Section C: Authenticating with the NetCache user database

About this section

This section describes the NetCache user database, which you can use to authenticate users. In addition, this section describes how to add users to the database, create groups and add users to them, and create administrator accounts.

About the NetCache user database

The NetCache user database contains local user and group information that provides NetCache with instructions for handling client requests.

You can use the NetCache user database in many different ways, depending on the requirements of your organization. For example,

If it is used to contain user information, the NetCache user database can provide Web protocol client authentication (by protocol) for users.
If it is used to contain system administrator user account information, it provides administrative access into the appliance if other configured methods of authentication in your environment are unavailable due to system or network failure problems.
Because it can contain group information, it can be used to assign user access permissions based on group membership.
Note
In a load-balanced NetCache environment that includes many appliances, for the NetCache local database to be effective as an authentication resource, its contents must be synchronized across all appliances. In this case, you must maintain the user database on each appliance separately. If the databases on cooperating appliances become unsynchronized, some users might be denied access to the Internet. To synchronize the content of the NetCache local database across all NetCache appliances, you can use central configuration management or Data Fabric Manager.

Authenticating administrators

System administrators cannot access the Appliance Manager unless the NetCache user database contains at least one user name and password. NetCache provides a default administrator account and a default NetCache group. The account user name is admin and the password is NetCache.

For the default system administrator, the default group is named "NetCache." Because the administrator user belongs to the NetCache group, all permissions assigned to the NetCache group apply to the default administrator account.

The default admin user account is configured with permissions to use all protocol services, as well as permissions to access the Appliance Manager and change the NetCache configuration.

Note
The administrator user account user name and password are case-sensitive.

Using the NetCache options for enabling protocol authentication for users, you can create profiles with different levels of access for NetCache administrators. For example, you can allow some administrators to monitor the status of NetCache, but prevent them from making configuration changes.You can apply different ACLs to different administrator accounts that you create.

Note
Do not rely on an external database to provide authentication for administrative users. If these settings are provided for NetCache through an LDAP or RADIUS authentication server, or the NTLM or Kerberos protocol, you risk administrative lockout in the event of authentication server or network downtime.

Authenticating users and groups of users

If you choose to authenticate using the NetCache user database, then user names, passwords, group memberships, and protocol permissions are assigned using the authentication user and group options in the Appliance Manager. Using these options, you can do the following:

You can individually add users.
Authenticated users who are not members of any groups are assigned default access permissions. There is only one set of default access permissions. Permissions cannot be modified on a per-user basis.
You can create groups, specify group memberships for users, and set access permissions for the group.
You can allow a user to be a member of one group or multiple groups. You can set and modify group access permissions on a per-group basis.

Grouping users is common practice and makes administering access to protocols less complicated than administering access by individual user. For example, NetCache can be configured to authorize access to FTP for users in the Engineering group while prohibiting access to FTP for the Marketing group.