Sun Microsystems Netscape Enterprise Server, Руководство администратора

Страница: 328 / 532

What Is Access Control?
328 Netscape Enterprise Server Administrator’s Guide
Figure 14.1 Users see this dialog box when authenticating themselves to the server.
Note
If your server does not use SSL encryption, the username and password that the
end user types are sent in unencrypted text across the network. Someone could
intercept the network packets and read the username and password being sent
to Enterprise Administration Server. For this reason, User-Group authentication
is most effective when combined with SSL encryption or Host-IP authentication,
or both.
The server maintains two connections to the directory server. One of these is
used to authenticate users, by doing an LDAP bind as the specified user. The
other is permanently bound as the
binddn
specified in the Configure Directory
Service page, and is used for locating user entries and checking group
memberships. Only one HTTP request thread can access the directory server at
a time, which means that a global lock controls access to both LDAP
connections. This can be a potential performance bottleneck, especially when
combined with the fixed size of the ACL user/group cache.
Client Certificate Authentication
You can confirm users’ identities with security certificates before giving the
users access to your web site. You can do this in two ways:
• The server can use the information in the certificate as proof of identity.
• The server can verify the certificate itself if certificates are published in an
LDAP directory.