Section A: About authentication

About this section

This section introduces authentication services provided by the NetCache appliance. It gives a brief description of authentication and general information that is useful when planning NetCache client authentication and access to NetCache services.

What is authentication?

Authentication is the process of determining a user's identity so that the user becomes known to the system. NetCache allows you to require authentication for Web requests from clients using certain protocols, such as HTTP, HTTPS, FTP, NNTP, MMS, RTSP, and so on. NetCache also allows you to specify how that authentication is to be performed--for example, against the local NetCache user database, against a RADIUS database, or using the Microsoft Windows NTLM protocol server.

In addition to verifying a user's identity, authentication can be used in conjunction with access control to enforce local security domains, allocate resources, control bandwidth usage, and keep records of traffic and filter requests based on content.

Clear-text authentication

Clear-text authentication is performed using a base64-encoded user name and password information pair intended to identify the user. The pair is verified against information stored in a database or on a server.

Base64-encoding is intended to be easily decoded. For this reason, it is referred to as clear text.

You can configure NetCache to provide clear-text authentication for users against any of the following databases or servers: the NetCache user database, an LDAP server, a RADIUS server, and a Microsoft Windows domain controller.

Caching credentials

For clear-text authentication, after NetCache authenticates a user against an external server, such as LDAP or RADIUS or clear-text NTLM, each cached credential remains in the cache for one hour, by default. You can configure this caching Time-To-Live (TTL) value, increasing or decreasing it. Using the Authentication Server Cache TTL option on the Authentication - General page in the Appliance Manager, you can modify the frequency of cache interaction with an authentication server to authorize users.

For true NTLM, NetCache allows you to enable caching of NTLM challenges for reuse to reduce the processing load in the Microsoft Windows domain controller. To minimize the security risks that could result from caching the NTLM challenge, NetCache expires the challenge after a period of time, gradually phasing in a new challenge. Security precautions are added to the challenge; the client's IP address is used to render the challenge unique making replay attacks more difficult.

Here are the two main benefits of caching credentials on the appliance:

It speeds up NetCache response time. Because the appliance does not need to engage the external database yet again in the authentication process, it can respond to user requests more quickly.
It reduces the workload on the authentication server, which, when overloaded, can become a bottleneck.

The only case in which NetCache fetches the credentials from the authentication database for a user whose credentials are presently cached is when a user passes credentials that do not match those cached for an account.

Planning client authentication

NetCache is permissive by default, which means access to all protocols (HTTP, FTP, and so on) is allowed and authentication is not required (enabled) for any protocols. When you are planning client authentication, consider

For which protocols you want to require authentication
Consider whether you want to require users to supply a user name and password when requesting URLs over any or all of the following protocols: HTTP, HTTP-based tunneling (SSL), FTP, Gopher, NNTP, MMS, and RTSP.
Which supported method, or methods, of authenticating users best suits your environment
Which user database is to be queried first when authenticating users, if you support multiple authentication checking methods

Methods for authenticating users

NetCache supports various methods for authenticating users and provides options for regulating access to NetCache services. Supported methods for authenticating users are described in the following table.

Method	Description
NetCache user database	The native NetCache user database provides local authentication for users and administrators. (clear-text authentication)
LDAP authentication server	Lightweight Directory Access Protocol (LDAP) databases are commonly used as employee directory databases. You can enable NetCache to retrieve user and group data from an existing LDAP server to perform clear-text authentication.
RADIUS authentication server	Remote Authentication Dial-in User Service (RADIUS) was originally used to authenticate people logging in to the network through a modem to remote points of presence (POPs). You can enable NetCache to retrieve user data from an existing RADIUS server to perform clear-text authentication. Note RADIUS does not support groups.
NTLM (NT LAN Manager)	NTLM supports NT domain access to the Microsoft Windows authentication environment. NTLM (in true mode) performs authentication using an encrypted challenge-and-response sequence between NetCache and a Windows domain controller. NTLM can be used for clear-text authentication when used with a browser other than Microsoft Internet Explorer.
Kerberos (Windows 2000)	Kerberos version 5 is a new authentication protocol for Windows 2000 domain access. It is an industry standard developed by Massachusetts Institute of Technology (MIT) that offers mutual authentication to client and server. The Kerberos standard is described in Request for Comments (RFC) 1510. Kerberos authentication uses a private key cryptography referred to as a shared secret key distribution model in which NetCache validates tickets presented by the client (user). The key is considered symmetrical because both client (NetCache) and server (Windows 2000 DC running Kerberos) must prove that they know the shared secret; one party encrypts a message with the key, and the other party decrypts it.