Authentication

Authentication is the process of identifying yourself to the Directory Server. The authentication process enables the Directory Server to determine what operations you are allowed to perform on the directory. Note, however, that authentication is not always necessary; your directory administrator can configure the system so that permission is not required for some procedures.

By default, access to the directory is denied to all users with the exception of the directory administrator. However, most sites allow anonymous search access and self update access. The directory administrator defines the permissions that grant or remove access to the directory. Because permissions are determined on a site by site basis, you need to check with your directory administrator to find out what kind of access you have to the directory and which operations require authentication, if any.

This chapter contains the following sections:

Understanding Directory Access

One of the key tasks of the directory administrator is determining which users need access to the directory and the types of access required. The directory administrator grants and denies permission to the directory through the use of the access control mechanism. Using the access control mechanism, the directory administrator can allow or deny access:

The specific rights the administrator assigns can vary from user to user. For example, the administrator usually would grant read and search access to anonymous users and would grant write access only to a select group of authenticated users and groups, perhaps only from specific machines.

The following are just some of the things the directory administrator can do by applying permissions to the directory. The directory administrator can:

The Directory Server interface has no way of determining if you are required to authenticate before attempting any directory access. However, the interface assumes you must authenticate before modifying the directory tree in any way, and if you are not currently authenticated, it prompts you for authentication before you can make any modifications. If you do not authenticate, you are allowed only to perform the operations and access the portions of the directory that your directory administrator has set for anonymous access.

Authenticating to the Directory

In some situations, the Directory Server interface automatically prompts you to authenticate before continuing with an operation. You can also explicitly choose to authenticate by clicking the Authentication tab. Either way, the authentication procedure is as follows:

  1. Click the Authentication tab.
  2. Enter the name you want to use to identify yourself to the Directory Server:
  3. If the Directory Server interface displays a table of matching entries, select the link that corresponds to your directory entry. If your name is unique in the directory, the system skips this step.
  4. Enter your password and click Continue.
    Contact your directory manager if you do not know your password.
    After the authentication operations complete successfully, the interface displays a message indicating the amount of time for which your authentication credentials are valid. When this time has elapsed, you need to reauthenticate to the directory to continue your session. If your password has already expired you should either change it immediately or contact your system administrator.
  5. Click "Return to Main" to continue your Directory Server interface session.

Logging Out of the Directory

If you have authenticated to the Directory Server and want to return to anonymous access, do the following:

  1. Click the Authentication tab.
  2. Click the "Discard Authentication Credentials (log out)" button.

You are returned to anonymous access. To change from one type of access to another, you must authenticate to the Directory Server again. See Authenticating as a User or Authenticating as Directory Manager for more information.

Reauthenticating to the Directory

When you authenticate to the directory, you are given authentication credentials that are good only for a specific amount of time. By default, authentication credentials are valid for 120 minutes. However, this period is configurable by the directory administrator. If your authentication credentials expire before you have finished using the Directory Server interface, you must reauthenticate to the directory before your changes can be saved. The procedure for reauthenticating to the directory is the same as the procedure you originally used to authenticate to the directory.

Problems Caused by Incorrect Authentication

When you are not authenticated to the Directory Server, you are accessing the directory as an anonymous user. The types of operations you can perform as an anonymous user depend on the access controls set by your directory administrator. You may notice strange behavior when you try to perform a directory operation, such as a search. Although not explicitly stated by the Directory Server interface, the anomalies you encounter are often caused by improper authentication. The interface does not provide this information because doing so could compromise security.

The following table lists symptoms of some common problems along with the possible causes and the action you can take to fix the problem.

Symptom Cause Action
Search results are empty Either no entries match the search string you entered, or you are required to authenticate to the directory before performing this type of search operation. Try a different search operation. Or, if you are sure that there are entries that match the criteria you entered, authenticate to the directory.
Search results missing entries or missing attribute information from returned entries. Either you are not authenticated properly or you do not have access to the information. The directory administrator can specify that all or parts of the directory tree require authentication to access entries, or even certain entry attributes. In this situation, the Directory Server does not indicate that the information exists and that you do not have privileges to access it. Instead, it simply acts as if the information does not exist at all. This behavior is driven by the concern that knowing certain information exists in the tree, even if you are not allowed to see it, can pose a security risk. Make sure you are properly authenticated. Then, verify with your directory administrator that you have access to the directory information you need.
Operation fails after completion The directory is failing the operation because of improper authentication. Although, it may seem as if the interface's form action is failing the operation, the form is only passing the operation to the Directory Server, which is then failing the operation. The Directory Server interface simply reports the results of the operation. This occurs because the LDAP protocol does not currently allow the interface to know whether authentication is required before trying an operation. Using the interface, this situation can only arise if your authentication times out while you are creating or modifying the directory entry. Make sure you are properly authenticated and that your authentication has not timed out.
A table of entries is displayed during the authentication process Either your full name is not unique in the directory, or the name you entered does not exist in the directory. If your entry is displayed on the table, select the corresponding link and continue with the authentication process.

If your entry is not displayed on the table, click Cancel and then try authenticating again. Be sure to use your full name and not your user ID.

Username is correct, but authentication fails anyway Your password is incorrect.

If you enter a valid username but an incorrect password, and the username you supplied represents an NT person entry, the Directory Server attempts to authenticate you to the Windows network.

If that is not successful or the user name you supplied does not represent an NT person entry, you are given the choice to retry, close the window, or seek help.

Click Retry and then reenter your password.