TCP/IP Tutorial and Technical Overview - IBM Redbooks

The DCE security service ensures secure communications and controlled
access to resources in this distributed environment. It is based on the
Massachusetts Institute of Technology's Project Athena, which produced
Kerberos. Kerberos is an authentication service that validates a user or service.
The current DCE security service (DCE 1.2.2) is based on Kerberos Version 5.
Because the DCE security service must be able to validate users and services, it
must also have a database to hold this information. This is indeed the case. The
DCE security service maintains a database of principals, accounts, groups,
organizations, policies, properties, and attributes. This database is called the
registry. Figure 13-9 shows a pictorial representation of the registry tree. The
registry is actually part of the cell directory namespace, although it is stored on a
separate server.
Figure 13-9 DCE: Registry directory structure
The DCE security service consists of several components:
...
sec
organization groups policy replist xattrschema accounts
MYGROUP1 MYGROUPn
USER1
Authentication service Handles the process of verifying that principals are
correctly identified. This also contains a ticket
granting service, which allows the engagement of
secure communications.
Privilege service Supplies a user's privilege attributes to enable
them to be forwarded to DCE servers.
Registry service Maintains the registry database, which contains
accounts, groups, principals, organizations, and
policies.
USERn
Access control list facility Provides a mechanism to match a principal's
access request against the access controls for the
resource.
Chapter 13. Remote execution and distributed computing 501
...