Netscape ENTERPRISE SERVER 6.1, Руководство пользователя

Страница: 50 / 373

AuthTrans Stage
50 Netscape Enterprise Server NSAPI Programmer’s Guide • April 2002 (Draft)
You can measure the performance of any SAF in
obj.conf
by adding a
bucket=
bucket-name parameter to the function, for example
bucket=cache-bucket
.
To list the performance statistics, use the
service-dump
Service function.
As an alternative, you can use the
stats-xml
Service function to generate
performance statistics; use of buckets is optional.
For more information about performance buckets, see the Netscape Enterprise Server
Performance Tuning, Sizing, and Scaling Guide.
AuthTrans Stage
AuthTrans
stands for Authorization Translation.
AuthTrans
directives give the
server instructions for checking authorization before allowing a client to access
resources.
AuthTrans
directives work in conjunction with
PathCheck
directives.
Generally, an
AuthTrans
function checks if the username and password associated
with the request are acceptable, but it does not allow or deny access to the request
-- it leaves that to a
PathCheck
function.
The server handles the authorization of client users in two steps.
• AuthTrans Directive - validates authorization information sent by the client in
the Authorization header.
• PathCheck Stage - checks that the authorized user is allowed access to the
requested resource.
The authorization process is split into two steps so that multiple authorization
schemes can be easily incorporated, as well as providing the flexibility to have
resources that record authorization information but do not require it.
AuthTrans
functions get the username and password from the headers associated
with the request. When a client initially makes a request, the username and
password are unknown so the
AuthTrans
functions and
PathCheck
functions work
together to reject the request, since they can’t validate the username and password.
When the client receives the rejection, its usual response is to pop up a dialog box
asking for the username and password to enter the appropriate realm, and then the
client submits the request again, this time including the username and password in
the headers.
If there is more than one
AuthTrans
directive in
obj.conf
, each function is
executed in order until one succeeds in authorizing the user.