IBM DFS, Reference Manual

Page: 29 / 67

The dfsgw add command can be used to refresh DCE credentials. If they are
not refreshed, DCE credentials (tickets) expire after the lifetime specified by
the DCE Security Service. After they expire, the tickets can no longer be used
for authenticated access. To end an authenticated session before the ticket
lifetime has passed, you can issue either of the following commands:
v
From the NFS client from which authenticated access to DFS is provided,
enter the dfs_logout command. (See “Authenticating to DCE from an NFS
Client”)
v
From the Gateway Server machine via which the DFS is accessed, enter the
dfsgw delete
command. (See “Authenticating to DCE from a Gateway
Server Machine” on page 21)
Both commands remove the entry from the authentication table that provides
authenticated access from the NFS client. Regardless of which command you
used to establish the DCE credentials (dfs_login or dfsgw add), you can end
the authenticated session with the dfs_logout command or the dfsgw delete
command. Neither command affects authenticated access from the other NFS
clients. If your DCE credentials are the basis of another entry in the
authentication table, you still have authenticated access via that other entry.
To refresh your DCE credentials before they expire, use the dfsgw add
command, which refreshes the ticket lifetime of your existing TGT. to obtain
new credentials, then use the dfs_login or dfsgw add command to replace
your existing TGT with the new TGT.
Note that if you configure multiple Gateway Server machines, each server
machine houses its own authentication table. The dfs_login and dfs_logout
commands affect entries only in the authentication table maintained on the
Gateway Server machine they contact; commands in the dfsgw suite affect
entries only in the authentication table on the machine on which they are
issued.
Authenticating to DCE from an NFS Client
The dfs_login command authenticates a user to DCE from an NFS client. The
command contacts the DCE Security Service to obtain a TGT and a service
ticket for the Gateway Server (dfsgwd) process for the user. It encrypts the
user’s TGT with the service ticket and sends these to the Gateway Server
process. It also sends the UID of the user who issues the command and the
network address of the NFS client from which the command is issued. The
Gateway Server process uses this information to create a valid login context,
including a PAG, and an entry in the authentication table for the user.
Note: The dfs_login and dfs_logout commands are not provided with DFS;
these commands are provided by your NFS vendor. The instructions
Chapter 4. Accessing DFS from an NFS Client
19