Authentication

uthentication is the process of identifying yourself to the Directory Server. The authentication process is necessary so that the Directory Server knows what operations you are allowed to perform on the directory tree. Note, however, that authentication is not always necessary; your directory administrator can allow certain kinds of access to be performed anonymously.

By default, access to the directory tree is completely denied for any user with the exception of the directory administrator. It is up to the directory administrator to define the permissions that grant or remove access to the directory tree. Because permissions are determined on a site by site basis, you need to check with your directory administrator to find out what kind of access you have to the directory tree.

User authentication

The Directory Server interface has no way of knowing whether you are required to authenticate before performing any directory access. However, the interface assumes you must authenticate before modifying the directory tree in any way, and if you are not currently authenticated, it prompts you for authentication before you can modify the tree.

Authentication consists of providing a name and a password to the Directory Server through the interface. The name you supply is actually the common name or full name for your entry in the directory.

At such a time as authentication has occurred, access to the directory is granted based on the access control mechanism defined for the directory and for your common name.

Performing authentication

In some situations, the Directory Server interface will automatically ask you to authenticate before continuing with an operation. You can also explicitly choose to authenticate by clicking on the Authentication button in the interface. Either way, the authentication process is identical:

  1. You are asked to enter your name. Enter your name as it would appear in the Directory Server (your common name or full name). Do not enter your userid or login for the local operating system. You can optionally authenticate as the directory manager (if you know the password) by clicking on the Authenticate as directory manager button.

  2. The Directory Server searches the directory tree to find all the entries that correspond to the name you provided.

  3. If multiple matches are found, you are shown a table identifying the matching entries. Locate your entry in the table and click on it. If only a single matching entry is found, you will skip this step.

  4. Once a single matching entry is located, the Directory Server interface prompts you for your password. Contact your directory manager if you do not know what your password is.

  5. If you enter the correct password, you will be authenticated to the directory tree. Click on Continue to continue working on the directory tree. Note that for security purposes, your authentication expires in a set amount of time from the time that you authenticate. The actual expiration time is set by you directory administrator.

  6. If you enter an incorrect password, you can click on the Retry button to enter a different password, or you can click on the Cancel button to return to the main screen in the Directory Server interface and continue operations as an anonymous user.

About permissions

The following are just some of the things the directory administrator can do by applying permissions to the directory tree. The directory administrator can:

Problems caused by incorrect authentication

Improper authentication can occur if your directory manager required you to authenticate before performing a search operation and you are not aware of this fact. Improper authentication can also occur if you simply forgot to authenticate before attempting the search operation.

If you attempt to authenticate and supply an unknown user name, the Directory Server will provide you with a list of names similar to what you entered for the user name. If one of these names is who you would like to authenticate as, click on that name and proceed with Performing authentication. If no names similar to what you entered are in the Directory Server, the Directory Server will leave you with a Cancel and Help button after an explanation of the problem.

If you enter a valid user name but an incorrect password, you will be given the choice to retry, close the window, or seek help. Click on the Retry button to enter the password again. Click on the Close window button to close the window, or click Help to read more on Performing authentication.

If you are not properly authenticated, then you are accessing the directory tree as an anonymous user. The consequences of this is largely determined by how your directory administrator has set up permissions for the directory tree.

Some of the (somewhat strange) behavior you might see if you have not authenticated properly is:

Finally, it is possible to authenticate properly and still be confronted with the preceding behavior. This is because the directory manager can set permissions based not just on who you log in as, but also where you log in from. That is, the directory manager can allow or deny access based on your system's host ID or IP address. Consult your directory administrator if you believe this is the situation.

Anonymous access

Anonymous access can be configured for the directory such that anyone can access the directory. In this situation, access is granted to users that provide no login name and no password. Anonymous access is configured using the Directory Server access control mechanism. Anonymous access can be limited to specific types of access (for example, access for searching) or to specific areas within the directory (for example, access to specific subtrees, individual entries, or even individual fields within an entry). Anonymous access is the default access granted until you authenticate.

If you have already authenticated to the Directory Server and wish to return to anonymous access:

  1. Click the Authentication button in the Directory Server interface.

  2. Click the Discard Authentication Credentials (log out) button.
You will be returned to anonymous access. To change your access you must authenticate to the Directory Server again. See the section Performing authentication for more information.

Directory manager authentication

The directory manager is the privileged directory user who has general write privileges for all or parts of the directory tree. The directory manager can be the unrestricted directory user (root DN) that is configured when the Directory Server is installed, but this is not necessarily the case. The actual identity of the directory manager is configurable. Therefore, the directory manager can be someone whose access to the directory is defined by the Directory Server access control lists (unlike the unrestricted directory user who is not affected by access control lists). It is assumed, however, that the directory manager has reasonably broad write privileges to the directory.

To authenticate as the directory manager:

  1. Click the Authentication button in the Directory Server interface.

  2. Click the Authenticate as directory manager button.

  3. Enter the password for the directory manager.

  4. Click the Continue button.