The authentication process is one of the most common safety measures used for any service. AXIGEN clusters also use authentication and support a wide variety of algorithms as well as password encryption.

Any AXIGEN cluster can make use of the two authentication methods available:

• Internal Authentication - the account information defined and stored on the back-end is used to process the authentication request.
• LDAP Authentication - the LDAP directory tree is used to search, retrieve and process the authentication request.

While using the internal AXIGEN authentication system, the password is retrieved by the server from its local user information data. The password is defined during the account creation process and can be changed at a later time, either by the administrator or by the user from within the WebMail interface. This method does not require an LDAP server to be set up but is very slow by comparison.

LDAP authentication is very widely used in cluster setups because of the speed gain. Also, while using LDAP, the mapping system can be assigned to it and the resulting setup becomes a centralized configuration point for the proxy services. In addition, the LDAP server may already exist and contain the entries required, in which case the configuration overhead is reduced considerably.

The LDAP authentication isolates the process from the actual AXIGEN account defined. This can arise some unexpected results such as different passwords within the directory and the back-end server. While a user can still change its password from the WebMail interface, this password will not be updated in the LDAP tree structure and the user can become easily confused. To prevent such issues, a thorough synchronization process must be implemented within the cluster.

This type of authentication overrides the standard AXIGEN authentication method. As such, using LDAP to authenticate sessions for one service will also disable the internal authentication method for all services. LDAP authentication is performed using an LDAP connector that must be defined in advance. The directory tree must also be configured before the authentication process will succeed.

The authentication process consists of a three stage process:

• LDAP query - During this stage, AXIGEN performs a lookup in the directory tree and expects the account password information as the result.
• Credential information matching - Using the information gathered during the first stage, AXIGEN compares what the client provided against what LDAP returned.
• Session authentication - If the above process was successful the session becomes authenticated.
  

If any of the above stages fail for some reason, the session will not be authenticated. Thus, for the account that requests an authentication, the LDAP server must be able to return an entry and a valid password property.





For more details please visit AXIGEN LDAP Authentication.