The authentication process in a clustering environment can be performed either on the front-end or back-end nodes. This is why, depending on the setup to be deployed, LDAP authentication may not be required. A good example of such setup is the one-tier cluster.

To delegate the authentication process to the proxy servers, a user password property must exist in all directory entries. Using the information stored in that field, the proxy service can compare the information provided by the client with what it found as a result of the lookup.


The password may contain information in one of the following formats:

• Clear text is a rather insecure method of storing passwords, but has very low processing power requirements. In addition, the speed at which the authentication process is performed is greater than for any of the other formats.
• Plain text will allow the password to be retrieved without binding to the LDAP server, but it will be encoded in base64 format. The password can easily be recovered if public access to the LDAP server is allowed.
• Encrypted hashes is the most secure method of storing passwords. However, they can be retrieved only by binding to the LDAP server using a privileged account. The connector should be set to bind and the account details should be filled in before attempting to use this format.

The authentication process takes place on the front-end systems only if LDAP authentication is enabled for the proxy services. The authentication itself is actually performed twice, once on the front-end and once on the back-end. This would appear useless, while in fact, with the help of the front-ends only valid authentication requests will reach the back-end systems. Another advantage for using front-end authentication is preventing third-parties from ever reaching the back-end systems directly. This is a very important security feature and should be enforced as often as possible.



For more detailed information please see AXIGEN Authentication System and AXIGEN LDAP Authentication.