Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 445 / 552

Chapter 17.
427
Using the Pass-through Authentication
Plug-in
Pass-through authentication (PTA) is a mechanism which allows one Red Hat Directory Server
instance to consult another to authenticate bind requests. Pass-through authentication is implement
through the PTA Plug-in; when enabled, the plug-in lets a Directory Server instance accept simple bind
operations (password-based) for entries not stored in its local database.
Directory Server uses PTA to administer the user and configuration directories on separate instances
of Directory Server.
17.1. How Directory Server Uses PTA
If the configuration directory and the user directory are installed on separate instances of Directory
Server, the setup program automatically sets up PTA to allow the Configuration Administrator user
(usually
admin
) to perform administrative duties.
PTA is required in this case because the
admin
user entry is stored under
o=NetscapeRoot
suffix in
the configuration directory. Therefore, attempts to bind to the user directory as
admin
would normally
fail. PTA allows the user directory to transmit the credentials to the configuration directory, which
verifies them. The user directory then allows the
admin
user to bind.
The user directory in this example acts as the
PTA Directory Server
, the server that passes through
bind requests to another Directory Server. The configuration directory acts as the
authenticating
directory
, the server that contains the entry and verifies the bind credentials of the requesting
client.
The
pass-through subtree
is the subtree
not
present on the PTA directory. When a user's bind DN
contains this subtree, the user's credentials are passed on to the authenticating directory.
NOTE
The PTA Plug-in may not be listed in the Directory Server Console the same server
instance is used for the user directory and the configuration directory.
Here's how pass-through authentication works:
1. The configuration Directory Server (authenticating directory) is installed on machine A. The
configuration directory always contains the configuration database and suffix,
o=NetscapeRoot
.
In this example, the server name is
configdir.example.com
.
2. The user Directory Server (PTA directory) is then installed on machine B. The user directory
stores the root suffix, such as
dc=example,dc=com
. In this example, the server name is
userdir.example.com
.
3. When the user directory is set up on machine B, the setup script prompts for the LDAP URL of the
configuration directory on machine A.
4. The setup program enables the PTA Plug-in and configures it to use the configuration directory
LDAP URL.