Section B: Authenticating with the NetCache appliance

About this section

This section provides an overview of the NetCache authentication process and explains some of the processes entailed in authenticating a user.

When a connection authenticates

When a client attempts to authenticate with the NetCache appliance, NetCache carries out the authentication sequence shown in the following table (this verification process also entails authorization through access control).

Note
In HTTP, only true NTLM and Kerberos are authenticated per connection. Clear-text authentication requests are authenticated per request. (Other protocols might work differently.)

Stage	Description
1	Checks protocol authentication settings (authenticates the user).
2	Checks ACL permission settings for the applicable group in the NetCache user database.
3	Checks the request-type (protocol specific) ACL.
4	Checks the accelerator ACL.
5	Checks the global ACL.
6	Verifies whether SmartFilter or WebWasher DynaBLocator denies the request.
7	Checks group permissions settings.
8	Allows or disallows the request, based on the results of the authentication process.

When does NetCache authenticate a user?

NetCache authenticates a user for the first time under these circumstances:

When the user makes a request using a protocol, such as HTTP, for which authentication is enabled
When ACLs specifying authentication are applied, forcing authentication

If a user makes a request using a protocol for which authentication is not enabled, NetCache does not attempt to authenticate the user, even if authentication is enabled for other protocols. However, if the same user later uses a protocol that requires authentication, NetCache validates that user.

For example, consider two user sessions through a appliance that is configured as follows:

FTP authentication is enabled.
LDAP authentication is configured and enabled.
HTTP authentication is not enabled.

Example 1

If a user makes an FTP request, NetCache prompts the user for a user name and password, then authenticates the user to the LDAP server. Only after the user is authenticated does NetCache service the request.

Example 2

If a user makes an HTTP request, NetCache does not authenticate the user; NetCache just services the request. However, if the same user then makes an FTP request, NetCache prompts the user for a user name and password before servicing the request. For example, if authentication is enabled for HTTP, any HTTP client requests must be authenticated.

Types of authentication

The following table shows two primary categories of authentication.

Authentication type	How it works
Clear text	If a user makes a request that requires clear-text authentication, NetCache requests a user name and password and authenticates the user to the appropriate authentication server.
NTLM (for Microsoft Windows 2000)	NetCache undertakes an NTLM authentication handshake.
Kerberos (for Microsoft Windows 2000)	NetCache participates in the exchange of encrypted information based on a key (shared secret) used to authenticate both parties.

Authentication type

How it works

Clear text

If a user makes a request that requires clear-text authentication, NetCache requests a user name and password and authenticates the user to the appropriate authentication server.

NTLM (for Microsoft Windows 2000)

NetCache undertakes an NTLM authentication handshake.

Kerberos (for Microsoft Windows 2000)

NetCache participates in the exchange of encrypted information based on a key (shared secret) used to authenticate both parties.

Authentication checking order

NetCache allows you to specify the order in which it should check authentication resources for clear-text authentication if your environment includes more than one clear-text authentication method. You set the Authentication Checking Order list on the Authentication - General page to specify the clear-text authentication resources that you want the appliance to use.

This process does not apply to use of the NTML or Kerberos protocols in the Microsoft Windows 2000 environment. They are not included in the checking order for authentication methods.

Note
You should always include "local" in the authentication checking order, preferably first. Neglecting to do so can cause various administrative lockouts and delays.

NetCache carries out the process shown in the following table.

Stage	Description
1	NetCache prompts each user for a user name and password when the user attempts a request using a client protocol for which authentication is enabled (or when ACLs specifying authentication are applied, forcing authentication).
2	NetCache attempts to authenticate the user against the first method in the list.
3	If the first authentication attempt results in failure, NetCache tries the next authentication method in the list, and so on, until it succeeds in authenticating the user or has exhausted all possible authentication methods.

Note
The authentication order does not apply to Kerberos or true NTLM. Rather, it is used for clear-text authentication only.

A user is authenticated against the various databases following the preconfigured order. When authentication succeeds (that is, a match is found), any groups that a user belongs to are determined.