Section D: Authentication

About this section

This section provides information about authenticating users, including how to navigate to the Appliance Manager pages that allow you to configure authentication options, how to test which type of authentication (clear-text, or Microsoft Windows NTLM or Kerberos) the NetCache appliance is using, and where authentication information is logged. This section also describes how proxy authentication for streaming clients is performed.

Where to configure authentication

Authentication options are located on the Authentication pages of the Appliance Manager. To access the Authentication pages, select Setup tab > Authentication.

The options on the Authentication pages enable you to

Enable or disable requirement of client authentication per supported protocol
Create groups, add users, and edit user and group information for the local NetCache user database
For clear-text authentication, configure the authentication checking order that NetCache is to follow in attempting to authenticate users if your environment supports more than one method (for example, the local NetCache user database, LDAP, and NTLM)
Set default protocol access permissions for authenticated users who are not members of any group in the NetCache user database
Specify the authentication realm to be used for clear-text authentication and specify the length of time that user credentials are held in the cache
For clear-text authentication, enable or disable support for transparent proxy authentication
Specify the origin servers to which to forward proxy authentication credentials
Configure an LDAP server or a RADIUS server for NetCache authentication, if you use these databases
Enable and configure NTLM and Kerberos protocol support for the Microsoft Windows authentication environment

Namespace issues and other concerns

Using multiple authentication methods (databases) entails complexity, which can introduce problems. For example, sometimes a company transitions from one database to another, or sometimes the appliance is configured above multiple authentication domains that use different techniques. In the latter example, duplicate user names and group names can occur. Take these considerations into account, for example, if your company is transitioning from use of an LDAP server to exclusive use of the NetCache local user database for authentication or if you are using a combination of the two methods.

Testing the authentication server

To test whether NetCache is authenticating users using a clear-text authentication server, use your browser to access a Web site you prefer. If NetCache is configured correctly, you will be prompted for user name and password information.

Where authentication server information is logged

NetCache logs general information pertaining to authentication in the Messages log file. For example, if repeated authentication failures occur, NetCache logs a simple, explicit message noting that there were many authentication failures. You can use information such as this to assess if there might be a communication problem between the NetCache and the authentication server rather than a true failed attempt to authenticate the user.

NetCache logs this event as a connectivity error. Notification of this event in the log can be of importance to you as forewarning that a link is down between the NetCache appliance and the server.

Proxy authentication for streaming clients

The Authenticate Client Requests Using These Protocols option on the Authentication - General page in the Appliance Manager includes an Authenticate (MMS and RTSP) Requests item. This item allows you to enable proxy authentication for streaming clients. RTSP clients (RealPlayer, Quicktime Player) use Basic authentication only. MMS clients can use NTLM authentication.

If a streaming server requires client authentication, NetCache establishes a connection to the streaming server and forwards the authentication information given by the client. NetCache waits until the streaming server verifies the authentication request before delivering the stream to the client.

NetCache forwards the authentication information for every client, even if a client's request can be resolved by splitting an existing stream already authenticated for another client or by serving a stream from the cache.

If NetCache subsequently delivers a split stream to the client, NetCache closes the connection to the streaming server after the client has been authenticated. VOD (video on demand) connections are not terminated.