Netscape Certificate Management System 6.01, Manual

Page: 19 / 377

Overview of Authentication Modules
Chapter 1 Authentication Plug-in Modules 19
Table 1-1 lists the authentication modules provided for the Certificate Manager and
Registration Manager; no authentication modules are provided for the Data
Recovery Manager as it does not function as an enrollment authority in a PKI. You
can use these modules to configure a Certificate Manager and Registration
Manager to employ a specific authentication method during certificate
enrollments.
Note that the name of the Java class for an authentication plug-in is in this format:
com.netscape.cms.authentication.<plugin_name>
where
<plugin_name>
is the name of a plug-in module. For example, the Java class
for the
UidPwdDirAuth
module would be:
com.netscape.cms.authentication.UidPwdDirAuthentication
Because large corporations typically store corporatewide user, group, and
network-resource data in LDAP-compliant directories, the default authentication
modules provided for automated certificate enrollment use an LDAP directory for
authenticating users or for formulating certificate subject names, or for both. If you
already have an LDAP-compliant directory, such as Netscape Directory Server,
with end-user data, you can use that directory for any of the purposes mentioned
above. For example, if you have an NIS server and LDAP directory installations,
you can use the NIS server for authenticating end users and the directory for
formulating certificate subject names; end users will be required to provide only
their NIS user IDs and passwords during enrollment.
Table 1-1 Authentication plug-in modules for end user certificate enrollments
Plug-in module name Function
NISAuth
Authenticates end users based on their user IDs and passwords stored in a NIS
server. Optionally, uses an LDAP directory for formulating certificate subject
names. For details, see “NISAuth Plug-in Module” on page 35.
PortalEnroll
Authenticates online service users based on their user IDs and passwords stored
in an LDAP directory. Also registers new users for the online service. For details,
see “PortalEnroll Plug-in Module” on page 42.
UidPwdDirAuth
Authenticates end users based on their user IDs and passwords stored in an
LDAP directory. For details, see “UidPwdDirAuth Plug-in Module” on page 22.
UidPwdPinDirAuth
Authenticates end users based on their user IDs, passwords, and PINs stored in
an LDAP directory. For details, see “UidPwdPinDirAuth Plug-in Module” on
page 28.