Authenticating with Kerberos

The Kerberos protocol  

The Kerberos protocol supports Microsoft Windows 2000 access to the Microsoft Windows authentication environment. Kerberos is the authentication method used with Microsoft's Active Directory.

Note
The Microsoft Windows 2000 Active Directory configuration and administration architecture allows for remote administration of systems and transaction of tasks that entail communications with centralized servers, including authentication.

Kerberos authentication is based on a shared-secret key distribution model in which NetCache validates tickets presented by the client (user). The ticket, which verifies the client's identity, is issued by the Kerberos Key Distribution Center (KDC). When a Kerberos client sends a request to NetCache and NetCache requests authentication, the client obtains a ticket from the Kerberos server and presents it to NetCache.

Kerberos keeps a database of its clients and their keys. The private key is a large number known only to Kerberos and the client. Private keys are negotiated at registration. Because Kerberos knows these keys, it can create messages that convince a server that a client is really who it claims to be.

Kerberos and backup protocols  

If Kerberos authentication is enabled, then the NetCache does the following:

1. NetCache first attempts Kerberos authentication of a requesting client against the Microsoft Windows 2000 Active Directory user database. If the appliance challenges the requesting client for Kerberos authentication, the client browser will automatically send a Kerberos ticket.
2. If the requesting client browser does not support Kerberos authentication, or if Kerberos authentication fails for some other reason, NetCache attempts to authenticate the user against a clear-text database, in response to the browsers request.

   For the clear-text method to use, the NetCache follows the order specified in the Authentication Checking Order option on the Authentication - General page.

   Note
   To support authentication of clients within a Microsoft Windows 2000 domain with browsers that do not support Kerberos authentication (such as Netscape), Network Appliance recommends enabling both Kerberos and NTLM authentication. For details on enabling NTLM, see Section , Authenticating with NTLM. For details on enabling Kerberos, see Section , Authenticating with Kerberos.

Configuring your browsers for Kerberos authentication  

NetCache supports Kerberos authentication of users using client browsers within a Microsoft Windows 2000 domain of a specific type and configuration. Network Appliance recommends that you do not use Kerberos for proxy authentication.

To use Kerberos for authentication, the following conditions must be met:

• The client browser must support Kerberos exchange. Currently, only Microsoft Internet Explorer is Kerberos-capable.

  Note
  Microsoft Internet Explorer 6 (MSIE 6) does not support authentication of a client to a proxy server (such as the appliance) using Kerberos.

• The client browser must be configured to access the appliance as a proxy server in nontransparent mode only.
• The client browser's proxy server setting must specify this appliance by its host name rather than its IP address. The host name of the appliance must be the same as the Microsoft Domain Name Services (MS-DNS) entry, and it must also match the machine-account name that the NetCache appliance used when it joined the domain.

  For example, on a client Microsoft Internet Explorer browser, you would use the following menu selections to specify the appliance host name, netcache.domain.com instead of its equivalent IP address:

  Tools > Internet Options > Connections > LAN settings > Use a 
  proxy server menu 
  

Testing Kerberos authentication  

To test whether NetCache is authenticating users using Kerberos, complete the following steps.

.

Copyright © 1994-2002, Network Appliance, Inc. All rights reserved.
Part No. 210-00370
File: auth13.htm
Last updated: 11/12/02 11:23:17