any content category restrictions set in the SmartFilter options.
3	Accelerator	If a request originates from a Web-accelerator (reverse-proxy), this ACL is checked.
4	Global	Global rules impose restrictions on all traffic by allowing you to specify variables, such as a user name and a URL. Global access controls have precedence over SmartFilter rules. If a global rule explicitly allows, denies, or redirects a request, NetCache follows this rule regardless of any content category restrictions set in the SmartFilter or DynaBLocator options.
5	Content filtering application (SmartFilter or DynaBLocator)	Restricts access to Web sites that contain objectionable content. Rules apply only to URLs that are not explicitly allowed, denied, or redirected by global or request-type options.
6	Group access permissions	Group access permissions specify default access to services for groups, and control rewrites or redirects for blocked requests. Default rules apply to requests that have no rule matches.